# It worked great but **URL:** \ **Category:** Praise\ **Created:** [September 18, 2019, 3:14am UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260 "2019-09-18T03:14:03Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 21, 2019, 12:57am UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/21 "2019-09-21T00:57:06Z")
How would I have known that from the documentation of acme.sh? Or is the syntax understood by those that know DNS – before . = Name and after . = Content? Anyway – thank you. So, if I pull [lucra-lc.com](http://lucra-lc.com) over to CloudFlare do I need to do anything to it with the exception of the TXT record that will be requested by acme.sh? Lastly, all my subdomains are one level. I could leave them where they are in NoIP right? Maybe I’m too unskilled but I am persistent. ![image001.jpg](https://global.discourse-cdn.com/letsencrypt/original/2X/f/f464dd1c7c382c015b3fc53eebe1cd1aadffee61.jpg) ![image002.jpg](https://global.discourse-cdn.com/letsencrypt/original/3X/a/f/afc8b23b577bf5509965d0b54e9660d9153ffec7.jpg) ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [September 21, 2019, 1:02am UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/22 "2019-09-21T01:02:15Z")
> [@SMLMG](#): > > How would I have known that from the documentation of acme.sh? It's one of those things that depends on the user interface of your DNS hosting (in this case, [no-ip.com](http://no-ip.com)). In some user interfaces you have to chop off the rest of the domain, in some you don't. I share your pain. > [@SMLMG](#): > > , if I pull [lucra-lc.com](http://lucra-lc.com) over to CloudFlare do I need to > do anything to it with the exception of the TXT record that will be requested by acme.sh If you move your entire domain to Cloudflare, then you don't need to do any of this complicated CNAME stuff. You can skip it all and just [follow the acme.sh Cloudflare guide](https://github.com/Neilpang/acme.sh/wiki/dnsapi#1-use-cloudflare-domain-api-to-automatically-issue-cert). By moving your entire domain, I mean: - Signing up to Cloudflare - Adding `lucra-llc.com` as a domain - Copying all of your DNS records to Cloudflare - Changing your nameserver registration at no-ip to the nameservers instructed by Cloudflare ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 21, 2019, 1:27am UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/23 "2019-09-21T01:27:21Z")
OK … Then I go with CloudFlare … after all this though we should try it out to see if it works – I’m referring to the other method. ![image001.jpg](https://global.discourse-cdn.com/letsencrypt/original/2X/f/f464dd1c7c382c015b3fc53eebe1cd1aadffee61.jpg) ![image002.jpg](https://global.discourse-cdn.com/letsencrypt/original/3X/a/f/afc8b23b577bf5509965d0b54e9660d9153ffec7.jpg) ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 21, 2019, 12:45pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/24 "2019-09-21T12:45:59Z")
Ok … it gets more interesting … I guess I need to use the CloudFlare API to get a key and a token on my server. I do know those two items but how do I let acme.sh know? I’m starting to feel inept. Maybe DNS Alias is not that bad. BTW - I’m going to transfer the domains from NoIP to CF. ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 21, 2019, 2:06pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/25 "2019-09-21T14:06:49Z")
I typed in the Cloudflare export commands as specified by acme.sh documentation. No errors were given. However, when I looked in ~/.acme.sh/account.conf the exported token and account id were not there. What am I missing? ![image001.jpg](https://global.discourse-cdn.com/letsencrypt/original/2X/f/f464dd1c7c382c015b3fc53eebe1cd1aadffee61.jpg) ![image002.jpg](https://global.discourse-cdn.com/letsencrypt/original/3X/a/f/afc8b23b577bf5509965d0b54e9660d9153ffec7.jpg) ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [September 21, 2019, 9:08pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/26 "2019-09-21T21:08:10Z")
Once you have obtained your Cloudflare Email and API Key (from [dash.cloudflare.com](http://dash.cloudflare.com)), you run those two `export` commands with the respective values you found. So far, this does not affect your acme.sh configuration files. Once you actually try to issue a certificate (using `acme.sh --issue ...`), acme.sh will save those parameters to `~/.acme.sh/account.conf`. If it hasn’t, something has gone wrong. ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 22, 2019, 12:53pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/27 "2019-09-22T12:53:45Z")
Thank you … I saw the environment variables when I listed them in Debian … ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 23, 2019, 4:54am UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/28 "2019-09-23T04:54:36Z")
