LetsEncrypt - SSL certificate is not valid

**fulltilt** · Dec 15th 2021

Thanks Kess, looks good to me!

I did several tests this morning (snap certbot) with your OpenSSL.pm patch:

- Create, renew, revoke and restore works for all LE Certificates

- Installing purchased certificates works

- it survives an i-mscp reconfiguration (setup) no errors occurred

- even after the reconfiguration everything works as above (create, renew, revoke, restore incl. edit and save purchased certificates)

so everything should work!

Quote from kess

OK guys, it seems I found the way to renew certificates per cron job in the normal way.
Thank you to vege.net for you hint here LetsEncrypt - SSL certificate is not valid but unfortunately it's not complete.

The following little modifications, works for LE certificates and for paid certificates.
Edit file /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm and instead of modifying line 134 as stated in the previous post, just add the little code below.

Code

132. my $cmd = [

133. 'openssl', 'verify',

134. ( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),

135. '-purpose', 'sslserver', $self->{'certificate_container_path'}

136. ];

137.

138. my $rs = execute( $cmd, \ my $stdout, \ my $stderr );

139. debug( $stdout ) if $stdout;

# BEGIN: Check certificates validity for Let's Encrypt certificates on renewal

if ( $rs && ( $self->{'ca_bundle_container_path'} ne '' ) ) {

$cmd = [

'openssl', 'verify',

'-purpose', 'sslserver', $self->{'certificate_container_path'}

];

$rs = execute( $cmd, \ $stdout, \ $stderr );

debug( $stdout ) if $stdout;

}

# END: Check certificates validity for Let's Encrypt certificates on renewal

Display More

Please let me know if it works for you also,
bye Kess.

Display More

**Tonezzz** · Feb 12th 2022

Hi Kess, Hi Fulltilt,

I've been dealing with this issue for a while taking info from this forum, thanks to everybody for the advice.

I've been using i-MSCP for a while but know almost nothing about its coding, let alone modifying it. So I'd like to clarify a bit.

My setup: Debian 9 + i-MSCP 1.5.3 2018120800

1/ Do I still need the snapd solution from Kess before applying this latest fix?
Edit: I've re-read and think I still need to do the snaps solution first.

2/ I found that the line number in the latest code match /var/www/imscp/engine/PerlLib/iMSCP/OpenSSL.pm from the maintenance branch not the stable release.

Does this mean I should replace just the OpenSSL.pm file with the maintenance brand (plus the code) or do I need other files (which ones) too?

3/ There're some extra lines above and below the #BEBIN and #END: tag. Do I need to keep them?

Code

...
my $cmd = [
'openssl', 'verify',
( ( $self->{'ca_bundle_container_path'} ne '' ) ? ( '-CAfile', $self->{'ca_bundle_container_path'} ) : () ),
'-purpose', 'sslserver', $self->{'certificate_container_path'}
];
my $rs = execute( $cmd, \ my $stdout, \ my $stderr );
debug( $stdout ) if $stdout;
error( sprintf(
"SSL certificate is not valid: %s",
( $stderr || $stdout || 'Unknown error' ) =~ s/$self->{'certificate_container_path'}:\s+//r
)) if $rs;
# Begin :
...
# END :
$self->{'ca_bundle_container_path'} = '' unless $caBundle;
$rs;
}

Display More

Sorry if my questions sound a bit stupid, I just want to be sure. This issue has given me a lot of headaches recently.

Thank you,
Tony.

**fulltilt** · Feb 12th 2022

I use snap certbot & latest LE plugin with:

Latest Release: 1.5.3 (2018120800)

**Tonezzz** · Feb 12th 2022

Many thanks fulltilt,

I've already done the Snap Certbot earlier so I've just applied the latest LE plugin. Earlier I had to revoke and create to make the certificate works again but this time after rebooting the server, it just works, the browser doesn't give a warning anymore.

Now I can only wait and see if it'll still be good tomorrow morning. (I'm in Thailand and it's 22:22pm right now).

Edit: 14-Feb-2022 09:53am Still working well.

Thanks again.

Cheers,

Tony.

**fulltilt** · Feb 12th 2022

Quote from Tonezzz

Now I can only wait and see if it'll still be good tomorrow morning. (I'm in Thailand and it's 22:22pm right now).

