Gmail app cert not trusted

Help
41

Why? I have described a supported way to fix the default acme.sh uses and possibly another way.

Your problem now is you are now rate limited from doing the wrong thing too many times. Certbot won't fix that. You have to wait

42

for some reason, is not detecting DST

cat .acme.sh/ca/acme-v02.api.letsencrypt.org/directory/ca.conf
CA_EMAIL='webmaster@inverlandpanama.com'
ACCOUNT_URL='https://acme-v02.api.letsencrypt.org/acme/acct/*******'
CA_KEY_HASH='[******]'
DEFAULT_PREFERRED_CHAIN='DST'

I will ask namecheap but probably they do this on purpose since they claim no support to letsencrypt

43

It might detect that but you cannot get a fresh certificate because you are Rate Limited. You will need to wait a few more days to try again.

44

remember I ran the proper command before restriction.... here the prove
DEFAULT_PREFERRED_CHAIN='DST'

I didn't edit that file manually

45

That conf file can be changed at any time. It is not certain to me whether that was done before or after your most recent cert.

What do you do with the cert files once you get them?

And, which cert files do you use?

46

I did everything through acme.sh script so I didn't edit any other file manually

BTW, I contacted namecheap and as I informed previously they don't support third party certificates

cheers!

47

After a successful run of acme.sh it creates several files for the certs. We can see you getting these certs in the public cert logs (link here)

You have a LiteSpeed server that uses those cert files for HTTPS. And, we can see that LiteSpeed is using the most recent cert you got.

You also have Dovecot handling mail on port 993. It is also using the latest cert you got.

So, how did LiteSpeed and Dovecot know to use that latest cert? Do you copy the cert files somehow? Or, have you configured them to use the file(s) in the acme.sh folder? If so, which files have you configured them to use?

48

I haven't done any of these as I stated before.... I'm noob to letsencrypt and even any other SSL provider

what do you suggest I do? just wait for acme.sh rate limit to go away?

49

Sorry but I do not know how to help you. There are many ways to manage servers. If you don't know even these basics I can't do it for you.

My advice to you is to buy and use a service that you can manage. I think you have purchased a system that you are not yet able to understand.

50

sorry I read it wrong

51

Hmm. I see:

openssl s_client -connect inverlandpanama.com:993
---
Certificate chain
 0 s:CN = inverlandpanama.com
   i:C = US, O = Let's Encrypt, CN = R3
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: May  1 18:33:50 2023 GMT; NotAfter: Jul 30 18:33:49 2023 GMT
 1 s:C = US, O = Let's Encrypt, CN = R3
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Sep  4 00:00:00 2020 GMT; NotAfter: Sep 15 16:00:00 2025 GMT
---
52

what other completely free CA certificates are there?

53
54

And of course there is the Free (non ACME) CA that nobody likes

https://www.cacert.org

55

done via cpanel!

cheers!