another necessary fix for Proftpd TLS
FileZilla needs TLSProtocol TLSv1.2
nano /etc/proftpd/proftpd.conf
change TLS 1 to TLS1.2
another necessary fix for Proftpd TLS
FileZilla needs TLSProtocol TLSv1.2
nano /etc/proftpd/proftpd.conf
change TLS 1 to TLS1.2
I got this error too.
The problem is not related to letsencrypt plugin.
It is - verify certs with openssl, which return error: "certificate has expired" or "unable to get issuer certificate" (if disable expired DST certificate).
Trick: "$rs = 0;" after "... execute" (/var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm:138)
The solution is stupid, but working...
Good morning
So many solutions here
The problem is not about certbot, nor about i-MSCP or its LetsEncrypt plugin but about openSSL v1.0.x which cannot validate the SSL certificates.
To solve the problem, you need in order:
kess Good job. I don't think that all steps are required. You don't need to import the full CA. Regarding certbot, I'll update it.
kivamp You're totally right. To solve the problem, install the ISRG root X1 and remove the expired one manually from /etc/ssl/certs
To solve the problem, you need in order:
- Make sure that the CA ISRG Root X1 is installed on your system (in /etc/ssl/certs) : PEM AVAILABLE HERE
- Remove the old X3 (mozilla) CA which has expired
Alas
ls -la /etc/ssl/certs ?
did you also run update-ca-certificates -f ?
Display MoreGood morning
So many solutions here
The problem is not about certbot, nor about i-MSCP or its LetsEncrypt plugin but about openSSL v1.0.x which cannot validate the SSL certificates.
To solve the problem, you need in order:
- Make sure that the CA ISRG Root X1 is installed on your system (in /etc/ssl/certs) : PEM AVAILABLE HERE
- Remove the old X3 (mozilla) CA which has expired
kess Good job. I don't think that all steps are required. You don't need to import the full CA. Regarding certbot, I'll update it.
kivamp You're totally right. To solve the problem, install the ISRG root X1 and remove the expired one manually from /etc/ssl/certs
OK, I checked one more time with:
Stretch (OpenSSL 1.1.0l)
Ubuntu 18 (OpenSSL 1.1.1)
Buster (OpenSSL 1.1.1d)
The letsencrypt certificates for the panel (Panel URL & imscp_services) are issued without any problems ...
But all LE certificates for the customers are shown as invalid (verification process fails)
ls -la /etc/ssl/certs ?
did you also run update-ca-certificates -f ?
# ls /etc/ssl/certs/ISRG_Root_X1.pem
/etc/ssl/certs/ISRG_Root_X1.pem
update-ca-certificates -f
and
dpkg-reconfigure ca-certificates
did both, result is same
# openssl verify /etc/letsencrypt/live/mydomain.com/cert.pem
C = US, O = Internet Security Research Group, CN = ISRG Root X1
error 2 at 2 depth lookup: unable to get issuer certificate
error /etc/letsencrypt/live/mydomain.com/cert.pem: verification failed
Display MoreOK, I checked one more time with:
Stretch (OpenSSL 1.1.0l)
Ubuntu 18 (OpenSSL 1.1.1)
Buster (OpenSSL 1.1.1d)
The letsencrypt certificates for the panel (Panel URL & imscp_services) are issued without any problems ...
But all LE certificates for the customers are shown as invalid (verification process fails)
For me the same.
From my all domain (wich had ssl conf in the apache directory), now there is no _ssl.conf file. The panel says "Wrong ssl certificate". This is so annoying
For me the same.
From my all domain (wich had ssl conf in the apache directory), now there is no _ssl.conf file. The panel says "Wrong ssl certificate". This is so annoying
temporary option: