How to add a domain to an existing set of certs using acme.sh?

ovunque · September 17, 2020, 2:45am

Well, I did issue born2.run – a long time ago with updates that are still working now.
But the Qualys SSL Labs is, yeah, completely, no idea what that is.

rg305 · September 17, 2020, 2:46am

The first name from the second cert “longplay.trillionpictures.com” also shows a cert that you did not issue:

Your cert shows:
longplay.trillionpictures.com
Sun Aug 30 07:13:05 UTC 2020
Thu Oct 29 07:13:05 UTC 2020

ovunque · September 17, 2020, 2:47am

Is it possible for a cert to inherit the “Powered by” addition in the same way icons in your Mac OS sometimes shows, with great conviction that some strange system file was “created” by Adobe Illustrator when it clearly wasn’t?

ovunque · September 17, 2020, 2:48am

longplay, same thing, and the timing make sense too.
But the only system I’ve ever used to create certs was LetsEncrypt (certbot or acme.sh)

rg305 · September 17, 2020, 2:49am

Your updates are merely updating a cert that no one is using.
It is just coincidence that the site renews (via a completely different set of certs)

The Qualys report shows what the world sees - completely different certs than those issued to you via acme.sh

rg305 · September 17, 2020, 2:50am

So we know it is definitely NOT acme.sh.
Are any of those other two still installed?

ovunque · September 17, 2020, 2:51am

Both longplay.trillionpictures.com and born2.run are active now.

rg305 · September 17, 2020, 2:52am

Is certbot still installed?

rg305 · September 17, 2020, 2:53am

And NOT using the certs generated by acme.sh
Can we agree on that?

[Your born2.run cert expires Oct 29, the one served to the Internet expires Nov 28]

Oh no!!
That is the expected renewal date - not the expiration date - shown by acme.sh

griffin · September 17, 2020, 2:56am

Usually cPanel has a SECURITY section with SSL/TLS in it. You install your certificates in the GUI.

rg305 · September 17, 2020, 2:57am

He claims this has been somehow automated.
But I’m having difficulty trying to get to that automation (script).

griffin · September 17, 2020, 3:00am

rg305 · September 17, 2020, 3:02am

And to complicate matters, there is a cert in use with names on it that don’t match the cert in acme.sh:

DNS Name=born2.run
DNS Name=feathercollectionproject.com
DNS Name=fixitamerica.org
DNS Name=keeperofthedream.net
DNS Name=opq-design.com
DNS Name=radical4.media
DNS Name=radical4media.com
DNS Name=samself.com
DNS Name=savingbarbarasizemore.com
DNS Name=totallypostal.net
DNS Name=trillionpictures.com
DNS Name=www.born2.run
DNS Name=www.feathercollectionproject.com
DNS Name=www.fixitamerica.org
DNS Name=www.keeperofthedream.net
DNS Name=www.opq-design.com
DNS Name=www.radical4.media
DNS Name=www.radical4media.com
DNS Name=www.samself.com
DNS Name=www.savingbarbarasizemore.com
DNS Name=www.totallypostal.net
DNS Name=www.trillionpictures.com

Doesn’t match:

born2.run
feathercollectionproject.com
fixitamerica.org
keeperofthedream.net
opq-design.com
radical4.media
radical4media.com
samself.com
savingbarbarasizemore.com
starsandstrife.com
totallypostal.net
trillionpictures.com
www.born2.run
www.feathercollectionproject.com
www.fixitamerica.org
www.keeperofthedream.net
www.opq-design.com
www.radical4.media
www.radical4media.com
www.samself.com
www.savingbarbarasizemore.com
www.starsandstrife.com
www.totallypostal.net
www.trillionpictures.com

griffin · September 17, 2020, 3:03am

I recommend clicking on certificates and seeing what certificates cPanel thinks exist.

ovunque · September 17, 2020, 3:05am

Is certbot still installed?

Yes, and working.

He claims this has been somehow automated.

The automation is simply that it runs the acme.sh on a that cron job every minute, at which point it does nothing presumably until we're within some number of days of renewal.

And NOT using the certs generated by acme.sh Can we agree on that?

My strong impression is they are generated by acme.sh. I don't see how else they're being generated. I doubt the hosting provider is doing me some hand-of-god favor, there is no (and I've never installed nor even tried to install) a hosting-provider-provided SSL, and the dates I'm seeing in that SSL folder correspond to my running acme.sh. There are even some there from today's efforts. That would be a crazy coincidence.

griffin · September 17, 2020, 3:05am

Just humor me.

griffin · September 17, 2020, 3:07am

For your visual benefit Rudy:

rg305 · September 17, 2020, 3:08am

What does this show?:
certbot certificates

rg305 · September 17, 2020, 3:08am

OK
A blonde walks into a bar...

ovunque · September 17, 2020, 3:09am

Is certbot still installed?

My apologies. Only 'acme.sh' is installed. NOT 'certbot'
certbot is something I used way way back and only on a local machine to generate certs which I subsequently uploaded to this server.

Topic		Replies	Views
How to issue certs for multiple domains with different webroots with acme.sh? Help	26	10183	December 11, 2021
Today was my first attempt to use acme.sh script in 2023: it worked but certs failed to update Help	37	2898	March 21, 2023
Invalid Response from well-known/acme-challenge with .acme.sh/acme.sh --issue -d typing12.com Help	34	3639	September 29, 2022
Installed Debian 11: cant get certificate to activate ssl: Times out EVERY TIME Help	34	2114	June 4, 2022
Need help finding instructions that don't use SUDO Help	56	9368	August 25, 2019

How to add a domain to an existing set of certs using acme.sh?

Related topics