Newly created wildcard SSL w/ Certbot fails to load site

rg305 · November 8, 2023, 5:58am

jasperf:

sudo certbot certonly --manual --email user@site.com --preferred-challenges dns --server http
s://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok -d *.staging.smart48.com -d staging.smart48.com

Without using "--cert-name" certbot will create a new cert name.
[based on the name(s) in the new cert]
But when that new name conflicts with an already existing cert name, certbot will add an incrementing suffix - starting with "-0001".

Again:

jasperf · November 8, 2023, 6:01am

that is odd as server was restarted and config does have

sudo cat /etc/nginx/sites-available/concept.staging.smart48.com 
[sudo] password for ploi: 
# Ploi Webserver Configuration, do not remove!
include /etc/nginx/ploi/concept.staging.smart48.com/before/*;

server {
    # listen 80;
    # listen [::]:80;
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    root /home/ploi/staging.smart48.com/current/public;
    server_name .concept.staging.smart48.com;

    # include /etc/nginx/ssl/concept.staging.smart48.com;
    ssl_certificate /etc/letsencrypt/live/concept.staging.smart48.com-0001/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/concept.staging.smart48.com-0001/privkey.pem;
...

Did wonder why the -0001 was added here, but I guess to not overwrite existing LE SSL for concept wildcard sites.

/etc/letsencrypt/live# ll
total 24
drwx------ 5 root root 4096 Nov  8 06:12 ./
drwxr-xr-x 7 root root 4096 Nov  8 06:12 ../
drwxr-xr-x 2 root root 4096 Sep 27 10:01 concept.staging.smart48.com/
drwxr-xr-x 2 root root 4096 Nov  8 06:12 concept.staging.smart48.com-0001/
-rw-r--r-- 1 root root  740 Mar 26  2023 README
drwxr-xr-x 2 root root 4096 Nov  8 05:20 staging.smart48.com/

jasperf · November 8, 2023, 6:02am

 certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Found the following certs:
  Certificate Name: concept.staging.smart48.com-0001
    Serial Number: 3efef45c376cccbb9c31f1d90d76aea3846
    Key Type: ECDSA
    Domains: concept.staging.smart48.com staging.smart48.com
    Expiry Date: 2024-02-06 04:12:48+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/concept.staging.smart48.com-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/concept.staging.smart48.com-0001/privkey.pem
  Certificate Name: concept.staging.smart48.com
    Serial Number: 46e123199d9213acdf24b0b4c9fbfb37a12
    Key Type: ECDSA
    Domains: *.concept.staging.smart48.com
    Expiry Date: 2023-12-26 07:01:53+00:00 (VALID: 48 days)
    Certificate Path: /etc/letsencrypt/live/concept.staging.smart48.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/concept.staging.smart48.com/privkey.pem
  Certificate Name: staging.smart48.com
    Serial Number: 3bd352ec9032237eabc2c0ee316d0a0f247
    Key Type: ECDSA
    Domains: *.staging.smart48.com
    Expiry Date: 2024-02-06 03:20:52+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/staging.smart48.com/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/staging.smart48.com/privkey.pem
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

rg305 · November 8, 2023, 6:10am

[abbreviated]

Here are the names being covered and the certs that are covering them:

Certificate Name: concept.staging.smart48.com-0001
Domains: concept.staging.smart48.com staging.smart48.com

Certificate Name: concept.staging.smart48.com
Domains: *.concept.staging.smart48.com

Certificate Name: staging.smart48.com
Domains: *.staging.smart48.com

Now serve them up [correctly] via nginx.
OR
If that is not possible, get new cert(s) and delete any unused certs.
And then serve what remains via nginx.

rg305 · November 8, 2023, 6:11am

So, [currently] for:

You will need to use this cert:

jasperf · November 8, 2023, 6:15am

So are you saying I should load concept.staging.smart48.com-0001 for both concept.staging and staging Nginx configuration files as that certificate should cover both subdomains and wildcard certificates?

Staging now still loads:

sudo cat /etc/nginx/sites-available/staging.smart48.com 
# Ploi Webserver Configuration, do not remove!
include /etc/nginx/ploi/staging.smart48.com/before/*;

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;

    server_name .staging.smart48.com;
    root /home/ploi/staging.smart48.com/current/public;

    # ssl_certificate /etc/nginx/ssl/certificates/staging.smart48.com.crt;
    ssl_certificate /etc/letsencrypt/live/staging.smart48.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/staging.smart48.com/privkey.pem;
    # ssl_certificate_key /etc/nginx/ssl/certificates/staging.smart48.com.key;
...

so guess I should update that?

jasperf · November 8, 2023, 6:23am

Yes, it does now that I use

ssl_certificate /etc/letsencrypt/live/concept.staging.smart48.com-0001/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/concept.staging.smart48.com-0001/privkey.pem;

for staging nginx config as well. Do think I need to clean up some of the certificates , but want to make sure I do not screw up again. Also will need to test some subdomains. Thanks a lot @rg305 and @MikeMcQ !

rg305 · November 8, 2023, 6:24am

Not exactly.
That cert does cover two names - but none of the wildcard entries for them.
Just the two base names:

jasperf:

