Certificate Renewal

Help Ajuda (em português)
1

Por favor, preencha todos os campos abaixo para que nós possamos ajudar você. Obs.: você deve indicar seu nome de domínio para receber ajuda. Os nomes de domínio dos certificados emitidos são divulgados nos logs da Transparência de Certificados (por exemplo, crt.sh | example.com). Assim, não indicar seu nome de domínio não o mantém em segredo, mas torna a nossa ajuda mais difícil.

Posso ler respostas em inglês: sim

Meu nome de domínio é: aguiapiscinas.ind.br

Executei esse comando: Certbot renew, certbot -cert-name xxxxxx --force-renewal

Produziu essa saída: prints

Meu servidor web é (com versão): certbot
0.26.1

O sistema operacional no meu servidor web é (com versão): Ubuntu 16

O serviço de hospedagem do meu site (se aplicável) é: OceanDigital

Posso acessar um shell root na minha máquina (sim ou não, ou não sei):Sim

Uso um painel de controle para administrar meu site (não, ou indique o nome e a versão do painel de controle): não

I have an error when I renew my certificate, it does not allow connection for renewal, my file and the error output follow.

Captura de Tela 2021-12-04 às 23.37.06
Captura de Tela 2021-12-04 às 23.37.06820×850 51.7 KB

1 Like
2

Hi @danielicaro and welcome to the LE community forum :slight_smile:

First, let me apologize for my use of English.

Please don't use --force-renewal it really doesn't force things to work.
Things should just work; And we are here to help you with doing that.

I see "connection refused" error.
You must have a "working" HTTP server before you can secure it (via HTTP validation).
LE validations can come from anywhere.everywhere on the Internet.
Make sure you aren't doing Geolocation blocking on inbound HTTP connections.
Also, it would be beneficial to handle the HTTP request in HTTP (and not redirect them to HTTPS):

curl -Ii http://aguiapiscinas.ind.br/.well-known/acme-challenge/Test_File-1234
HTTP/1.1 301 Moved Permanently
Server: nginx
Location: https://aguiapiscinas.ind.br/.well-known/acme-challenge/Test_File-1234
2 Likes
3

Sorry, I didn't understand the commands you gave.

1 Like
4

Which "commands" are you referring to?

  1. You must have a "working" HTTP server before you can secure it (via HTTP validation).
  2. Make sure you aren't doing Geolocation blocking on inbound HTTP connections.
  3. it would be beneficial to handle the HTTP request in HTTP (and not redirect them to HTTPS)
  4. curl -Ii http://aguiapiscinas.ind.br/.well-known/acme-challenge/Test_File-1234

Note: #4 was just for "show" (not something you should do)
[It showed how the HTTP request is being redirected to HTTPS]

2 Likes
5

A question, where can I update the data from API, I see my hostname is out of date

6

I don't understand your question.

1 Like
7

type": "http-01",
"status": "invalid",
"error": {
"type": "urn:ietf:params:acme:error:connection",
"detail": "Fetching http://xxxxxxxxxxxxxx/.well-known/acme-challenge/GbRu6nCGBylCyuSmFQ3qjQ9m6smvtLbpMQaDRqEYl6s: Connection refused",
"status": 400
},
"url": "https://acme-v02.api.letsencrypt.org/acme/xxxxxxxxxxxx",
"token": "Gxvcvcxvxcvcx",
"validationRecord": [
{
"url": "http://xxxxxxxxxxxxxxxx/.well-known/acme-challenge/Gl6s",
"hostname": "xxxxxxxxx.com", -> exchange this information
"port": "80",
"addressesResolved": [
"xxx"
],
"addressUsed": "xxxx"
}
],
"validated": ""
}

I need to change this information, where can I get it?

8

The hostname is taken from your own certbot request.
If you say:
certbot ... -d EXAMPLE.COM
LE will try to validate to:
http://EXAMPLE.COM/.well-known/acme-challenge/...

2 Likes
9

one question, how do I make a domain use the certificate of another?

for example

www.teste.inf.br, www.testebr.com.br

the .com.br use the certificate o inf.br

10

You must get a certificate that has the name of the site being reached.
If anyone with be reaching the same site via multiple names, then you will need all those names on the cert.

1 Like
11

so i have to have a certificate for each name? I can't have 1 certificate with multiple names, is that it?

13

SNI can handle multiple names being served from a single IP.
The TLS constraint is that whatever names are in the vhost config must all be served by its' cert.
[the name(s) being served by the vhost config must be a subset of the list of names (SAN) in that cert]
So that once the name is matched to a vhost, that vhost must have a cert that covers that name.
If you make one vhost config for each name, then you can have one cert for each name.
It's not possible to make vhost configs that use multiple certs (with different names).
[so it's not possible to make one vhost that covers ten names and then try to fit ten certs into that vhost]
It is possible to make one cert that has all the names; And that same cert can be used by all the vhosts.

2 Likes
14

First sorry for the question, but where do I find the list of names (SAN) to be able to change or pass new names

15

You create the cert, you control the contents of the SAN.
If you want to review a cert already created, there are many ways to do that; The simplest being to "inspect the cert" and look at the Subject Alternat Names (SAN) field.
Here is a picture of the cert being used by this site:

image
image405×509 11.9 KB

1 Like
16

I don't think you understand, where can I pass this information, where do I pass these names? Which file contains them?

another question, in this print you sent has applicant, is this a random name or where he will get the certificate, for example, the site is teste.com and the name in applicant has to be teste.com or can it be test?

17

When you create the cert.
with certbot you would use:
-d "domain1.com,www.domain1.com,domain2.com,www.domain2.com,..."

Look at the output of:
certbot certificates

1 Like
18

it's really confusing for me, the print follows, the applicant's name is a name that is not in my domain, when I try to renew the certificate it's giving an error precisely in this .com domain, I wanted to know how to change it

Merged_document
Merged_document453×1029 105 KB

19

And who setup certbot?

1 Like
20

an old company, I've never worked with certbot, so the difficulty and the certificate won and I'm having a lot of trouble renewing it.

21

Start here:

1 Like