Renewal issue mac osx https

Help
22

this has failed again today :frowning: HELP !
acme.sh/acme.sh --issue --force --dns dns_cf -d mail.example.com.au -d autodiscover.example.com.au
[Fri 1 Oct 2021 08:33:35 AEST] Using CA: https://acme.zerossl.com/v2/DV90
[Fri 1 Oct 2021 08:33:35 AEST] Create account key ok.
[Fri 1 Oct 2021 08:33:35 AEST] No EAB credentials found for ZeroSSL, let's get one
[Fri 1 Oct 2021 08:33:35 AEST] acme.sh is using ZeroSSL as default CA now.
[Fri 1 Oct 2021 08:33:35 AEST] Please update your account with an email address first.
[Fri 1 Oct 2021 08:33:35 AEST] acme.sh --register-account -m my@example.com
[Fri 1 Oct 2021 08:33:35 AEST] See: ZeroSSL.com CA · acmesh-official/acme.sh Wiki · GitHub
[Fri 1 Oct 2021 08:33:36 AEST] Please add '--debug' or '--log' to check more details.
[Fri 1 Oct 2021 08:33:36 AEST] See: How to debug acme.sh · acmesh-official/acme.sh Wiki · GitHub
bash-3.2# /Users/user/.acme.sh/acme.sh acme.sh --register-account -m support@mail.example.com.au
/Users/user.acme.sh/acme.sh: line 7563: acme.sh: command not found
bash-3.2# /Users/user/.acme.sh/acme.sh --issue --force --dns dns_cf -d mail.example.com.au -d autodiscover.example.com.au --server letsencrypt
[Fri 1 Oct 2021 08:36:17 AEST] Please refer to libcurl - Error Codes for error code: 60
[Fri 1 Oct 2021 08:36:19 AEST] Can not init api for: https://acme-v02.api.letsencrypt.org/directory.
[Fri 1 Oct 2021 08:36:19 AEST] Sleep 10 and retry.

acme is uptodate

23

It seems that libcurl is unable to speak with the acme api.

Please show output of
hostnamectl | grep -i sys
openssl version
sudo apt update
sudo apt install curl
sudo apt install ca-certificates

and for good measure:
sudo apt install libgnutls-openssl27 libgnutls30

P.S. Sorry, I just realized you are on a MAC. Not sure how much of that (if any) will not just error out.

24

i upgrade the OS and openssl and all libs now function but my webserver still shows the cert as
untrusted certificate
DST Root CA X3
ISRG Root X1
mail.example.com

any ideas ?

25

Try:
curl -I https://acme-v02.api.letsencrypt.org/directory

Does that fail?
If so...

26

here's the result

curl -I https://acme-v02.api.letsencrypt.org/directory
HTTP/2 200
server: nginx
date: Fri, 01 Oct 2021 03:21:36 GMT
content-type: application/json
content-length: 658
cache-control: public, max-age=0, no-cache
replay-nonce: 0101pIKH3rENWSxdEuPqovcqFUKeadSb1f14sSiE2yeo2bs
x-frame-options: DENY
strict-transport-security: max-age=604800
27

curl works; But whatever is used to connect to that /directory fails.
Then curl is not being used.
Try:
wget --delete-after https://acme-v02.api.letsencrypt.org/directory