  Certificate Name: concept.staging.smart48.com-0001     <<<<<<<<<<<<<<<<<<
    Serial Number: 3efef45c376cccbb9c31f1d90d76aea3846
    Key Type: ECDSA
    Domains: concept.staging.smart48.com staging.smart48.com <<<<<<<<<<<<<<
    Expiry Date: 2024-02-06 04:12:48+00:00 (VALID: 89 days)
    Certificate Path: /etc/letsencrypt/live/concept.staging.smart48.com-0001/fullchain.pem
    Private Key Path: /etc/letsencrypt/live/concept.staging.smart48.com-0001/privkey.pem

While the other two certs only cover one wildcard entry each - with no base names.

jasperf · November 8, 2023, 6:27am

Hmm, yeah, https://t3st.concept.staging.smart48.com does not work this way. So I guess I have zero wildcard options this way as you said. Perhaps I need to delete all in

ll
total 24
drwx------ 5 root root 4096 Nov  8 06:12 ./
drwxr-xr-x 7 root root 4096 Nov  8 07:02 ../
drwxr-xr-x 2 root root 4096 Sep 27 10:01 concept.staging.smart48.com/
drwxr-xr-x 2 root root 4096 Nov  8 06:12 concept.staging.smart48.com-0001/
-rw-r--r-- 1 root root  740 Mar 26  2023 README
drwxr-xr-x 2 root root 4096 Nov  8 05:20 staging.smart48.com/

and do one for both sites and wildcards. Or one wildcard for concepts and staging as I had working before. How do I do that?

rg305 · November 8, 2023, 6:29am

You mentioned several things - which one exactly?

In general, you get cert(s) BEFORE you delete any cert(s).

get new cert
use new cert
make sure nothing is still using old cert
delete old unused cert

jasperf · November 8, 2023, 6:38am

Should I then do

sudo certbot certonly --manual --email user@site.com --preferred-challenges dns --server http
s://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok -d *.concept,staging.smart48.com -d

and

sudo certbot certonly --manual --email user@site.com --preferred-challenges dns --server http
s://acme-v02.api.letsencrypt.org/directory --manual-public-ip-logging-ok -d *.staging.smart48.com -d staging.smart48.com

update configs for concepts an staging, reload Nginx, and then remove older ones?

rg305 · November 8, 2023, 6:40am

sudo certbot certonly \
--manual \
--email user@site.com \
--preferred-challenges dns \
--server https://acme-v02.api.letsencrypt.org/directory \
--manual-public-ip-logging-ok \
-d *.concept,staging.smart48.com \
-d

Something is missing at the end.

rg305 · November 8, 2023, 6:41am

sudo certbot certonly \
--manual \
--email user@site.com \
--preferred-challenges dns \
--server https://acme-v02.api.letsencrypt.org/directory \
--manual-public-ip-logging-ok \
-d *.staging.smart48.com \
-d staging.smart48.com

This is is better.

But you still haven't learned how to use:

rg305 · November 8, 2023, 6:43am

Without using "--cert-name", certbot will be forced to create a new name for this new set of names covered by each new cert.
Again "-0002" ...

jasperf · November 8, 2023, 6:43am

No I have not learned how to use certname. You mentioned :

Without using "--cert-name " certbot will create a new cert name.
[based on the name(s) in the new cert]
But when that new name conflicts with an already existing cert name, certbot will add an incrementing suffix - starting with "-0001 ".

So sounds like I should add --certname-name to overwrite existing ones. So I do not get odd numbers at the end.

rg305 · November 8, 2023, 6:44am

If you are the only nginx admin, you might as well get one cert will all four names on it:

-d *.concept.staging.smart48.com \
-d   concept.staging.smart48.com \
-d *.staging.smart48.com \
-d   staging.smart48.com

jasperf · November 8, 2023, 6:45am

sudo certbot certonly \
--manual \
--cert-name staging-certs \
--email user@site.com \
--preferred-challenges dns \
--server https://acme-v02.api.letsencrypt.org/directory \
--manual-public-ip-logging-ok \
sudo certbot certonly \
--manual \
--email user@site.com \
--preferred-challenges dns \
--server https://acme-v02.api.letsencrypt.org/directory \
--manual-public-ip-logging-ok \
-d *.concept.staging.smart48.com \
-d   concept,staging.smart48.com \
-d *.staging.smart48.com \
-d   staging.smart48.com

but what should I add for cert name ? staging ?

rg305 · November 8, 2023, 6:45am

^^ the comma is a TYPO ^^

rg305 · November 8, 2023, 6:47am

^^ requires a name [and a dash]
Like:
--cert-name staging.smart48.com
OR
--cert-name staging-cert
OR
--cert-name something-else
[any unique string will work - it's just a LABEL]

rg305 · November 8, 2023, 6:48am

^^ TYPO remains ^^

Topic		Replies	Views
Letsencrypt is reading an outdated DNS TXT record Help	4	5295	October 27, 2019
_acme-challenges mismatch from dns-rfc2136 Help	7	1297	April 12, 2020
Updating a wildcard domain Help	8	1107	December 3, 2020
Can't pass the TXT record test when trying to get a wildcard domain certificate Help	14	67	January 17, 2025
Wildcard cert request renders "Incorrect TXT record" error Help	8	9490	May 19, 2018

Newly created wildcard SSL w/ Certbot fails to load site

Related topics