Shoutcast access to letsencrypt certs

Help
22

Normally that should be fullchain.pem not just cert.pem

Without fullchain your server does not send the matching intermediate cert. This may prevent browsers from treating it as a trusted connection.

2 Likes
23

Sorry, I got that from someone else. 644 would be a better idea?

24

Thanks for the recommendation. Changed that and it's still working after server restart

1 Like
25

Hi @MattMski,

Mine are -rw------- which is 600 for Private Keys, you do not want just anyone to be able to read the Private Keys!

26

Ok, had to add my user to be able to do sudo, then did as you suggested, but I still get the same thing. Is there a way to verify this shoutcast user has the permissions now?

Should I change that from 0755 to 600 as suggested?

27

Make sure you did both live and archive directories.

If you want to verify, ls -l /etc/letsencrypt/live/domain.net/privkey.pem

It'll either show you the files or permission denied

28

Yes, I did both but if I try the ls -l /usr/local/psa/var/modules/letsencrypt/etc/live/rock101klol.com/ is returns:
shoutcast.2.6.1.777]$ ls -l /usr/local/psa/var/modules/letsencrypt/etc/live/rock101klol.com/
ls: cannot access /usr/local/psa/var/modules/letsencrypt/etc/live/rock101klol.com/: Permission denied

If I use: sudo ls -l /usr/local/psa/var/modules/letsencrypt/etc/live/rock101klol.com/
It lists the files.

29

You want to have eXecute on the directories, but you don't need it on the files.

I'd like the third number to be zero, but that will break your system if you run shoutcast as another user. This is one of the reasons nginx and apache usually start as root and then drop privileges.

You can also use a deploy hook to copy and chown fullchain and key.

2 Likes
31

So:

sudo chmod +x /usr/local/psa/var/modules/letsencrypt/etc/live/rock101klol.com/
sudo chmod +x /usr/local/psa/var/modules/letsencrypt/etc/archive/rock101klol.com/
sudo chmod -R 0600 /usr/local/psa/var/modules/letsencrypt/etc/live/rock101klol.com/
sudo chmod -R 0600 /usr/local/psa/var/modules/letsencrypt/etc/archive/rock101klol.com/

But why doesn't it seem to be working? I still cannot view these directories. It's still not working.

32

There's a lot we don't know about your setup, like what's your acme client and what user it runs as.

I know nothing about plesk and the assumptions it makes.

1 Like