I cannot get SSL cert Certbot: error: unrecognized arguments: prefered-challenges=dns

Help
61

How did they become identical?

They're not supposed to be.

1 Like
62

another question

i got cert for dsrlearn.com and *.dsrlearn.com wildcard with SAN

if i use DNS CAA issuewild then will it cover dsrlearn.com?
if i want to provide email should i add another record of iodef along with isuewild?

63

Just add issue.

It will cover issuewild as well. Iodef is pretty much ignored.

1 Like
64

openssl x509 -noout -modulus -in 0001_chain.pem | openssl md5
openssl rsa -noout -modulus -in private.pem | openssl md5

i performed these and i got same value. is anything wrong?

65

I don't know those commands. How many certificates are in that chain file? There should be three. If not, run

cat cert.pem chain.pem > newfile.pem

And then use the newfile.pem as certificate.

1 Like
66

there are 3 certs in full chain

67

And yet there is a mismatch. I don't know. Let's wait for someone else.

1 Like
68

do you think any problem with order?

inssllabs test

1 Sent by server

2 Extra download -> this is error it's in yellow

3 In trust store - fine

69

Leaf, then intermediate, then "root"

1 Like
70

inssllabs test

1 Sent by server

2 Extra download -> this is error it's in yellow

3 In trust store - fine

71

So you have a missing or wrong intermediate? Where does it come from?

1 Like
72

i don't know . how can i solve this?

73

If you are sending the certificate by itself it's normal to have that issue. You need to send fullchain to solve it.

The issue is... Why is your fullchain not working?

1 Like
74

that's the issue. it's not working

75

i checked again with every file i found hash of 0000_chain not match to key. hash of csr , full chain , cert matches to private key hash.

what should i do?

77

Show that file here.
[make sure it doesn't contain the word "PRIVATE"]

I suppose it's the LE "long" chain.
Perhaps you would do better by using the "short" chain.

1 Like
78

Please show the command used.

1 Like
79

openssl x509 -pubkey -in 0000_chain.pem -noout | openssl sha256

80

ssllabs says chain issues

81

You are drawing at straws.
SSL Labs will always show an "issue" (with the "long" chain - its' root is expired).
But also shows no issue with at least one path (more than enough to validate).

And what are you comparing that output to?

1 Like