From time to time you should take a look in your control panel:

System tools > Debugger

Invalid LE certificates are also listed there

**gpeter73** · May 4th 2022

After following your solution I can't create any Certificates anymore:

Code

Some challenges have failed. at /var/www/imscp/gui/plugins/LetsEncrypt/backend/LetsEncrypt.pm line 834.cd /

The letsencrypt Log:

Code

Domain: khopen.xxx.xxx
Type: dns
Detail: DNS problem: NXDOMAIN looking up A for khopen.xxx.xxx - check that a DNS record exists for this domain; DNS problem: NXDOMAIN looking up AAAA for khopen.xxx.xxx - check that a DNS record exists for this domain
2022-05-04 09:15:33,715:DEBUG:certbot._internal.error_handler:Encountered exception:
Traceback (most recent call last):
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/auth_handler.py", line 91, in handle_authorizations
self._poll_authorizations(authzrs, max_retries, best_effort)
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/auth_handler.py", line 180, in _poll_authorizations
raise errors.AuthorizationError('Some challenges have failed.')
AuthorizationError: Some challenges have failed.
2022-05-04 09:15:33,715:DEBUG:certbot._internal.error_handler:Calling registered functions
2022-05-04 09:15:33,715:INFO:certbot._internal.auth_handler:Cleaning up challenges
2022-05-04 09:15:33,715:DEBUG:certbot._internal.plugins.webroot:Removing /var/www/imscp/gui/plugins/LetsEncrypt/acme/.well-known/acme-challenge/zTyJc3Ij0EZZCesgHkNjEhSjwN5xS5Bja9mid2MAgZk
2022-05-04 09:15:33,716:DEBUG:certbot._internal.plugins.webroot:All challenges cleaned up
2022-05-04 09:15:33,716:DEBUG:certbot._internal.log:Exiting abnormally:
Traceback (most recent call last):
File "/usr/local/sbin/certbot", line 11, in <module>
sys.exit(main())
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/main.py", line 15, in main
return internal_main.main(cli_args)
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/main.py", line 1357, in main
return config.func(config, plugins)
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/main.py", line 1237, in certonly
lineage = _get_and_save_cert(le_client, config, domains, certname, lineage)
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/main.py", line 121, in _get_and_save_cert
lineage = le_client.obtain_and_enroll_certificate(domains, certname)
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/client.py", line 418, in obtain_and_enroll_certificate
cert, chain, key, _ = self.obtain_certificate(domains)
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/client.py", line 351, in obtain_certificate
orderr = self._get_order_and_authorizations(csr.data, self.config.allow_subset_of_names)
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/client.py", line 398, in _get_order_and_authorizations
authzr = self.auth_handler.handle_authorizations(orderr, best_effort)
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/auth_handler.py", line 91, in handle_authorizations
File "/opt/eff.org/certbot/venv/local/lib/python2.7/site-packages/certbot/_internal/auth_handler.py", line 180, in _poll_authorizations
raise errors.AuthorizationError('Some challenges have failed.')
AuthorizationError: Some challenges have failed.
2022-05-04 09:15:33,717:ERROR:certbot._internal.log:Some challenges have failed.

Display More

But the domain exist and till I changed the config of my system I could create and recreate certificates

Quote from kess

Hello guys,

there you can find the solution I've adopted in order to get the systems working with every type of certificate (self signed, from CA or Let's Encrypt)

I didn't change absolutely nothing in the code of i-MSCP, everything is original.

The following has been tested ONLY on Debian Stretch x64, with a standard i-MSCP installation. No strange things.

1. Integrate the new LE CAs in your system:

Code

mkdir /usr/share/ca-certificates/letsencrypt

curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/isrgrootx1.crt https://letsencrypt.org/certs/isrgrootx1.pem

curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/isrg-root-x2.crt https://letsencrypt.org/certs/isrg-root-x2.pem

curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/isrg-root-x1-cross-signed.crt https://letsencrypt.org/certs/isrg-root-x1-cross-signed.pem

curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/lets-encrypt-r3.crt https://letsencrypt.org/certs/lets-encrypt-r3.pem

curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/lets-encrypt-r3-cross-signed.crt https://letsencrypt.org/certs/lets-encrypt-r3-cross-signed.pem

curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/lets-encrypt-r4.crt https://letsencrypt.org/certs/lets-encrypt-r4.pem

curl --insecure -Lo /usr/share/ca-certificates/letsencrypt/lets-encrypt-e2.crt https://letsencrypt.org/certs/lets-encrypt-e2.pem

dpkg-reconfigure ca-certificates

Here a Dialog appears.

