Help with wildcard setup

Help
21

thank you.

i been looking for something about acme.
but nothing much has shown

22
23

the configuration is different from the config i provided.

  1. Say “Hello World”
    docker run --rm neilpang/acme.sh
  2. Use as an executable:
    docker run --rm -it
    -v “$(pwd)/out”:/acme.sh
    –net=host
    neilpang/acme.sh --issue -d example.com --standalone
    You can use any commands that acme.sh supports here, other examples:

#revoke a cert
docker run --rm -it
-v “(pwd)/out":/acme.sh \ --net=host \ neilpang/acme.sh --revoke -d example.com #use dns mode docker run --rm -it \ -v "(pwd)/out”:/acme.sh
neilpang/acme.sh --issue --dns -d example.com
#run cron job
docker run --rm -it
-v “$(pwd)/out”:/acme.sh
–net=host
neilpang/acme.sh --cron

24

I would cerate a new dedicated docker container.
Then try installing it as one would normally (while inside that container):
curl https://get.acme.sh | sh

25

i setup the acme in pfsense.
but still getting the error

pfsense%20acme
pfsense acme.png763×878 61.7 KB

26

pfsense%20err%20invalid
pfsense err invalid.JPG711×570 31.6 KB

27

I’m not familiar with pfSense+LetsEncrypt.
I do see that
nslookup -q=txt _acme-challenge.marcuse.net.au
returns two records.
You might need to increase the DNS Sleep time.

28

is the information correct though ?
the sleep is default at 120 seconds.
what should i put it as ?

29

Two TXT records were created:
_acme-challenge.marcuse.net.au text =

    "Gzre2aQLTX4CidlRFvWsilb1jK6G9splF26foY-Vq2Q"

_acme-challenge.marcuse.net.au text =

    "0_1xlLBWYTGweLjpfOYUbu9EWv7UJ8dp3vBY9CFViu4"
30

Hi,

Could you please double check if you've binded to a correct IP / server?

Since the hostname is not available from public, we are not sure what's going on in your server....

And do you mind to share us output of the following command?
openssl s_client -connect pfsense.ad.marcuse.net.au:443 -showcerts

Thank you

31

where do i check. sorry?

32

Try DNS Sleep 300 (5 minutes)
Use nslookup (from any other computer) to confirm when it updates:
nslookup -q=txt _acme-challenge.marcuse.net.au hank.ns.cloudflare.com
or
nslookup -q=txt _acme-challenge.marcuse.net.au tia.ns.cloudflare.com

33

Although it’s not working properly, a good news is that the error message is different (from mismatch to CA not valid)

@rg305 did he get the certificate issued? (He actually should check nslookup -q=txt _acme-challenge.ad.marcuse.net.au hank.ns.cloudflare.com right?)

34

where do i enter that command ?

35

I don’t think he has been able to get a (good) cert yet.
He needs multiple wildcard entries on one cert.

36

You need to enter that to your CMD (command line prompt) or shell in the device that you see the error.

37

From a device that has access to pfsense.ad.marcuse.net.au:443
And that also has openssl (most Linux based system have it)

38

depth=1 CN = Fake LE Intermediate X1
verify error:num=20:unable to get local issuer certificate
CONNECTED(00000003)

Certificate chain
0 s:/CN=*.marcuse.net.au
i:/CN=Fake LE Intermediate X1
-----BEGIN CERTIFICATE-----

cert

-----END CERTIFICATE-----
1 s:/CN=Fake LE Intermediate X1
i:/CN=Fake LE Root X1
-----BEGIN CERTIFICATE-----

cert

-----END CERTIFICATE-----

Server certificate
subject=/CN=*.marcuse.net.au
issuer=/CN=Fake LE Intermediate X1

No client certificate CA names sent
Peer signing digest: SHA512
Server Temp Key: ECDH, P-256, 256 bits

SSL handshake has read 3092 bytes and written 433 bytes

New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 0EC86BA0E6D24129A2B89C9F94491A56456CD6BB41E618FAC8573261DDE9BF8B
Session-ID-ctx:
Master-Key:
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1544161061
Timeout : 300 (sec)
Verify return code: 20 (unable to get local issuer certificate)

DONE

39

Does this need to change into Production to work ?

pfsense%20prod
pfsense prod.JPG583×549 43.5 KB

40

Hi,

Two things:

  1. The certificate you binded to pfsense.ad.[the domain] is a "Staging" certificate.
    You need to issue a real certificate....

Yes.

  1. Please share us the certificate file that you omitted when executing the above commands... (Since a common name does not show much and since it's staging certificate, i don't know where to find the logs to see if that certificate includes the correct SAN)

P.S. Please do not expose your Lets Encrypt Account Key. IT'S EXTREMELY DANGEROUS!

Thank you