Hot answers tagged

15

I was having trouble with this as well since Amazon Linux 2 doesn't have epel-release in its repositories, but I've found you can install the EPEL RPM package itself, and then you'll be able to install certbot or certbot-nginx from there. Download the RPM curl -O http://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm Then install it sudo ...


13

Yes, certbot can help you clean up. sudo certbot certificates will list what certbot thinks you have installed sudo certbot delete will allow you to interactively remove and clean up unwanted / deprecated domains.


10

According to: https://community.letsencrypt.org/t/how-to-specify-a-port-different-from-443-for-the-dvsni-challenge/12753/4 This is not possible with certbot. You should take a look at the other implementation method here: https://community.letsencrypt.org/t/list-of-client-implementations/2103


8

I don't allow certbot to create my web server configurations. I frankly don't trust it to get it right, since it's already doing some not very efficient practices. So I get certs with certbot certonly --webroot -w /var/www -d hostname -d hostname ... And my nginx configuration looks like this (for one example domain): server { server_name www.yes-www....


8

For EC2 running Amazon Linux 2 AMI: Enable EPEL Repo: sudo amazon-linux-extras install epel Install Certbot: sudo yum install certbot-apache


7

did you follow instructions above that to enable backports? You need to add deb http://ftp.debian.org/debian jessie-backports main to your /etc/apt/sources.list


7

Don't try to install certbot manually on CentOS/RHEL systems. It just makes a huge mess. Instead, install it from EPEL. yum install epel-release yum install certbot


7

Your certificate has the wrong name listed. Using Chrome's Dev Tools, I see the following information on your site: The certificate should be created with your server's name, not www.example.com.


7

The certificate that the site is using is self-signed - it is not a Letsencrypt certificate. Try checking the path to the SSL certificate and private key in your web server configuration. Which certificate is it pointing to? Does the server need restarting to load the configuration file? Has the letsencrypt certificate been installed successfully? The ...


7

You installed RHEL 8, and then added the EPEL repo for RHEL 7. This is not compatible with RHEL 8 and packages from EPEL 7 will not function properly. You can replace EPEL 7 with EPEL 8 when that becomes available, but it does not currently contain certbot and you still will have to wait for it to be built. It may be a few months before EPEL 8 has most or ...


6

Remember in addition to the user crontabs there is also a system crontab file, cron.d directory and the cron.hourly, cron.daily and cron.weekly directories. These are a likely culprit if you installed the software from a package. Specifically when I look at the certbot debian package I see a file /etc/cron.d/certbot . If you installed certbot from a package ...


6

Verify with a commands like this. dig -t txt _acme-challenge.app.mydomain.com @nameserver1.example.org dig -t txt _acme-challenge.app.mydomain.com @nameserver2.example.org


6

You need either a second certificate for the subdomain, or one certificate that is valid for both. There is no way around it. The redirect happens after the SSL connection is established, so you need a working certificate for a working redirect. With certbot you can create such a certificate by providing the -d parameter multiple times: certbot-auto -d ...


5

It could be due to the recent vulnerability announced with the tls-sni-01 verification method, Let’s Encrypt disabled this until it’s been fixed patched. Until then, they have advised using http for verification. Lets Encrypt tls-sni-01 bug details


5

OpenSSL 1.1.0g 2 Nov 2017 I did not even look at the rest of what you are doing but OpenSSL 1.1.0 simply does not support TLS 1.3 yet. TLS 1.3 is support starting with OpenSSL 1.1.1 only. See Using TLS1.3 With OpenSSL for more information.


5

You need to keep /etc/letsencrypt/live/my-client-server-domain/privkey.pem private as it contains the private key for your certificate. You can hand out one ofthese two files: /etc/letsencrypt/live/my-client-server-domain/chain.pem /etc/letsencrypt/live/my-client-server-domain/fullchain.pem You might want to share the /etc/letsencrypt/live/my-client-...


