LetsEncrypt - SSL certificate is not valid

**fulltilt** · Oct 1st 2021

everything seems to work with the letsencrypt patch, but I discovered a problem when installing a purchased certificate ...

To install a paid certificate line 134 needs to be reactivated in OpenSSL.pm (afterwards deactivate again).

Therefore I have deactivated / changed the button links in the client theme to prevent customers being able to create and edit certificates themselves except letsencrypt

Code

# nano /var/www/imscp/gui/themes/default/client/domains_manage.tpl
#from:
<a href="{CERT_SCRIPT}" class="icon i_edit" title="{VIEW_CERT}">{VIEW_CERT}</a>
#to
<a href="" class="icon i_edit" title="{VIEW_CERT}">{VIEW_CERT}</a>
service imscp_panel restart

also w/ any other line with {CERT_SCRIPT} for alias, alias-sub, sub ...

or simply

Code

sed -i 's|{CERT_SCRIPT}||g' /var/www/imscp/gui/themes/default/client/domains_manage.tpl
sudo service imscp_panel restart
# reverse - make buttons available again
sed -i 's|""|"{CERT_SCRIPT}"|g' /var/www/imscp/gui/themes/default/client/domains_manage.tpl
sudo service imscp_panel restart

I will try to make this accessible only to the administrator

if ... admin

<a href="{CERT_SCRIPT}" ...

else

<a href=""

...

**fulltilt** · Oct 2nd 2021

Quote from Nuxwin

It's not working ok... but ... any relevant data would be welcome.

Thank you...

Nuxwin

some details about the expired letsencrypt certificates (certbot-auto affected)

Intermediate R3 expired on 9/29/2021 at 19:21:40 (GMT)

DST Root CA X3 expired on 9/30/2021 14:01:15 (GMT)

https://letsencrypt.org/docs/d…xpiration-september-2021/

**Athar** · Oct 3rd 2021

Was valid until 6th of October.

Display Spoiler

~~So far, the best solution I found to avoid modifying any code anywhere, is to manually change the CA Bundle in the DB then manually rerun the request manager.~~

~~I also disabled the "X3" CA cert.~~

~~When a LE cert is generated, you should go the X1 issuer issue : "unable to get issuer certificate"~~

~~Going to the i-MSCP DB, then in table "ssl_certs", search your domain.~~

~~Replace the content of "ca_bundle" with :~~

~~This is the R3 and the old X3, both issued by ISRG Root X1.~~

~~Also there, set the status to "toadd"~~

~~On your server, just run :~~

~~perl /var/www/imscp/engine/imscp-rqst-mngr~~

~~And you should be good with the LE cert, for the next 3 months (when you'll have to do this again... unless we got a fix for the generated fullchain with the correct CA Bundle).~~

**Nagilum** · Oct 4th 2021

Quote from vege.net

we had the same problems, here is a hot fix which worked for us:

Code

cd /usr/share/ca-certificates/mozilla/

wget https://letsencrypt.org/certs/lets-encrypt-r3.pem

mv lets-encrypt-r3.pem lets-encrypt-r3.crt

dpkg-reconfigure ca-certificates # -->> add new letsencrypt Cert

vi /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm +134 #comment out line 134

my $cmd = [

'openssl', 'verify',

# ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),

'-purpose', 'sslserver', $self->{'certificate_container_path'}

];

Display More

what it does:

- adding new letsencrypt CA cert to /etc/ssl/certs

- removing "-CAfile fullchain1.pem" from openssl command (its not necessary anymore because openssl knows it now)

Regards, Joern

ps: Debian 9 / i-MSCP 1.5.3 Build: 2018120800uild: 2018120800

Display More

Thank you for the hot fix. It helped me very well to calm down and to enjoy my weekend as planed!

/Nagilum

**bytewerk.net** · Oct 4th 2021

Thnx for your workaround.

**kess** · Oct 4th 2021

Hello guys,

there you can find the solution I've adopted in order to get the systems working with every type of certificate (self signed, from CA or Let's Encrypt)

I didn't change absolutely nothing in the code of i-MSCP, everything is original.

The following has been tested ONLY on Debian Stretch x64, with a standard i-MSCP installation. No strange things.

1. Integrate the new LE CAs in your system:

Code

mkdir /usr/share/ca-certificates/letsencrypt
curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/isrgrootx1.crt https://letsencrypt.org/certs/isrgrootx1.pem
curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/isrg-root-x2.crt https://letsencrypt.org/certs/isrg-root-x2.pem
curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/isrg-root-x1-cross-signed.crt https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem
curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/lets-encrypt-r3.crt https://letsencrypt.org/certs/lets-encrypt-r3.pem
curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/lets-encrypt-r3-cross-signed.crt https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem
curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/lets-encrypt-r4.crt https://letsencrypt.org/certs/lets-encrypt-r4.pem
curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/lets-encrypt-e2.crt https://letsencrypt.org/certs/lets-encrypt-e2.pem
dpkg-reconfigure ca-certificates

Here a Dialog appears.

- In the first dialog choose "yes"

- In the second select your new 7 CA certificates to import and then click OK

The result should be as follows:

Code

Updating certificates in /etc/ssl/certs...
7 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.

2. Remove any previous certbot versions:

Code

apt remove certbot

3. Install the new and supported certbot version

Code

apt install snapd
snap install core && snap refresh core
snap install --classic certbot

4. Optional, but recommended, edit the file /var/www/imscp/gui/plugins/LetsEncrypt/config.php and update the section as follows:

Code

'certbot_create_options' => [
'--preferred-chain ISRG Root X1'
],

Save and close;

5. Remove previous symlinks that could still exist, we'll fix them in next steps:

Code

rm /usr/bin/certbot
rm /usr/local/sbin/certbot

6. HIT THE "UPDATE PLUGINS" BUTTON here: https://your.server.panel:1234/admin/settings_plugins.php

If everything goes well, the LE Plugin will reconfigure.