-AZ … help … here is what I did for home assistant using cloudflare … The old config … duckdns: domain: woodlandhillsnorthsanantonio access\_token: [redacted] http: # Secrets are defined in the file secrets.yaml api\_password: !secret legacy\_password ssl\_certificate: /home/homeassistant/dehydrated/certs/woodlandhillsnorthsanantonio.duckdns.org/fullchain.pem ssl\_key: /home/homeassistant/dehydrated/certs/woodlandhillsnorthsanantonio.duckdns.org/privkey.pem base\_url: [woodlandhillsnorthsanantonio.duckdns.org:8123](http://woodlandhillsnorthsanantonio.duckdns.org:8123) ip\_ban\_enabled: True login\_attempts\_threshold: 10 my new conf … http: # Secrets are defined in the file secrets.yaml api\_password: !secret legacy\_password ssl\_certificate: /home/pi/.acme.sh/markresidence.com/fullchain.cer ssl\_key: /home/pi/.acme.sh/markresidence.com/markresidence.com.key base\_url: [markresidence.com:8123](http://markresidence.com:8123) ip\_ban\_enabled: True login\_attempts\_threshold: 10 the command I ran – pi@hassbian:/home/homeassistant/acme.sh $ ./acme.sh --issue --dns dns\_cf -d [markresidence.com](http://markresidence.com) [Sun 22 Sep 23:11:15 CDT 2019] Create account key ok. [Sun 22 Sep 23:11:15 CDT 2019] Registering account [Sun 22 Sep 23:11:16 CDT 2019] Registered [Sun 22 Sep 23:11:16 CDT 2019] ACCOUNT\_THUMBPRINT=‘wS5o61DO\_IzzO3kWF-ux1kZSr8q61goR4CS\_X2SLexo’ [Sun 22 Sep 23:11:16 CDT 2019] Creating domain key [Sun 22 Sep 23:11:17 CDT 2019] The domain key is here: /home/pi/.acme.sh/markresidence.com/markresidence.com.key [Sun 22 Sep 23:11:17 CDT 2019] Single domain=‘[markresidence.com](http://markresidence.com)’ [Sun 22 Sep 23:11:17 CDT 2019] Getting domain auth token for each domain [Sun 22 Sep 23:11:19 CDT 2019] Getting webroot for domain=‘[markresidence.com](http://markresidence.com)’ [Sun 22 Sep 23:11:19 CDT 2019] Adding txt value: ocZn90Zswa1d4rjPmkaDB\_4enOr3UO\_Aqe\_XSRXtwKM for domain: \_acme-challenge.markres [idence.com](http://idence.com) [Sun 22 Sep 23:11:20 CDT 2019] Adding record [Sun 22 Sep 23:11:20 CDT 2019] Added, OK [Sun 22 Sep 23:11:20 CDT 2019] The txt record is added: Success. [Sun 22 Sep 23:11:20 CDT 2019] Let’s check each dns records now. Sleep 20 seconds first. [Sun 22 Sep 23:11:41 CDT 2019] Checking [markresidence.com](http://markresidence.com) for \_acme-challenge.markresidence.com [Sun 22 Sep 23:11:42 CDT 2019] Domain [markresidence.com](http://markresidence.com) ‘\_acme-challenge.markresidence.com’ success. [Sun 22 Sep 23:11:42 CDT 2019] All success, let’s return [Sun 22 Sep 23:11:42 CDT 2019] Verifying: [markresidence.com](http://markresidence.com) [Sun 22 Sep 23:11:45 CDT 2019] Success [Sun 22 Sep 23:11:45 CDT 2019] Removing DNS records. [Sun 22 Sep 23:11:45 CDT 2019] Removing txt: ocZn90Zswa1d4rjPmkaDB\_4enOr3UO\_Aqe\_XSRXtwKM for domain: \_acme-challenge.markresidenc [e.com](http://e.com) [Sun 22 Sep 23:11:46 CDT 2019] Removed: Success [Sun 22 Sep 23:11:46 CDT 2019] Verify finished, start to sign. [Sun 22 Sep 23:11:46 CDT 2019] Lets finalize the order, Le\_OrderFinalize: [https://acme-v02.api.letsencrypt.org/acme/finalize/6697](https://acme-v02.api.letsencrypt.org/acme/finalize/6697) 2420/1142857093 [Sun 22 Sep 23:11:48 CDT 2019] Download cert, Le\_LinkCert: [https://acme-v02.api.letsencrypt.org/acme/cert/03efc27be41d08698fbae83](https://acme-v02.api.letsencrypt.org/acme/cert/03efc27be41d08698fbae83) 702e52736160c [Sun 22 Sep 23:11:49 CDT 2019] Cert success. I cannot get Home Assistant to resolve to [markresidence.com](http://markresidence.com) … nothing happens at all … am I using the wrong files for ssl\_certificate and ssl\_key in my configuration.yaml file? I expected the usual let’s encrypt names. ![image001.jpg](https://global.discourse-cdn.com/letsencrypt/original/2X/f/f464dd1c7c382c015b3fc53eebe1cd1aadffee61.jpg) ---
**Author:** ![mnordhoff](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/mnordhoff/32/22583_2.png) [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)\ **Post date:** [September 23, 2019, 4:58am UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/29 "2019-09-23T04:58:01Z")
Hello > [@SMLMG](#): > > access\_token: [redacted] I just edited your post to remove this. I don't know if it was sensitive -- it might be more like a username, or it might be a password -- but I decided to err on the safe side. Apologies for the disruption. ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [September 23, 2019, 5:31am UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/30 "2019-09-23T05:31:34Z")
I think the first thing you are going to want to do is disable the Cloudflare proxy on your domain. This gets us back to a similar setup as to what you had before you moved to Cloudflare. You can do this by going into Cloudflare, going to the DNS editing interface, and make sure the “orange cloud” is turned off on all of your DNS records. ---
**Author:** ![steved430](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/steved430/32/30683_2.png) [@steved430](https://community.letsencrypt.org/u/steved430)\ **Post date:** [September 23, 2019, 8:57am UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/31 "2019-09-23T08:57:02Z")
Hi Steve, I beleive they are under /etc/letsencrypt/keys. However the directory keys is root access only. (You cannot use SUDO to cd to keys.) So you will need to chmod keys to allow you access. SteveD ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 23, 2019, 1:00pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/32 "2019-09-23T13:00:58Z")
