I'm atempting to renew several of my domains but mine right now as primary. My goal is to have both RSA 4096 and EC-256 keys for all the domains. My domain the one right now is davemehler.com and I'm using the latest acme.sh client. I've tried the new command both with and without the --force option. In both cases the output gets to the final verification then loops for 15 seconds, atempts another verification and repeats. I've linked to my dropbox as the output mostly what I just said the repeating is quite substancial. I'd appreciate any help.
Hi @dmehler51. and welcome to the LE community forum
You aren't requesting any certs from LE, so I don't know exactly how to help you. [Sat Jul 9 18:46:35 EDT 2022] Using CA: https://acme.zerossl.com/v2/DV90
Show us the output of: acme.sh --list
[and don't post it via dropbox]
@Rudy Thanks for your reply. It got me thinking and looking in another
direction, and apparently I upgraded and was bit by the zerossl.com CA
switch for acme.sh 3.x and possibly saved though it didn't feel that
way by the newly added CAA record for my domain. I would recommend
that the Secure a Website or Domain with Let's Encrypt and acme.sh | Linode
page be edited to contain a notation on 3.x and the change in CA so
that users atempting to use that document won't get bit. Here's the
information for completeness sake.
Excellent! That went a lot better. I do have a few questions regarding the lines
[Sun Jul 10 06:07:27 EDT 2022] The intermediate CA cert is in:
/root/.acme.sh/davemehler.com/ca.cer
[Sun Jul 10 06:07:27 EDT 2022] And the full chain certs is there:
/root/.acme.sh/davemehler.com/fullchain.cer
What are those and the differences between them? Which do I need to do
ocsp stapling and if the fullchain what role does the other play? My
web server is Apache 2.4.5x I believe.
I settled on EC-256 because my s7 phone (running android 10 at the
time of it's passing) was only able to access the ECC cert Prime256V1
I do not know and have not been able to find out what my current phone
my s20 running Android 12 can support. Can you help on that? I'd like
to upgrade my ECC setup with these certificates if possible.
Thanks.
Dave.
The default chain for Let's Encrypt uses 2 intermediate certs in addition to your leaf (or server) cert. The ca.cer contains just the 2 intermediate certs. The fullchain.cer contains your leaf and the 2 intermediates. For Apache, it depends on your version which files you use. But, modern Apache versions use just the fullchain.crt and the private key file. See this too
You need to review Apache docs for configuring stapling. You then set the option for stapling in the cert although I don't know how in acme.sh off-hand.
Did you just add an AAAA record to your DNS? Because connections using IPv6 fail and that will prevent getting a cert since Let's Encrypt uses the AAAA IP address when present. You should correct your IPv6 routing or remove the AAAA record if not possible.
nslookup davemehler.com
A address : 66.228.47.34
AAAA Address: 2600:3c03::f03c:91ff:fedf:6fc
curl -I4 -m10 http://davemehler.com (4 uses IPv4)
HTTP/1.1 301 Moved Permanently
Date: Sun, 10 Jul 2022 12:16:11 GMT
Server: Apache
Location: https://davemehler.com/
(other headers omitted)
curl -I6 -m10 http://davemehler.com (6 uses IPv6)
curl: (28) Failed to connect to davemehler.com port 80 after 5002 ms: Connection timed out
got no output at all. I can connect to the server but it doesn't say
anything about stapling. I then did a check on SSL Server Test (Powered by Qualys SSL Labs) and
I got this in the results:
This server certificate supports OCSP must staple but OCSP response is
not stapled.
For certificate #1
OCSP Must Staple
Supported, OCSP response not stapled
Revocation information
OCSP
OCSP: http://r3.o.lencr.org
Revocation status
Good (not revoked)
For certificate #2:
OCSP Must Staple
Supported, OCSP response not stapled
Revocation information
OCSP
OCSP: http://r3.o.lencr.org
Revocation status
Good (not revoked)
Lastly neither certificate gives me a chain issue.
