LetsEncrypt - SSL certificate is not valid

Quote from kess

I tested the procedure on more boxes and it works for certificates creation and for certificates revocations. I don't know if it works for renewals. Please test it and kindly report back.

Hope it helps,

bye Kess.

kess Thank you for your work!

The certificates are created correctly, but the apache vhost ssl.conf files are no longer created automatically ...

Quote from vege.net

we had the same problems, here is a hot fix which worked for us:

Code

1. cd /usr/share/ca-certificates/mozilla/
2. wget https://letsencrypt.org/certs/lets-encrypt-r3.pem
3. mv lets-encrypt-r3.pem lets-encrypt-r3.crt
4. dpkg-reconfigure ca-certificates # -->> add new letsencrypt Cert
5. vi /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm +134 #comment out line 134
8. my $cmd = [
9. 'openssl', 'verify',
10. # ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),
11. '-purpose', 'sslserver', $self->{'certificate_container_path'}
12. ];

Display More

what it does:

- adding new letsencrypt CA cert to /etc/ssl/certs

- removing "-CAfile fullchain1.pem" from openssl command (its not necessary anymore because openssl knows it now)

Regards, Joern

ps: Debian 9 / i-MSCP 1.5.3 Build: 2018120800

Build: 2018120800

Display More

In case where the i-mscp installer is used for re-generation tasks, problems could also arise here:

If that part remains deactivated, all Letsencrypt certificates will be restored but the certificates you have bought will probably be deleted or marked as invalid.

So we still need a working solution or an update for the Letsencrypt plugin!

Quote from Athar

For me, the solution provided by Kess remain the best at the moment ==> LetsEncrypt - SSL certificate is not valid

yes, certificates are created correctly, but my apache vhost ssl.conf files are no longer created automatically when request a new cert

Quote from Athar

I did remove a few certs during my tests, so I did create some fresh new certs for those, no issues.

Same for a domain which never get enrolled with LE, it worked (SSL is working for this site, so the VHost is created, else would not work at all )

I will try again, maybe a lock file from a previous test was in place ...

Quote from Athar

I did remove a few certs during my tests, so I did create some fresh new certs for those, no issues.

Same for a domain which never get enrolled with LE, it worked (SSL is working for this site, so the VHost is created, else would not work at all )

the cert is created but the plugin removed the vhost-ssl.conf afterwards due to

Quote from Athar

Funny, didn't get any validation error (else the panel wouldn't enable the SSL for the specified domain).

Don't know what's wrong on your server, but something might be missing as it can't verify the certificate.

I guess the chain of certbot-auto inside the LE plugin is still in use or re-activated after re-run update plugins: