Questions tagged [lets-encrypt]
Let's Encrypt is a certificate authority that provides free X.509 certificates for TLS encryption.
751
questions
0
votes
0
answers
8
views
Amazon Lightsail + CDN 502 Error
I have gone through all of the various posts here about the issue as well as gone through this link and still can't solve the problem.
Using Amazon's Lightsail and Amazon Linux 2, I tried setting up a ...
- 123
10
votes
1
answer
693
views
Do SSL Certs containing two wildcards work (esp. on Let's Encrypt)? [duplicate]
I want to include two wildcards in an SSL cert (will be) signed by Let's Encrypt: *.*.thost3.de. Will this cert match any hostnames matching that rule (e.g. example.example.thost3.de, hello.world....
- 201
0
votes
1
answer
27
views
Certbot - Failed authorization procedure
I want to generate a Let's Encrypt certificate for my server, so that I can renew it automatically.
I ran the command certbot --nginx -d testpbx.info.eu and got the following error.
certbot --nginx -d ...
0
votes
0
answers
17
views
Remove discarded subdomains (wildcard) from subdomain scanners
I have a server which I use with my own domain name, with a wildcard DNS record.
On the server side, I use the nginxproxy docker image to autogenerate VHosts. This allows me to add new websites/pages/...
- 1
0
votes
1
answer
60
views
Unable to renew a Certbot NGINX certificate
I have a NGINX server and I use Certbot to generate a Let's Encrypt certificate. I saw that my certificate was not renewing automatically despite the cron I had set up.
I tried to renew it manually ...
0
votes
1
answer
32
views
Server refused to connect after installing SSL via Certbot | Docker + Nginx, AWS Lightsail
I have successfully managed to install SSL via certbot into my Nginx Docker container,
but after installation, all traffic routed via HTTPS refuses to connect.
curl https://www.example.com or curl ...
- 101
0
votes
1
answer
53
views
Mail server sending to postfix refusing TLS connection with "certificate expired", but it's not
Since April 30, I'm seeing errors like that in my mail log:
May 1 02:27:27 afaron postfix/smtpd[2644268]: connect from r137.info.hofer.at[66.117.17.137]
May 1 02:27:27 afaron postfix/smtpd[2644268]: ...
- 131
0
votes
0
answers
30
views
Change certbot renewal configurations to another Let’s Encrypt-Account
Using certbot 1.26.0.
Due to moving some certificate configurations to another server and creating new ones, I now have got two accounts. That was not intended and I think I don't need two accounts.
...
- 127
2
votes
0
answers
790
views
SSL_do_handshake() failed (SSL: error:141CF06C:SSL routines:tls_parse_ctos_key_share:bad key share) while SSL handshaking, client:
A few months ago I started getting complaints from dozens of users about getting errors when connecting to my site. When I look into the error.log of nginx I see daily SSL errors:
I have no idea what ...
0
votes
1
answer
73
views
How do I set up a Let's Encrypt wildcard certificate for Apache on an Amazon Linux 2 AMI EC2 instance?
I have a domain (let's say example.com), and I currently have a Let's Encrypt certificate set up and properly working for example.com and www.example.com for Apache on an Amazon Linux 2 AMI EC2 ...
- 103
0
votes
2
answers
79
views
Configuring BIND9 (ver 9.16) to allow TXT DNS updates from Letsncrypt
Solution to the below problem: Use $ddns-confgen or $tsig-keygen, the former provides you with the syntax to paste into your named.conf file
Problem:
I am trying to configure a BIND9 (ver9.161-Ubuntu) ...
- 1
0
votes
1
answer
98
views
Sharing a Let's Encrypt certificate with a node websocket connection on the same domain? Possible? Advisable?
Is it possible / advisable to register and renew a Let's Encrypt certificate through Nginx for https, and share that same certificate on a websocket connection (wss://) on the same domain? The ...
- 103
0
votes
1
answer
44
views
TLS certificate for non standard ports
We have a server (running on Ubuntu 20.04) accessible from a subdomain myserver.university.country, I would like to install SSL/TLS certificate on the server to make the connections to the server ...
- 103
0
votes
1
answer
333
views
Kubernetes Nginx Ingress with Cert Manager and letsencrypt does not allow wildcarts in domain names
I have a self-hosted Kubernetes cluster with an Nginx Ingress. Cert-manager is also running on the cluster, with which I try to get valid SSL certificates using Letsencrypt. It all works and I get a ...
- 1
0
votes
2
answers
35
views
What commands can I use to simulate letsencrypt adding the TXT field to my server?
I'm trying to debug my DNS setup for the letsencrypt challenge.
I understand that BIND9 may not be receiving the requests, although it was earlier in the day. The .jnl does not get created, ...
- 1,962
0
votes
1
answer
38
views
Apache serves with new and old SSL Root certificate
I am hosting a website at https://www.tabletop.cloud
A while back I switched from the DST Root CA X3 root certificate to the ISRG Root X1 certificate. When I access my website in every browser the SSL ...