- In the first dialog choose "yes"

- In the second select your new 7 CA certificates to import and then click OK

The result should be as follows:

Code

Updating certificates in /etc/ssl/certs...

7 added, 0 removed; done.

Running hooks in /etc/ca-certificates/update.d...

done.

2. Remove any previous certbot versions:

Code

apt remove certbot

3. Install the new and supported certbot version

Code

apt install snapd

snap install core && snap refresh core

snap install --classic certbot

4. Optional, but recommended, edit the file /var/www/imscp/gui/plugins/LetsEncrypt/config.php and update the section as follows:

Code

'certbot_create_options' => [

'--preferred-chain ISRG Root X1'

],

Save and close;

5. Remove previous symlinks that could still exist, we'll fix them in next steps:

Code

rm /usr/bin/certbot

rm /usr/local/sbin/certbot

6. HIT THE "UPDATE PLUGINS" BUTTON here: https://your.server.panel:1234/admin/settings_plugins.php

If everything goes well, the LE Plugin will reconfigure.

7. Now it's time to fix the symlinks:

Code

rm /usr/bin/certbot

ln -s /snap/bin/certbot /usr/bin/certbot

rm /usr/local/sbin/certbot

ln -s /usr/bin/certbot /usr/local/sbin/certbot

8. Now a little check:

Code

which certbot

Result:

- /usr/local/sbin/certbot

which -a certbot

Result:

- /usr/local/sbin/certbot

- /usr/bin/certbot

- /snap/bin/certbot

9. And the final check:

Code

/usr/local/sbin/certbot --version

Result:

certbot 1.19.0

Now your system will have:

- The new CA from LE that it didn't have before

- The new supported version of certbot that knows the new chains

I tested the procedure on more boxes and it works for certificates creation and for certificates revocations. I don't know if it works for renewals. Please test it and kindly report back.

Hope it helps,

bye Kess.

Display More

**Athar** · May 4th 2022

If this is a new domain, wait for DNS propagation (which seems to be your issue there, if we look at the logs)

**gpeter73** · May 4th 2022

The Domain is about 6 Month old and online available

Quote from Athar

If this is a new domain, wait for DNS propagation (which seems to be your issue there, if we look at the logs)

**kess** · May 4th 2022

You are not using the correct certbot version... Please follow what I wrote and use certbot with snapd

**gpeter73** · May 5th 2022

I followed step by step your HowTo.
Did it today again and still the same.

Code

ROOTSRV123:/# snap install core && snap refresh core
snap "core" is already installed, see 'snap help refresh'
snap "core" has no updates available
ROOTSRV123:/# snap install --classic certbot
snap "certbot" is already installed, see 'snap help refresh'
ROOTSRV123:/# nano /var/www/imscp/gui/plugins/LetsEncrypt/config.php
ROOTSRV123:/# rm /usr/bin/certbot
ROOTSRV123:/# rm /usr/local/sbin/certbot
ROOTSRV123:/# rm /usr/bin/certbot
rm: das Entfernen von '/usr/bin/certbot' ist nicht möglich: Datei oder Verzeichnis nicht gefunden
ROOTSRV123:/# ln -s /snap/bin/certbot /usr/bin/certbot
ROOTSRV123:/# rm /usr/local/sbin/certbot
ROOTSRV123:/# ln -s /usr/bin/certbot /usr/local/sbin/certbot
ROOTSRV123:/# which certbot
/usr/local/sbin/certbot
ROOTSRV123:/# which -a certbot
/usr/local/sbin/certbot
/usr/bin/certbot
ROOTSRV123:/# /usr/local/sbin/certbot --version
certbot 1.27.0

Display More

Quote from kess

You are not using the correct certbot version... Please follow what I wrote and use certbot with snapd

LetsEncrypt - SSL certificate is not valid

Share

Daily visitors