7. Now it's time to fix the symlinks:

Code

rm /usr/bin/certbot
ln -s /snap/bin/certbot /usr/bin/certbot
rm /usr/local/sbin/certbot
ln -s /usr/bin/certbot /usr/local/sbin/certbot

8. Now a little check:

Code

which certbot
Result:
- /usr/local/sbin/certbot
which -a certbot
Result:
- /usr/local/sbin/certbot
- /usr/bin/certbot
- /snap/bin/certbot

9. And the final check:

Code

/usr/local/sbin/certbot --version
Result:
certbot 1.19.0

Now your system will have:

- The new CA from LE that it didn't have before

- The new supported version of certbot that knows the new chains

I tested the procedure on more boxes and it works for certificates creation and for certificates revocations. I don't know if it works for renewals. Please test it and kindly report back.

Hope it helps,

bye Kess.

**fulltilt** · Oct 4th 2021

Thanks Kess! It works with my test vps ... but I think it would be a better idea to be patient until Nuxwin is done with his work.

Manual changes in database or OS (via snapd sources) could possibly cause problems afterwards ...

For now I prefer the solution of vege.net ... an undo is very simple because only line 134 needs to be activated again.

**kess** · Oct 4th 2021

Hi fulltilt ,

thx for your reply.

With that solution, nothing has been changed in i-MSCP files or Database, everything is original.

Regarding snapd, it runs in its own sandbox... everything you have on your systems is included in /snap directory.

Problems ? I can't see... but if you don't like it in 1 or 2 years, just uninstall it using apt or apt-get and everything will be exactly as before...

certbot-auto has become unsupported, this is the only official method for managing LE Certs (Certbot documentation on eff.org).

I didn't test using the Debian Packaged Certbot in order to see if it works... I don't know if the new chains are managed or not. I'm sure the --preferred-chain option will not work on version 0.28.0 (Debian 9 packaged version).

It's up to you...

Bye Kess

**fulltilt** · Oct 5th 2021

there is a newer script for certbot-auto (letsencrypt-auto)

/plugins//LetsEncrypt/bin/certbot-auto

https://github.com/certbot/cer…r/letsencrypt-auto-source

maybe the plugin could work with it?

axl · Oct 5th 2021

Quote from vege.net

we had the same problems, here is a hot fix which worked for us:

Code

cd /usr/share/ca-certificates/mozilla/

wget https://letsencrypt.org/certs/lets-encrypt-r3.pem

mv lets-encrypt-r3.pem lets-encrypt-r3.crt

dpkg-reconfigure ca-certificates # -->> add new letsencrypt Cert

vi /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm +134 #comment out line 134

my $cmd = [

'openssl', 'verify',

# ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),

'-purpose', 'sslserver', $self->{'certificate_container_path'}

];

Display More

what it does:

- adding new letsencrypt CA cert to /etc/ssl/certs

- removing "-CAfile fullchain1.pem" from openssl command (its not necessary anymore because openssl knows it now)

Regards, Joern

ps: Debian 9 / i-MSCP 1.5.3 Build: 2018120800uild: 2018120800

Display More

A good solution for fixing Let's Encrypt, but...

Quote from fulltilt

everything seems to work with the letsencrypt patch, but I discovered a problem when installing a purchased certificate ...

To install a paid certificate line 134 needs to be reactivated in OpenSSL.pm (afterwards deactivate again).

... it had issues with paid certificates.

I continued the work on Joern's approach. As per his instructions, start with:

Code

cd /usr/share/ca-certificates/mozilla/
wget https://letsencrypt.org/certs/lets-encrypt-r3.pem
mv lets-encrypt-r3.pem lets-encrypt-r3.crt
dpkg-reconfigure ca-certificates # -->> add new letsencrypt Cert

The next step is to edit /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm with editor of your choice. As Joern instructed, start by commenting out the line at 135. However, to allow paid certificates with CA bundle continue to work, if the initial verify command fails, then we need to try to run it with the CAfile parameter. This is done by adding the code below after line 140 debug( $stdout ) if $stdout;:

Code

# If an error state was returned, run again with CA bundle (support for paid certs)
if ( $rs && ( $self->{'ca_bundle_container_path'} ne '' ) ) {
$cmd = [
'openssl', 'verify',
( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),
'-purpose', 'sslserver', $self->{'certificate_container_path'}
];
$rs = execute( $cmd, \ $stdout, \ $stderr );
debug( $stdout ) if $stdout;
}

Display More

Full code from line 132 (old) to 157 (new) with a few comments for clarity:

Code

# COMMENTED OUT LINE 135
my $cmd = [
'openssl', 'verify',
# ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),
'-purpose', 'sslserver', $self->{'certificate_container_path'}
];
my $rs = execute( $cmd, \ my $stdout, \ my $stderr );
debug( $stdout ) if $stdout;
# ADDED: If an error state was returned, run again with CA bundle (support for paid certs)
if ( $rs && ( $self->{'ca_bundle_container_path'} ne '' ) ) {
$cmd = [
'openssl', 'verify',
( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),
'-purpose', 'sslserver', $self->{'certificate_container_path'}
];
$rs = execute( $cmd, \ $stdout, \ $stderr );
debug( $stdout ) if $stdout;
}
# STOP EDITS HERE
error( sprintf(
"SSL certificate is not valid: %s",
( $stderr || $stdout || 'Unknown error' ) =~ s/$self->{'certificate_container_path'}:\s+//r
)) if $rs;

Display More

Disclaimer: use at your own risk.

LetsEncrypt - SSL certificate is not valid

Share

Daily visitors