Restricted domain by Let's Encrypt

Help
1

Hi

I'm using CyberPanel and in this week we had problem with email server runing on this control panel (snippy mail)
I asked theme and they told me to click on SSL Issue in the SSL section of control panel
I did and nothing changed , so many times I tried to solve that , after that my site alsow lost the SSL and I get this Your SSL will expire in 3649 days.
image

I installed the control panel in difrrent IP address but still get Your SSL will expire in 3649 days.
Now my site is runing without SSL and we are big shop and we have many customers

Is there any way to solve that?

2

I moved your topic to the Help category. You would have been asked to answer these questions which will be very helpful to us.

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is:

I ran this command:

It produced this output:

My web server is (include version):

The operating system my web server runs on is (include version):

My hosting provider, if applicable, is:

I can login to a root shell on my machine (yes or no, or I don't know):

I'm using a control panel to manage my site (no, or provide the name and version of the control panel):

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

7 Likes
3

My Domain is : [redacted]

I ran this command: wget -O - https://get.acme.sh | sh

It produced this output:

wget -O -  https://get.acme.sh | sh
--2022-07-19 23:07:54--  https://get.acme.sh/
Resolving get.acme.sh (get.acme.sh)... 188.114.96.3, 188.114.97.3, 2a06:98c1:312                                                1::3, ...
Connecting to get.acme.sh (get.acme.sh)|188.114.96.3|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘STDOUT’

-                       [ <=>                ]     937  --.-KB/s    in 0s

2022-07-19 23:07:55 (13.1 MB/s) - written to stdout [937]

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  211k  100  211k    0     0   286k      0 --:--:-- --:--:-- --:--:--  285k
[Tue 19 Jul 2022 11:07:55 PM +0430] Installing from online archive.
[Tue 19 Jul 2022 11:07:55 PM +0430] Downloading https://github.com/acmesh-offici                                                al/acme.sh/archive/master.tar.gz
[Tue 19 Jul 2022 11:07:56 PM +0430] Extracting master.tar.gz
[Tue 19 Jul 2022 11:07:57 PM +0430] Installing to /root/.acme.sh
[Tue 19 Jul 2022 11:07:57 PM +0430] Installed to /root/.acme.sh/acme.sh
[Tue 19 Jul 2022 11:07:57 PM +0430] Installing alias to '/root/.bashrc'
[Tue 19 Jul 2022 11:07:57 PM +0430] OK, Close and reopen your terminal to start                                                 using acme.sh
[Tue 19 Jul 2022 11:07:57 PM +0430] Installing cron job
7 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/null
[Tue 19 Jul 2022 11:07:57 PM +0430] Good, bash is found, so change the shebang t                                                o use bash as preferred.
[Tue 19 Jul 2022 11:07:58 PM +0430] OK
[Tue 19 Jul 2022 11:07:58 PM +0430] Install success!

My web server is (include version): OpenLitespeed

LiteSpeed/1.7.16 Open (BUILD built: Fri May 13 19:00:23 UTC 2022)
        module versions:
        lsquic 3.0.4
        modgzip 1.1
        cache 1.64
        mod_security 1.4

The operating system my web server runs on is (include version): Ubuntu TLS 20.04

My hosting provider, if applicable, is: Exclusive server that runing CyberPanel

I can login to a root shell on my machine (yes or no, or I don't know): Yes I installed the Control Panel and have full access to

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): Yes , CyberPanel

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):
This is log for cyberpanel in ssl section

4

Does the CyberPanel have an SSL option?

4 Likes
5

Yes it does

1 Like
6

Then, I'd go down that path [and see where it leads].

5 Likes
7

Thanks,
I'm waiting for your help

1 Like
8

But we are NOT CyberPanel support.
How can we help you?

5 Likes
9

My ssl : Your SSL will expire in 3649 days
I want to remove restriction of my domain so I can get new ssl and solve my problem

10

Then you need to investigate why:

[07.19.2022_16-10-40] Failed to obtain SSL, issuing self-signed SSL for: [redacted]
[07.19.2022_16-10-40] [Errno 111] Connection refused

Why were the HTTP connections refused?

