# Hitch proxy with wildcards **URL:** \ **Category:** Server\ **Created:** [April 17, 2018, 5:42pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745 "2018-04-17T17:42:21Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [April 18, 2018, 3:58pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/21 "2018-04-18T15:58:03Z")
Hi @dannysantos1985, > [@dannysantos1985](#): > > After I have installed and issue a certificate, in order to auto-renew do I need a cron job or it auto-renews automatically? As @danb35 said, yes, when you installed acme.sh it created a cron entry for the current user (I suppose you installed it using sudo or directly root) so you could check it running the command `crontab -l` and you will see a line similar to this: `0 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null` ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [April 18, 2018, 4:09pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/22 "2018-04-18T16:09:56Z")
Yes I can. Thank you all 🙂 ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [April 18, 2018, 4:30pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/23 "2018-04-18T16:30:12Z")
> [@sahsanu](#): > > acme.sh --issue -d [domain.com](http://domain.com) -d '\*.mydomain.com' --dns dns\_dynu --renew-hook '/usr/local/bin/hitch-renew-hook $Le\_Domain' --post-hook 'systemctl reload hitch' Its not working. The file `hitch-bundle.pem` doesn't exist. I believe the `$Le_Domain` variable doesn't exists in `--renew-hook`. Please check this out @sahsanu ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [April 18, 2018, 4:33pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/24 "2018-04-18T16:33:36Z")
That should work when you renew the cert not the first time you issue the cert. ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [April 18, 2018, 4:46pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/25 "2018-04-18T16:46:40Z")
It didn’t work @sahsanu . I did: `acme.sh --renew --force -d mydomain.com -d '*.mydomain.com'` and still I can’t find the `hitch-bundle.pem` file ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [April 18, 2018, 5:11pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/26 "2018-04-18T17:11:49Z")
I had some problems with `hitch.service`. Now hitch works but don’t know if my renew certificates work because I reached a rate limit 😕 When can I retry a force renew? how long until the rate limit is up? ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [April 18, 2018, 6:41pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/27 "2018-04-18T18:41:43Z")
> [@dannysantos1985](#): > > It didn’t work @sahsanu . > > I did: acme.sh --renew --force -d [mydomain.com](http://mydomain.com) -d '\*.mydomain.com' and still I can’t find the hitch-bundle.pem file I've tested it again, new machine, clean acme.sh installation and the script works fine here. Did you modify the script? Did you get any error when trying to renew?. What are the perms of script `/usr/local/bin/hitch-renew-hook` ? > [@dannysantos1985](#): > > When can I retry a force renew? how long until the rate limit is up? It depends on the rate limit you reached, I suppose you have reached the 5 duplicated certs per 7 days limit so it will depends on when the first duplicated cert was issued but if you started yesterday, in 6 days you could issue a new cert with the same domains. To bypass this limit, add a new domain. `acme.sh --issue -d a.b.domain.com -d domain.com -d '*.mydomain.com' --dns dns_dynu --renew-hook '/usr/local/bin/hitch-renew-hook $Le_Domain' --post-hook 'systemctl reload hitch'` It is important to use 4th level subdomain like `a.b.domain.com` instead of a 3rd level subdomain like `b.domain.com` because the wildcard already covers the 3rd level and LE will refuse to issue the cert. But, **don't do that** , if you want to test it, use LE staging server, it will issue a non valid cert but as you are testing the procedure it should be ok. So just add `--test` parameter to your command and use another domain in the first place (`-d a.b.domain.com` instead of `-d domain.com`) or you could overwrite the certs you have already issued... so: `acme.sh --issue -d a.b.domain.com -d '*.mydomain.com' --dns dns_dynu --renew-hook '/usr/local/bin/hitch-renew-hook $Le_Domain' --post-hook 'systemctl reload hitch' --test` Good luck, sahsanu ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [April 18, 2018, 7:34pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/28 "2018-04-18T19:34:11Z")
Thank you @sahsanu . I will wait 6 days. Cheers ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 18, 2018, 10:10pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/29 "2018-04-18T22:10:25Z")
You can use [https://crt.sh](https://crt.sh) to see when your certs were issued and from the most recent dates you can calculate when you can issue a new one. ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [April 19, 2018, 2:30pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/30 "2018-04-19T14:30:28Z")
One question about wilcards: In order to issue it does it have to be with dns as a prefered challenge? Is it the only way? Can it be through http? Why? ---