- 103
0
votes
0
answers
17
views
Postfix key rollover race condition?
the Postfix documentation on TLS advises against storing key and certificates in separate files because of possible race conditions during key rollover. It is rather complicated to follow this advice ...
- 239
0
votes
0
answers
27
views
Serve different SSL certificate depending upon connection
I currently have a Nextcloud installation running on a server at home behind an Nginx proxy, which in turn is routed through Cloudflare. The proxy currently presents a Cloudflare origin SSL ...
- 101
0
votes
1
answer
113
views
Certbot unauthorized and connection errors
I have a spring boot application on Google Cloud, CentOS 7. I wish to install SSL certificate via Let's Encrypt and Certbot. When I use certbot --apache -d mydomain.zone command I receive an error:
...
- 23
0
votes
0
answers
27
views
Letsencrypt certificate works only internally to the instance, but when queried externally cert is not valid anymore
I have one instance on Heroku with a auto generated certificate for mysite.com
I have created a EC2 instance on AWS and generated a letsencrypt certificate for api.mysite.com
From the EC2 instance, if ...
- 149
0
votes
1
answer
60
views
certbot creates a challenge owned by root:root and permissions 640 and apache can't access it - custom ACLs applied on parent directory
On my server I have special permissions that I set on my public_html folder.
First the sticky bit
chmod g+s /home/domain.com/public_html
Also default group permissions.
setfacl -m 'default:group::rwX'...
1
vote
2
answers
394
views
NginX website returns default page with HTTP (HTTPS works correctly)
This has to be a duplicate, but I have been searching for a long time and have not found anything.
When I type in the address of my website using http, I get the NginX default page (https works fine):
...
- 87
0
votes
1
answer
225
views
Nginx not listening on new ports with systemctl reload nginx after adding config with a new port
Not sure how to quickly summary this issue, so I will put my scenario in bulletpoints:
Normal basic nginx install
I only use https(443), so I removed all http(80) config
When you start nginx (or ...
- 101
0
votes
1
answer
36
views
HTTPS for intranet website
My situation is, I have a server running inside a home network which can be connected from the outside through VPN (Zerotier). This network connected to the internet through NAT, thus there is no real ...
0
votes
1
answer
88
views
i/o timeout when trying to renew letsencrypt certificate
I am running a webserver using caddy 1, which is supposed to renew https certificates automatically using letsencrypt but is having trouble doing so. In the server's logs I see this:
2022/01/14 04:03:...
- 101
0
votes
0
answers
44
views
Kubernetes: certificate for non-http service
In my cluster (DOKS), I'd like to run an SMTP/IMAP server, obviously with SSL encryption, provided by Let's encrypt. For HTTP based servers this works perfectly with cert-manager and the ingress ...
0
votes
1
answer
81
views
SSL certificate is not valid when the server is connecting itself
I have a local network where the [server] server's ip address is: 192.168.88.201, host: local.mydomain.com. This server is Ubuntu 18.04.6 LTS running Apache+PHP. Also this server has Let's encrypt SSL ...
- 155
0
votes
2
answers
21
views
Have godaddy point to specific path on custom ip
I have an ec2 machine running nginx. It has a lot of projects and typically I access it via:
https://ai.mydomain.com/myproject
One of these projects is spinning out to be separate. Assuming the ip was ...
- 101
0
votes
1
answer
146
views
How to stop Let'sEncrypt checking my domain for acme-challenge
Sorry if this question already asked before, but I can't found solution for my issue.
Previously I have site on Webmin server and use Let'sEncrypt SSL for the domain.
Now, I moved my site to Google ...
0
votes
1
answer
306
views
Why does Traefik renew with the expired Let's Encrypt certificate path?
We run Ubuntu Server 20.04 LTS with a Traefik Docker container. Back in September when the Let's Encrypt DST Root CA X3 certificate expired we didn't really find much actual information on how to ...
- 111
0
votes
1
answer
122
views
Is that possible to encrypt the traffic which is between internal webservers by using Load Balancer [closed]
I am currently using Let's Encrypt to obtain server certificates for approximately 100+ backend servers. Every 90 days I have to work with other teams to renew my certs via the DNS-01 challenge. I ...
- 151
0
votes
1
answer
140
views
SSL certificate - conflicting expiry dates [duplicate]
I am experiencing a weired issue regarding a letsencrypt SSL certificate on my postfix mail server.
According to certbot: "The following certs are not due for renewal yet:
/etc/letsencrypt/live//...
- 49
1
vote
1
answer
1k
views
Update certificates and OpenSSL on Ubuntu 14.04 and still getting expired LetsEncrypt certificate errors? [closed]
In my office one of the systems is still running Ubuntu 14.04. This system has been affected by the Let's Encrypt expired root certificate problem:
https://letsencrypt.org/docs/dst-root-ca-x3-...
- 151
0
votes
1
answer
2k
views
How do I specify a port other than 80 when adding SSL certificate using Certbot?