4 Likes
11

If I knew that , I was solved the issu and there was no need to ask here

12

Only you can know, or find why, the HTTP connections are being refused to your system.

Form the Internet, we can only see if it is open or blocked/closed.
Form my IP, I can get to your site:

curl -Ii [redacted]
HTTP/1.1 301 Moved Permanently
set-cookie: digits_countrycode=98; expires=Fri, 22-Jul-2022 18:58:23 GMT; Max-Age=259200; path=/; SameSite=None
set-cookie: PHPSESSID=tqsuckd8vfssug3fc90ctmpdui; path=/
x-dns-prefetch-control: on
expires: Thu, 19 Nov 1981 08:52:00 GMT
cache-control: no-store, no-cache, must-revalidate
pragma: no-cache
content-type: text/html; charset=UTF-8
x-litespeed-tag: ac0_HTTP.200,ac0_HTTP.301
x-redirect-by: WordPress
location: [redacted]
x-litespeed-cache-control: no-cache
date: Tue, 19 Jul 2022 18:58:23 GMT
server: LiteSpeed
connection: Keep-Alive

But apparently not all Internet IPs can reach your site.

3 Likes
13

Why do you think your domain is restricted? Your server currently just has a self-signed certificate installed, not something related to Let's Encrypt.

4 Likes
14

Becuse when I asked to get new ssl , the error appear
Would you please tell me how can we find that we get self-signed certificate installed?

15

I do not see an error which would lead me to think your domain is restricted by Let's Encrypt. Could you please help me to find that error?

2 Likes
16

Yes
I got email
Even I cannot enable the ssl in our server and site.

17

That email error has nothing to do with an SSL cert.

*** dns.google can't find salamtejarat.ir: Non-existent domain

3 Likes
18

I see the errno 111 failure in the log you uploaded. And, your try just before this one failed because your local DNS was not working.

[07.19.2022_16-10-40] /root/.acme.sh/acme.sh --issue -d [redacted] --cert-file /etc/letsencrypt/live/[redacted]/cert.pem --key-file /etc/letsencrypt/live/[redacted]/privkey.pem --fullchain-file /etc/letsencrypt/live/[redacted]/fullchain.pem -w /usr/local/lsws/Example/html -k ec-256 --force --server letsencrypt
[07.19.2022_16-10-40] Failed to obtain SSL, issuing self-signed SSL for: [redacted]
[07.19.2022_16-10-40] [Errno 111] Connection refused
[07.19.2022_16-10-40] Self signed SSL issued for [redacted].
[07.19.2022_16-37-26] /usr/local/lsws/lsphp74/etc/php/7.4/litespeed/php.ini
[07.19.2022_16-47-48] 'utf-8' codec can't decode byte 0xe0 in position 700: invalid continuation byte

What do these commands show (just a test)?

curl -I https://acme-v02.api.letsencrypt.org
curl -I https://google.com

Also, the next time you run acme.sh please add --debug 2 so more details show

3 Likes
19

The result of thoese commands

root@srvcyberpanelnoemail:~# curl -I https://acme-v02.api.letsencrypt.org
HTTP/2 200
server: nginx
date: Tue, 19 Jul 2022 19:37:30 GMT
content-type: text/html
content-length: 1540
last-modified: Thu, 23 Jun 2022 21:25:28 GMT
etag: "62b4da48-604"
x-frame-options: DENY
strict-transport-security: max-age=604800

root@srvcyberpanelnoemail:~# curl -I https://google.com
HTTP/2 301
location: https://www.google.com/
content-type: text/html; charset=UTF-8
date: Tue, 19 Jul 2022 19:37:38 GMT
expires: Thu, 18 Aug 2022 19:37:38 GMT
cache-control: public, max-age=2592000
server: gws
content-length: 220
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=25920                                             00,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000                                             ; v="46,43"
20

I missed that codec problem ...
It should also be addressed.

2 Likes