28

It IS renewing jsut the actual mail host wont trust it : heres the renewal process
bash-3.2# /Users/user/.acme.sh/acme.sh --issue --dns dns_cf -d example.com.au -d autoconfigure.example.com.au -d mail.example.com.au
[Fri 1 Oct 2021 13:27:15 AEST] Using CA: https://acme-v02.api.letsencrypt.org/directory
[Fri 1 Oct 2021 13:27:15 AEST] Creating domain key
[Fri 1 Oct 2021 13:27:16 AEST] The domain key is here: /Users/user/.acme.sh/example.com.au/example.com.au.key
[Fri 1 Oct 2021 13:27:16 AEST] Multi domain='DNS:example.com.au,DNS:autoconfigure.example.com.au,DNS:mail.example.com.au'
[Fri 1 Oct 2021 13:27:16 AEST] Getting domain auth token for each domain
[Fri 1 Oct 2021 13:27:21 AEST] Getting webroot for domain='example.com.au'
[Fri 1 Oct 2021 13:27:21 AEST] Getting webroot for domain='autoconfigure.example.com.au'
[Fri 1 Oct 2021 13:27:21 AEST] Getting webroot for domain='mail.example.com.au'
[Fri 1 Oct 2021 13:27:21 AEST] Adding txt value: xxxxxxxxxx for domain: _acme-challenge.example.com.au
[Fri 1 Oct 2021 13:27:22 AEST] Adding record
[Fri 1 Oct 2021 13:27:22 AEST] Added, OK
[Fri 1 Oct 2021 13:27:22 AEST] The txt record is added: Success.
[Fri 1 Oct 2021 13:27:23 AEST] Adding txt value: xxxxxxxxxx for domain: _acme-challenge.autoconfigure.example.com.au
[Fri 1 Oct 2021 13:27:24 AEST] Adding record
[Fri 1 Oct 2021 13:27:24 AEST] Added, OK
[Fri 1 Oct 2021 13:27:24 AEST] The txt record is added: Success.
[Fri 1 Oct 2021 13:27:24 AEST] Let's check each DNS record now. Sleep 20 seconds first.
[Fri 1 Oct 2021 13:27:45 AEST] You can use '--dnssleep' to disable public dns checks.
[Fri 1 Oct 2021 13:27:45 AEST] See: dnscheck · acmesh-official/acme.sh Wiki · GitHub
[Fri 1 Oct 2021 13:27:45 AEST] Checking example.com.au for _acme-challenge.example.com.au
[Fri 1 Oct 2021 13:27:46 AEST] Domain example.com.au '_acme-challenge.example.com.au' success.
[Fri 1 Oct 2021 13:27:46 AEST] Checking autoconfigure.example.com.au for _acme-challenge.autoconfigure.example.com.au
[Fri 1 Oct 2021 13:27:46 AEST] Domain autoconfigure.example.com.au '_acme-challenge.autoconfigure.example.com.au' success.
[Fri 1 Oct 2021 13:27:46 AEST] All success, let's return
[Fri 1 Oct 2021 13:27:46 AEST] Verifying: example.com.au
[Fri 1 Oct 2021 13:27:47 AEST] Pending, The CA is processing your order, please just wait. (1/30)
[Fri 1 Oct 2021 13:27:50 AEST] Success
[Fri 1 Oct 2021 13:27:50 AEST] Verifying: autoconfigure.example.com.au
[Fri 1 Oct 2021 13:27:51 AEST] Pending, The CA is processing your order, please just wait. (1/30)
[Fri 1 Oct 2021 13:27:54 AEST] Success
[Fri 1 Oct 2021 13:27:54 AEST] mail.example.com.au is already verified, skip dns-01.
[Fri 1 Oct 2021 13:27:54 AEST] Removing DNS records.
[Fri 1 Oct 2021 13:27:54 AEST] Removing txt: xxxxxxxxxx for domain: _acme-challenge.example.com.au
[Fri 1 Oct 2021 13:27:55 AEST] Removed: Success
[Fri 1 Oct 2021 13:27:55 AEST] Removing txt: xxxxxxxxxx for domain: _acme-challenge.autoconfigure.example.com.au
[Fri 1 Oct 2021 13:27:57 AEST] Removed: Success
[Fri 1 Oct 2021 13:27:57 AEST] Verify finished, start to sign.
[Fri 1 Oct 2021 13:27:57 AEST] Lets finalize the order.
[Fri 1 Oct 2021 13:27:57 AEST] Le_OrderFinalize='https://acme-v02.api.letsencrypt.org/acme/finalize/94113530/xxxxxxxxxx'
[Fri 1 Oct 2021 13:27:58 AEST] Downloading cert.
[Fri 1 Oct 2021 13:27:58 AEST] Le_LinkCert='https://acme-v02.api.letsencrypt.org/acme/cert/xxxxxxxxxx'
[Fri 1 Oct 2021 13:27:59 AEST] Cert success.

Importing the cert into the mail host shows the HIERACHY as Expired ( untrusted certificate)
DST root CA X3
ISRG Root X1
R3
mail.example.com.au expires 2021-12-30

29

Try removing "DST root CA X3" from:
[should be the last cert - at the bottom of the file]
/Users/user/.acme.sh/example.com.au/fullchain.cer

If that fails, then also replace "ISRG Root X1 (cross-signed)" with the self-signed version.