**Author:** ![danb35](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/danb35/32/70869_2.png) [@danb35](https://community.letsencrypt.org/u/danb35)\ **Post date:** [April 19, 2018, 2:34pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/31 "2018-04-19T14:34:57Z")
> [@dannysantos1985](#): > > In order to issue it does it have to be with dns as a prefered challenge? Yes, only the DNS challenge is available to validate wildcard certificates. ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [April 26, 2018, 6:32pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/32 "2018-04-26T18:32:37Z")
@sahsanu After 6 days (today) I have tried to do a force renew using the command: `acme.sh --issue -d minho.win -d '*.minho.win' --renew-hook '/usr/local/bin/hitch-renew-hook $Le_Domain' --post-hook 'systemctl reload hitch' --dns dns_dynu --force` and it didn’t create my `hitch-bundle.pem` file. When I execute `/usr/local/bin/hitch-renew-hook mydomain.com` it creates the new pem file, so the problem it isn’t from the script. The script has permission of 755 so any user can execute it. ---
**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\ **Post date:** [April 26, 2018, 6:52pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/33 "2018-04-26T18:52:24Z")
Add `set -e -x` right under the shebang (`#!`) line of your script and run it again under acme.sh. `-e` tells the shell to quit when there is an error and `-x` tells it to print the commands it is executing to the screen. Together these should provide some insight as to why your script is failing under acme.sh but working when you run it by itself. ---
**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\ **Post date:** [April 26, 2018, 7:06pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/34 "2018-04-26T19:06:56Z")
Hi @dannysantos1985, This command… `acme.sh --issue -d minho.win -d '*.minho.win' --renew-hook '/usr/local/bin/hitch-renew-hook $Le_Domain' --post-hook 'systemctl reload hitch' --dns dns_dynu --force` …won’t launch `hitch-renew-hook`, it only tells `acme.sh` that the next time it will try to **renew** the cert, it should use the script `hitch-renew-hook`. If you want to test it, execute this command: `acme.sh --renew --force -d minho.win` Also, before doing that, follow @Patches advise and add the set command in your script so we could debug it. Cheers, sahsanu ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 26, 2018, 7:12pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/35 "2018-04-26T19:12:41Z")
It seems that where you use `--renew-hook` you want it to do something (your script) on “any change” But forcing it to renew isn’t really a triggered renewal… not exactly. Maybe you want to look into `--deploy-hook` If available, that may run your script whenever the cert is changed. ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [April 26, 2018, 7:46pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/36 "2018-04-26T19:46:02Z")
I have achieve rate limit again. Will wait another 6 days I guess ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [April 26, 2018, 9:39pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/37 "2018-04-26T21:39:02Z")
> [@rg305](#): > > You can use [https://crt.sh](https://crt.sh) to see when your certs were issued and from the most recent dates you can calculate when you can issue a new one. It may be sooner than 6 days... ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [May 4, 2018, 1:46pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/38 "2018-05-04T13:46:44Z")
Ok. now I could create a hitch-bundle.pem file. I have got one issue now. My certificate seems to not be valid. Can someone please visit my website `https://mysite00538.com` and please tell me what is wrong? I have successfully done a renewal. I was working before ---
**Author:** ![schoen](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/schoen/32/79_2.png) [@schoen](https://community.letsencrypt.org/u/schoen)\ **Post date:** [May 4, 2018, 3:56pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/39 "2018-05-04T15:56:56Z")
Oi @dannysantos1985, The certificate is valid and is being sent correctly. However, your web server returns an empty response (literally no HTTP reply at all, not even an empty file). When I test with `curl` or Chromium, the empty response problem is clearly indicated. When I test with Firefox, it retries the request repeatedly and eventually gives up with an error that looks confusingly like a certificate error. This is probably a proxy, firewall, or web application configuration error. For example, maybe the underlying service that the proxy connects users to disconnects or returns no data in response to requests. ---
**Author:** ![dannysantos1985](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/dannysantos1985/32/22352_2.png) [@dannysantos1985](https://community.letsencrypt.org/u/dannysantos1985)\ **Post date:** [May 4, 2018, 4:00pm UTC](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745/40 "2018-05-04T16:00:29Z")
Thank you. I am using varnish/hitch as my http proxy. The problem is with hitch, since I can have http and have reinstall hitch last time. Will redirect this question to the hitch forum. Thanks [Previous page](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745.md?page=1) [Next page](https://community.letsencrypt.org/t/hitch-proxy-with-wildcards/59745.md?page=3)