Wget down't accept Let's Encrypt's certificate issued by acme.sh

I used to run a different wildcard cert from different issuer no problem, I successfully installed the new certificate and both Firefox and Chrome say that certificate is valid but neither Fedora's GNU Wget 1.21.2 or Debian's GNU Wget 1.20.1 accept the new certifiacte with error:

ERROR: The certificate of ‘radojevic.rs’ is not trusted.
ERROR: The certificate of ‘radojevic.rs’ doesn't have a known issuer.

My domain is:
radojevic.rs
I ran this command:

LINODE_V4_API_KEY="api key" acme.sh --issue --dns dns_linode_v4 --dnssleep 90 -d "radojevic.rs" -d "*.radojevic.rs" --server letsencrypt

It produced this output:
Everything is ok
My web server is (include version):
nginx/1.14.2
The operating system my web server runs on is (include version):
Debian 4.19.208-1
My hosting provider, if applicable, is:
Linode
I can login to a root shell on my machine (yes or no, or I don't know):
yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel):
no
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot):

v3.0.2

How did you install the issued certificate into nginx?

2 Likes

With acme.sh command

acme.sh --install-cert -d "radojevic.rs" --cert-file "/ssl/key.pem" --key-file "/ssl/cert.pem"

and nginx config

server {                                                                                                           
    listen 443      ssl http2;                                                                                     
    listen [::]:443 ssl http2;                                                                                     
    server_name radojevic.rs www.radojevic.rs;                                                                     
                                                                                                                   
    ssl_certificate     /ssl/key.pem;                                                                              
    ssl_certificate_key /ssl/cert.pem;                                                                             
                                                                                                                   
    root /www/root;                                                                                                
                                                                                                                   
    index index.html;                                                                                              
                                                                                                                   
    location / {                                                                                                   
        # First attempt to serve request as file, then                                                             
        # as directory, then fall back to displaying a 404.                                                        
        try_files $uri $uri/ =404;                                                                                 
    }                                                                                                              
}

I fixed the problem I messed the commands, sorry for your trouble. For future reference I should have typed

acme.sh --install-cert -d "radojevic.rs" --key-file "/ssl/key.pem" --fullchain-file "/ssl/cert.pem"

and nginx.con

server {                                                                                                           
    listen 443      ssl http2;                                                                                     
    listen [::]:443 ssl http2;                                                                                     
    server_name radojevic.rs www.radojevic.rs;                                                                     
                                                                                                                   
    ssl_certificate     /ssl/cert.pem;                                                                              
    ssl_certificate_key /ssl/key.pem;                                                                             
                                                                                                                   
    root /www/root;                                                                                                
                                                                                                                   
    index index.html;                                                                                              
                                                                                                                   
    location / {                                                                                                   
        # First attempt to serve request as file, then                                                             
        # as directory, then fall back to displaying a 404.                                                        
        try_files $uri $uri/ =404;                                                                                 
    }                                                                                                              
}
3 Likes

Jup! You needed the full chain instead of just the certificate! Looks all good now from my point of view.

Great you figured it out on your own!

4 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.