Deleted my CSR file

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: server.foreveryours.us

I ran this command: del server.foreveryours.us.csr

It produced this output:bye bye

My web server is (include version):apache 2.4

The operating system my web server runs on is (include version):centos 7

My hosting provider, if applicable, is: Linode

I can login to a root shell on my machine (yes or no, or I don’t know):Yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel):Centos CWP 9.8.809

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot):

I was doing some house cleaning and accidentally deleted my csr file. Now new certs are throwing an error with mismatched common names. Whats the best easiest way to fix this?

Most reason cert was created a few minutes ago. 352notarypublic.com

2

Hi @pixelpadre,

Your CSR isn’t necessary for the validity of a certificate at all. Also, most of our recommended ways of obtaining Let’s Encrypt certificates don’t save the CSR at all!

How are you obtaining and installing your certificates?

3

centos cwp. Nice control panel. You might be familiar with it. I am transitioning from one server to another. So maybe thats the reason I am getting some mismatch common names.

4

Yes, maybe your DNS records are still pointing at the old server (or are pointing at the new server before it’s obtained a certificate)?

5

It wont let me get a premature cert unless dns points to the server. but that does leave open the propagation issue. I just added a new cert and its got A rating. But one or two still give me common name mismatch. I will wait a day or two.

6

Hi @pixelpadre

you don't include the www-version. Your dns-entries have www-entries ( https://check-your-website.server-daten.de/?q=server.foreveryours.us ):

Host T IP-Address is auth. ∑ Queries ∑ Timeout
server.foreveryours.us A 45.33.10.132 yes 1 0
AAAA yes
www.server.foreveryours.us A 45.33.10.132 yes 1 0
AAAA yes

your certificate not

CN=server.foreveryours.us
	07.05.2019
	05.08.2019
expires in 90 days	server.foreveryours.us - 1 entry

so your www version isn't secure.

Domainname Http-Status redirect Sec. G
• http://server.foreveryours.us/
45.33.10.132 200 0.287 H
• http://www.server.foreveryours.us/
45.33.10.132 403 0.290 M
Forbidden
• https://server.foreveryours.us/
45.33.10.132 200 1.557 I
• https://www.server.foreveryours.us/
45.33.10.132 200 1.370 N
Certificate error: RemoteCertificateNameMismatch

There are users who add www never, other add www to every domain.

So if you have two dns entries, you should have one certificate with both domain names.

And your chain is wrong - duplicated certificates:

Chain - duplicate certificates	
	1	CN=server.foreveryours.us
	2	CN=server.foreveryours.us
	3	CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US

Looks like you use cert.pem and fullchain.pem.

7

Looks like I had a custom server configuration for the one bad acting domain. I had it set up for apache-phpfpm. I did not properly setup the server correctly. After I deleted the custom configuration I got a good certificate. Sorry about the distraction.

1 Like
8

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.