5

From an ACME protocol perspective, there is no difference...which is to say, there's no such thing as a renewal. All new certs come from a new "order". Most clients just abstract the concept of a renewal by saving the details you originally used to create the certificate and re-using those same details to get a new cert. For reference, here's the recently ...


4

I experienced this same issue twice on 2 separate Centos7 systems in the last 2 months. This is what worked for me: yum remove pyOpenSSL [This will remove certbot installed via epel] yum install openssl-devel python-devel [May or may not actually be necessary] pip install certbot pip install certbot-apache After completing these steps I was able to ...


4

Updated answer (see original answer below) In my original answer I focused on the fact that the script you provided is not required when using the renew command. However, I did not make sure the renew command is actually applicable in this scenario. As cdhowie and bobpaul in the comments state: certbot renew is a non-interactive mode that - in conjunction ...


4

I did this for 3 domains now and it worked, but try it at your own risk and make backups of original files before you do anything. Make sure you actually have the nginx plugin. You can install it with the command sudo apt-get install python-certbot-nginx Edit /etc/letsencrypt/renewal/*.conf with an editor of your choice I did vim /etc/letsencrypt/renewal/...


4

This is casued because on /etc/letsencrypt/renewal/example.org.conf the certificate for it also apply on other domains as well so you need to specify the correct webroot for other domains as well in /etc/letsencrypt/renewal/example.org.conf at [[webroot_map]] as well. For my domain ellak.org.cy that apply on other domains I have specified: [renewalparams] ...


4

I couldn't find it either, so I looked at the source (and another doc) which states: security: Security parameters & server settings --rsa-key-size N Size of the RSA key. (default: 2048) --must-staple Adds the OCSP Must Staple extension to the certificate. Autoconfigures OCSP Stapling for ...


4

Some things to consider: _acme-challenge.example.net 1800 IN A XXX.XXX.XXX.XXX _acme-challenge.example.org 10800 IN TXT "a-value" _acme-challenge.example.org 10800 IN TXT "another-value" www.example.org 1800 IN A XXX.XXX.XXX.XXX You should end the FQDN on the left with a dot. Otherwise it will put the $ORIGIN after it. ...


4

Let's Encrypt pretty much requires that the name you're certifying is accessible through a public IP address. Until IPv6 is more common, this will most likely not be the case for the vast majority of your servers. Even if it was, you probably wouldn't want to make web services Internet accessible without scrutiny on most of them. Generally speaking, to ...


4

First of all, maybe you don't need certs from a public CA at all? If you control the clients it may make more sense to have an internal CA, in which case only your last question (4) remains (partially) relevant. That said, from a purely technical "can this be done with Lets Encrypt" perspective: Yes, this would be possible. However, this naming convention ...


3

The correct fix is: mv /usr/lib64/python2.7/site-packages/OpenSSL /usr/lib64/python2.7/site-packages/pyOpenSSL Thanks to cnritng frim github.


3

This is the issue: HOME=/ To fix it HOME variable with /root value needs to be passed to the script: env HOME=/root /path/to/certbot-auto


3

I'm running into the same issue. Using python venv I was able to get certbot working using pip. Steps: Install virtualenv pip install virtualenv --upgrade Create a virtualenv virtualenv -p /usr/bin/python2.7 certbot Activate the certbot virtualenv . /root/certbot/bin/activate Your prompt might turn into something like this (certbot) [root@hostname ~]#...


3

First of all, removing Python 3 as suggested in a previous answer is a terrible idea, while it has a slight chance of fixing your particular problem, it is much more likely to create many more since any program depending on it will crash. Second, your problem stems from a modification that was made to your system that should never have been made. python is ...


3

I was believing that tls-sni is still possible, but based on the incident found, letsencrypt is advising people not to use tls-sni until future notice, for example the upcoming tls-sni-03 spec with challenges.


Only top voted, non community-wiki answers of a minimum length are eligible