I have a server which runs 2 different web servers (Apache and Nginx). The Apache server takes care of all the traffic directed to Wordpress sites whereas the Nginx server serves my Python API and ...
0
votes
0
answers
139
views
Docker-compose 502 Error after adding Wiki.js
I am having difficulty getting Wiki.js hosted on my server.
My current setup is using Docker Compose utilising a reverse proxy with the eventual aim to host some services for personal use. I have ...
1
vote
0
answers
273
views
iOS saying ssl is invalid from letsencrypt
I’m using letsencrypt for a few sub domains one of which is chat.mydomain.com which is setup as an alias of the main domain in Apache because it uses a socket on specific port and doesn’t require a ...
- 11
0
votes
1
answer
156
views
How can I tell if wget can support LetsEncrypt's new ISRG Root X1 certificate after DST Root CA X3 Expiration
A few weeks ago (Sept 2021), LetsEncrypt changed how their certificates were signed, which can affect some older programmes and clients. I have a standard Apache webserver (stock v2.4.41 from ubuntu ...
- 29.9k
0
votes
2
answers
176
views
Log the ssl certificate that apache is using for each SSL connection, for enhanced loging & debugging
I have an apache web server, with mod_ssl & SSL certificates from letsencrypt. certbot reports they are fine and not expiring. A few different (of my many users) report that they get invalid/...
- 29.9k
5
votes
1
answer
1k
views
How can I disable "Subject Alternative Name" from being included in Certbot Let's Encrypt certificates?
Using Certbot to install an R3 Let's Encrypt certificate on an nginx webserver causes all the other domains in the nginx configuration to be included under "Subject Alternative Name" on the ...
- 334
0
votes
1
answer
2k
views
Apache reverse proxy with self-signed certificate
I run a Unifi hardware appliance which comes with a self-signed certificate, issued on unifi.local. For my current setup, it's not an option to import a certificate on the appliance directly for ...
- 115
0
votes
0
answers
38
views
RDS: Current deployment certificate level is Error?
I am just after a bit of help to troubleshoot an error on a RDS deployment. I've just created a new RDS service and created the certificates using Certify The Web which uses Lets Encrypt certs. I've ...
- 13
0
votes
0
answers
373
views
Nginx: Reverse Proxy to Docker Container with SSL
On my Ubuntu (20) server I have a Docker container running on port 3000. I have now installed NGINX on the server and point a domain via a reverse proxy to the Docker container.
server {
listen 80;...
- 101
2
votes
1
answer
351
views
Searx (based on Nginx) "Let's Encrypt" SSL certificate is not valid for Safari (iPhone and MacOS), it is valid for the rest of the world
I have a customized installation of Searx (https://searx.me/) at:
https://ricercaalternativa.mydissent.net/
It has been working properly with Letsencrypt for years now. As of a few days ago, however, ...
0
votes
0
answers
281
views
PHPLDAPAdmin Error: Could not start TLS. Please check your LDAP server configuration
We use phpldapadmin with Openldap on Debian 9. We use Let's Encrypt certificates on Openldap. Since the expiration of the IdentTrust DST Root CA X3, we experienced a shutdown of our LDAP System. We ...
- 91
1
vote
2
answers
494
views
Certificate problems since Let's Encrypts CA expired a few days ago
I'm running a Debian 10 server and I can't connect to other machines using Let's Enccrypt certificates anymore since LE's CA (DST Root CA X3) expired a few days ago:
root#> curl -I https://example....
- 4,957
1
vote
0
answers
2k
views
Why does Debian 11 still have the expired DST Root CA X3 certificate?
On an up-to-date Debian 11 server, I noticed the expired DST Root CA X3 certificate is still present:
$ grep DST /etc/ca-certificates.conf
mozilla/DST_Root_CA_X3.crt
This certificate is expired ...
- 111
0
votes
1
answer
169
views
DST Root CA X3 has expired
I have configured shadowsocks-rust with xray plugin using certificate from acme. Works fine on all devices except android 7. I understand that this is due to the fact that the DST Root CA X3 ...
- 1
0
votes
1
answer
73
views
SSL certificate issues on a Windows machine
There are 11 Windows 10 computers in the office but the following issue only happens on one of them.
When accessing some sites in any installed browser (Edge, Chrome and Opera) the browser tells that ...
- 137
1
vote
1
answer
2k
views
User agents not trusting web server due to Let's Encrypt DST Root CA X3 root certificate expiration
I handle a NodeJS server with an SSL certificate issued by Let's Encrypt. It works on some clients (Safari and Firefox on my macOS) and not others (curl on my macOS, Safari on iOS). The notice on iOS ...
- 253
2
votes
1
answer
885
views
Since Sep 30 14:01:15 2021 GMT any software using openssl <=1.0 (like curl, php etc.) can't connect to hosts with Let’s Encrypt certificates
Since Sep 30 14:01:15 2021 GMT any software using openssl <=1.0 (like curl, php etc.) can't connect to hosts with Let’s Encrypt certificates
* SSL certificate problem: certificate has expired
- 139