now it's broken ... (debian & ubuntu)
new certificates can no longer be created and the check shows for a certificate that was generated an hour before:
any idea how to proceed?
now it's broken ... (debian & ubuntu)
new certificates can no longer be created and the check shows for a certificate that was generated an hour before:
any idea how to proceed?
now it's broken ... (debian & ubuntu)
new certificates can no longer be created and the check shows for a certificate that was generated an hour before:
any idea how to proceed?
we had the same problems, here is a hot fix which worked for us:
what it does:
- adding new letsencrypt CA cert to /etc/ssl/certs
- removing "-CAfile fullchain1.pem" from openssl command (its not necessary anymore because openssl knows it now)
Regards, Joern
ps: Debian 9 / i-MSCP 1.5.3 Build: 2018120800
Build: 2018120800
Display Morewe had the same problems, here is a hot fix which worked for us:
cd /usr/share/ca-certificates/mozilla/
wget https://letsencrypt.org/certs/lets-encrypt-r3.pem
mv lets-encrypt-r3.pem lets-encrypt-r3.crt
dpkg-reconfigure ca-certificates
-->> choose new letsencrypt Cert
vi /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm +134
comment out line 134
my $cmd = [
'openssl', 'verify',
# ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),
'-purpose', 'sslserver', $self->{'certificate_container_path'}
];
Regards, Joern
ps: Debian 9 / i-MSCP 1.5.3 Build: 2018120800
Build: 2018120800
Thank You!
should only the mozilla/letsencryypt-r3.crt selected in the dialog?
I mean should any other be de-selected?
no, just added the cert.. dont know if the others are necessary.. (?)
your welcome
no, just added the cert.. dont know if the others are necessary.. (?)
your welcome
OK, it seems it shows existing & available, only one cert (letsencrypt) was added
in /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm
Only 'openssl', 'verify' should remain active?
just comment out line 134
# ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),
just comment out line 134
# ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),
yeah, it seems to work ...
great job, respect!
Thanks a lot
openssl verify still shows an error but the certificate seems to be valid
I also tried to remove the CA X3 incl. reboot afterwards but that didn't change anything ...
this is what the patch does... it deletes the "-CAfile fullchain.pem"
you dont need it anymore cause openssl got the CA now in /etc/ssl/certs