30

OK the libcurl problem was against ZeroSSL.COM (not LE):

31

This is useful information.
I didn't explicitly choose the Android compatibility option. For sites that I host, MacOS compatibility is more important. What do I need to do to update all my certificates to provide MacOS compatibility and sacrifice the compatibility with older Android devices?

32

Manually: Remove the last cert ("DST Root CA X3") from all the fullchain.pem files in use.
OR remove the last two certs from fullchain.pem and add in the self-signed "ISRG Root X1" cert.

(more) Automated: Reissue all certs preferring the alternate path.

33

acme.sh has the ability to "--set-default-chain" what should we set that too or is this something that shouldnt need doing ? Ive had such varying results with the expiration on many different OS's that host the service - some older OS's (all mac) have issued the cert all fine others will not accept their own renewed domain cert software suggests its untrusted - the only way is to import the "fullchain.cer" whereas before the cronjob would import the mail.example.com.cer ... even /Users/user/.acme.sh/acme.sh --list shows out of date certificate yet the cert actively inplace shows a few months of coverage - trying to unpick one case at a time but any help is welcomed !

34

IMO, setting a default is good because it puts the control of that choice in your hands.
Which one should one choose?
Well, that depends; as they are basically geared toward different target audiences (clients).
The "DST Root CA X3 (expired)" trust path is provided as the only way to get old Android devices to trust LE certs.
The "ISRG Root X1" trust path is provided as the one for modern devices (that already have it in their trusted root stores).

35

Thankyou for your response so would one add it like this : .acme.sh/acme.sh --issue --alpn -d mail.example.com --server letsencrypt --set-default-chain "ISRG Root X1" not sure how it should be done ! we use the certificate for mac clients not android at all

36

If this is what you had before:

Then add:
--preferred-chain "ISRG Root X1"
[to make a change only for this cert]

OR

--set-default-chain "ISRG Root X1"
[to make it the default chain for all renewals (including this one)]

37

legend ! Thankyou vey much ! I dont suppose you have any experience with standalone mode using socat ? It seems so antiquated as cloudflares DNS api is so much easier but we have a singluar client that refuses to change DNS and so we must TRY to use acme.sh v 2.8.0
trying wget gives us :
wget --delete-after https://acme-v02.api.letsencrypt.org/directory

--2021-10-05 14:27:21-- https://acme-v02.api.letsencrypt.org/directory

Resolving acme-v02.api.letsencrypt.org (acme-v02.api.letsencrypt.org)... 172.65.32.248

Connecting to acme-v02.api.letsencrypt.org (acme-v02.api.letsencrypt.org)|172.65.32.248|:443... connected.

HTTP request sent, awaiting response... 200 OK

Length: 658 [application/json]

directory.tmp: Bad file descriptor

opening port 80 on the router and forwarding to the local server ip fails according to i can manually edit LE_httplisten=80 but it was on 8081 - im not sure what the hell has changed in two months !
I tried using apln and turning off my hosts 443 service but now it states
Verify error:Cannot negotiate ALPN protocol

38

I think they are up to v3.0.1 now

Sorry I don't :frowning:

Are you sure the right ports are being allowed and to the right internal IP?

39

I am however configured by previous lost engineer ! im presuming they had 80 >> 8081 to stop a clash of ports however im unsure how socat automates using acme.sh, LE says hello on port 80 and the reply it gets is "connection refused" using letsdebug >>>
Domain has an A record but a request to this address over port 80 did not succeed. Your web server must have at least one working IPv4 or IPv6 address.
port forwards are 80 >> 8081 and 80 > 80 incase socat is running on that ....

40

I'm getting cross-eyed !
If 80 >> 8081, then you need to tell acme.sh to use 8081.
[LE will always use 80]
--http-port 8081

41

Always keep your client updated - Updating the client made port 80 > 80 work and it correctly issued the cert.... im not a fan of updating for the sake of it but it appears this is a MUST with acme.sh...
Thankyou very much for you assistance @rg305 Very kind to take your time out of your day to help.