It’s not sensitive … ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 23, 2019, 1:06pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/33 "2019-09-23T13:06:21Z")
Under Letsencrypt is cli.ini & renewal-hooks. ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 23, 2019, 1:09pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/34 "2019-09-23T13:09:13Z")
I turned off the orange proxy. Now what? Am I using the wrong files for Home Assistant. I ran acme.sh as the Home Assistant user. Also, since a cert was issued on the name do I need to revoke it? ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 23, 2019, 2:34pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/35 "2019-09-23T14:34:49Z")
I revoked the certificate and reissued it without the proxy. It still did not work. I revoked it again but when I do —list it still shows up after reboot. What am I doing wrong en? ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 23, 2019, 3:22pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/36 "2019-09-23T15:22:23Z")
Az - I got the cert to revoke. I have disabled proxy. My questions will hopefully be a bit better. Question 1. Did I use the correct paths for Home Assistant for key and cert. Question 2. Could a port interfere with acme? The user is required to have a port forward for the ip to port 8123. So if my paths are correct do you see any reason that [Https://domain.com:8123](Https://domain.com:8123) would cause a problem? Question 3. Normally, when using certbot, I see files called cert.pem, fullchain.pem, privkey.pem. What are the equivalent files using acme and where are they? ---
**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\ **Post date:** [September 23, 2019, 3:28pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/37 "2019-09-23T15:28:14Z")
Hi @SMLMG > [@SMLMG](#): > > I revoked the certificate and reissued it without the proxy. It still did not work. I revoked it again but when I do —list it still shows up after reboot. What am I doing wrong en? please don't revoke certificates if the private key is safe. There is a rate limit. > **[Rate Limits - Let's Encrypt](https://letsencrypt.org/docs/rate-limits/)** > > Let’s Encrypt provides rate limits to ensure fair usage by as many people as possible. We believe these rate limits are high enough to work for most people by default. We’ve also designed them so renewing a certificate almost never hits a... > **Revoking certificates does not reset rate limits** , because the resources used to issue those certificates have already been consumed. Create a backup of your working certificate. If not, you may hit the limit. Then you don't have a certificate - and you can't create a new. You have to wait 7 days. ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 23, 2019, 3:49pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/38 "2019-09-23T15:49:35Z")
Mr. Auer: I have been trying for a week now to get something working using acme.sh that, on the face or it, should be easy. However, without anyone to talk to the information comes to me only as mistakes are made. I need a chat or something to get one going using DNS validation with an automated renewal. I am not trying to say that I have not gotten help. In fact, your team has gone above and beyond. But I’m now in a situation where I have no access to my home automation and I did before all this began. Can I please speak or chat to someone before your rate limits are hit? ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [September 23, 2019, 8:52pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/39 "2019-09-23T20:52:01Z")
Did you restart Home Assistant after you updated its configuration to use the acme.sh certificate paths? Because when I visit [https://woodlandhillsnorthsanantonio.duckdns.org:8123](https://woodlandhillsnorthsanantonio.duckdns.org:8123) , it is clearly still using the old certificate. For what it’s worth, I think your new Home Assistant configuration looks correct, but I’ve never used it, so I can’t tell you definitively. ---
**Author:** ![SMLMG](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/smlmg/32/34094_2.png) [@SMLMG](https://community.letsencrypt.org/u/SMLMG)\ **Post date:** [September 25, 2019, 1:11pm UTC](https://community.letsencrypt.org/t/it-worked-great-but/102260/40 "2019-09-25T13:11:18Z")
Good Morning Az … I used dehydrated to issue a new certificate. I do not know what was happening with Cloudflare. Acme.sh would claim claim certificate success but I could never Https into my site. I just deleted the domain in Cloudflare and reset the name servers in NoIP. I would really like to get Cloudflare, acme.sh and Home Assistant on the same page but cannot figure out what I’m missing. While we’re here - can I copy my let’s encrypt directories to another server with the same architecture and OS and have everything work correctly inclusive of renewal? Let me know if you want more information on dehydrated to add to your library. Thanks for everything Az. [Previous page](https://community.letsencrypt.org/t/it-worked-great-but/102260.md?page=1) [Next page](https://community.letsencrypt.org/t/it-worked-great-but/102260.md?page=3)