How to fix my Lets Encrypt cert so that it's not self signed

Help
1

I’m using Acme.sh for making certs

server: Linux/Apache 2.4.35

on https://github.com/Neilpang/acme.sh page, I’ve been using section “6. Use Apache mode”

acme.sh --issue --apache -d example.com -d www.example.com -d cp.example.com

to make the certificate, and I’m ending up with a self-signed certificate.

Is there a general rule or setting I need to have in place to make sure that LE is set to sign them instead of my own domain?

Update: I’ve also tried using domain API to automatically issue a cert, with a production key, using the command:

acme.sh --issue --dns dns_gd -d example.com -d www.example.com

What am I doing wrong?

My domain is: prodecksupply.com

I ran this command:
acme.sh --issue --dns dns_gd -d prodecksupply.com -d prodecksupply.com

It produced this output:
[Mon Mar 4 13:18:09 MST 2019] Domains have changed.
[Mon Mar 4 13:18:09 MST 2019] Multi domain=‘DNS:prodecksupply.com,DNS:prodecksupply.com’
[Mon Mar 4 13:18:09 MST 2019] Getting domain auth token for each domain
[Mon Mar 4 13:18:09 MST 2019] Getting webroot for domain=‘prodecksupply.com’
[Mon Mar 4 13:18:09 MST 2019] Getting new-authz for domain=‘prodecksupply.com’
[Mon Mar 4 13:18:10 MST 2019] The new-authz request is ok.
[Mon Mar 4 13:18:10 MST 2019] Getting webroot for domain=‘prodecksupply.com’
[Mon Mar 4 13:18:10 MST 2019] Getting new-authz for domain=‘prodecksupply.com’
[Mon Mar 4 13:18:11 MST 2019] The new-authz request is ok.
[Mon Mar 4 13:18:11 MST 2019] prodecksupply.com is already verified, skip dns-01.
[Mon Mar 4 13:18:11 MST 2019] prodecksupply.com is already verified, skip dns-01.
[Mon Mar 4 13:18:11 MST 2019] Verify finished, start to sign.
[Mon Mar 4 13:18:13 MST 2019] Cert success.

[Mon Mar 4 13:18:13 MST 2019] Your cert is in /home/.acme.sh/prodecksupply.com/prodecksupply.com.cer
[Mon Mar 4 13:18:13 MST 2019] Your cert key is in /home/.acme.sh/prodecksupply.com/prodecksupply.com.key
[Mon Mar 4 13:18:13 MST 2019] The intermediate CA cert is in /home/.acme.sh/prodecksupply.com/ca.cer
[Mon Mar 4 13:18:13 MST 2019] And the full chain certs is there: /home/.acme.sh/prodecksupply.com/fullchain.cer

My web server is (include version):Apache Version 2.4.35

The operating system my web server runs on is (include version): Linux 2.6.32-954.3.5.lve1.4.58.el6.x86_64

My hosting provider is: godaddy.com

YES I can login to a root shell on my machine

YES, I’m using a control panel to manage my site
Name and version of the control panel: cPanel Version 70.0 (build 51)

The version of my client is acme.sh v2.8.1

2

Hi,

You are using cPanel with acme.sh, which means you’ll need to instruct acme.sh to install the certificate after installation.

Please follow this guide to proceed.

Thank you

3

Hi @schmitty42

that happens if you have different vHost definitions, so the ACME-client changes the wrong configuration.

CN=prodecksupply.deckandbasement.com
	03.10.2017
	03.10.2018
152 days expired	prodecksupply.deckandbasement.com, 
mail.prodecksupply.com, prodecksupply.com, 
www.prodecksupply.com, 
www.prodecksupply.deckandbasement.com - 5 entries

looks like your website uses the default vHost, not the certificate acme.sh has created.

But: If you have cPanel, isn't there an integrated solution? It may be impossible to install a certificate outside of your cPanel.

4

They don’t have any sort of simple/built-in/easy-setup utility that I’ve been able to find, but they will allow certificate additions if I create the certs and keys them outside the server. Still looking into this.

5

Probably your certificate import simply isn't taking effect for some reason. You can confirm that the certificate file generated by acme.sh is not self-signed with a command like

openssl x509 -text -noout -in /home/.acme.sh/prodecksupply.com/prodecksupply.com.cer

6

Hi,

You’ve issued the certificate, but have not install it via command line.

The command you show above will not install the certificate to cPanel by default. Check out the guide I posted before and see the bottom section to ask acme.sh to install it…

Thank you

2 Likes
7

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.