Certs aren't being uploaded via SFTP to /etc/letsencrypt/live correctly

Help
1

Steps I’ve done, taken from the internal documentation for my company, which I’ve written, doing dns verification method, on windows 10, uploading to centos, using latest version of Filezilla, over sftp.

  1. Download certbot for windows and run it in Powershell as administrator

  2. do this command

certbot certonly --manual --preferred-challenges=dns --email examil@example.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos --manual-public-ip-logging-ok -d *.example.com -d example.com

  1. Once done the certificates will be downloaded to C:/Certbot, upload everything inside that folder to /etc/letsencrypt . Override all existing files in that folder, if that folder doesn’t exist, create it.

Okay now when doing this

Note: make sure that the files inside C:\Certbot\live\example.com are uploaded correctly to /etc/letsencrypt/live/example.com because often filezilla fails to upload those

if I just upload what’s in certbot folder to the empty /etc/letsencrypt/live/, only the readme file will be uploaded. All other files get uploaded correctly

If I then go to C:\Certbot\live\example.com And upload to /etc/letsencrypt/live/example.com everything gets uploaded correctly.

So it’s not a permission error. Does anyone have a clue what’s happening?

2

Do you know why your company is advising you to run certbot from your personal Windows machine instead of directly on the server that will be using the certificate? It seems particularly silly since you’re using a manual DNS challenge that can be done from anywhere.

2 Likes
3

Why expose a server to the Internet (indirectly via DNS), when you can expose that same server to a PC [that is exposed to the entire Internet]?

Security at its’ best - LOL

1 Like
4

These files are symbolic links. I don’t know enough about Windows to understand how Filezilla would handle them. Their targets (in C:\Certbot\archive) are also only readable for an administrator user.

While I’m afraid I don’t know how to suggest solving this, that’s the most likely reason for this issue.

I also agree with @rmbolger that the most sensible solution is to run Certbot on the server where the certificates will be used, rather than on your own PC. The main reason that Certbot for Windows was created was on account of people running Windows on their web servers—not to encourage people to run Let’s Encrypt client applications on their desktop machines. :slight_smile:

1 Like
5

The server cannot reach the internet that’s why, exept through a vpn. it’s a common practice with many telecom providers, we work with many of them and all of our clients do the same things. The server in question is for a telecom provider.

6

That pc can only get to the server through a vpn, it’s a common practice with many telecom providers, we work with many of them and all of our clients do the same things. The server in question is for a telecom provider.

7

That pc can only get to the server through a vpn, it’s a common practice with many telecom providers, we work with many of them and all of our clients do the same things. The server in question is for a telecom provider.

8

So it can't reach the Internet.
But it can be reached from the Internet (through the VPN).

I like the sound of that !

9

As for your "problem".
As already mentioned:

To be able to follow these links and read the files linked to, you must be in the local admin group.
Which might mean that you may have to open FileZilla with "Run as administrator".
If that doesn't solve this problem, then you already found a "workaround".

10

Running it as adminstrator doesn’t work, I reported the bug to Filezilla, waiting for their reply.

11

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.