Decided to use Certbot Let's Encrypt wildcard SSL instead of Comodo for staging site and created a certificate with ease, added DNS TXT record and verified post command and all good. But now site refuses to load or loads www only all of the sudden. I need to be able to login at SMART48 .
My domain is: staging.smart48.com
I ran this command:
sudo certbot certonly --manual --email user@site.com --preferred-challenges dns --server https://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok -d *.staging.smart48.com
It produced this output:
Use of --manual-public-ip-logging-ok is deprecated.
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for *.staging.smart48.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please deploy a DNS TXT record under the name:
_acme-challenge.staging.smart48.com.
with the following value:
cihILT5oT8iBKGNbBEhzfBCS2vtdncJ12YBkD9Sn5PQ
Before continuing, verify the TXT record has been deployed. Depending on the DNS
provider, this may take some time, from a few seconds to multiple minutes. You can
check if it has finished deploying with aid of online tools, such as the Google
Admin Toolbox: https://toolbox.googleapps.com/apps/dig/#TXT/_acme-challenge.staging.smart48.com.
Look for one or more bolded line(s) below the line ';ANSWER'. It should show the
value(s) you've just added.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Press Enter to Continue
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/staging.smart48.com/fullchain.pem
Key is saved at: /etc/letsencrypt/live/staging.smart48.com/privkey.pem
This certificate expires on 2024-02-06.
These files will be updated when the certificate renews.
NEXT STEPS:
- This certificate will not be renewed automatically. Autorenewal of --manual certificates requires the use of an authentication hook script (--manual-auth-hook) but one was not provided. To renew this certificate, repeat this same certbot command before the certificate's expiry date.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
* Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
* Donating to EFF: https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
My web server is (include version):
nginx -V
nginx version: nginx/1.18.0 (Ubuntu)
built with OpenSSL 3.0.2 15 Mar 2022
TLS SNI support enabled
configure arguments: --with-cc-opt='-g -O2 -ffile-prefix-map=/build/nginx-zctdR4/nginx-1.18.0=. -flto=auto -ffat-lto-objects -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -fPIC -Wdate-time -D_FORTIFY_SOURCE=2' --with-ld-opt='-Wl,-Bsymbolic-functions -flto=auto -ffat-lto-objects -flto=auto -Wl,-z,relro -Wl,-z,now -fPIC' --prefix=/usr/share/nginx --conf-path=/etc/nginx/nginx.conf --http-log-path=/var/log/nginx/access.log --error-log-path=/var/log/nginx/error.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --modules-path=/usr/lib/nginx/modules --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --with-compat --with-debug --with-pcre-jit --with-http_ssl_module --with-http_stub_status_module --with-http_realip_module --with-http_auth_request_module --with-http_v2_module --with-http_dav_module --with-http_slice_module --with-threads --add-dynamic-module=/build/nginx-zctdR4/nginx-1.18.0/debian/modules/http-geoip2 --with-http_addition_module --with-http_gunzip_module --with-http_gzip_static_module --with-http_sub_module
The operating system my web server runs on is (include version):
lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 22.04.3 LTS
Release: 22.04
Codename: jammy
My hosting provider, if applicable, is:
transip.nl for DNS and hetzner.com for hosting
I can login to a root shell on my machine (yes or no, or I don't know):
Yes I can ssh in and run sudo or run commands as root
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
No I use ssh or ploi.io
The version of my client is (e.g. output of
certbot --versionorcertbot-auto --versionif you're using Certbot):
certbot --version
certbot 2.7.4
part of nginx config for site:
...
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name .staging.smart48.com;
root /home/ploi/staging.smart48.com/current/public;
# ssl_certificate /etc/nginx/ssl/certificates/staging.smart48.com.crt;
ssl_certificate /etc/letsencrypt/live/staging.smart48.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/staging.smart48.com/privkey.pem;
# ssl_certificate_key /etc/nginx/ssl/certificates/staging.smart48.com.key;
# include /etc/nginx/ssl/staging.smart48.com;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'xxxxx';
ssl_prefer_server_ciphers on;
ssl_dhparam /etc/nginx/dhparams.pem;
index index.php index.html;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options "nosniff";
add_header X-Content-Type-Options "application/json";
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
charset utf-8;
...
