acme.sh ECC sufix

I noticed, on a clean automated install on a fresh Debian 11 (hetzner cloud) today, acme.sh sets the "ECC_SUFFIX". So the certificate ends up in "/root/.acme.sh/<domain>_ecc", instead of "/root/.acme.sh/<domain>"

ISPConfig installer_base.lib.php does not seem to be able to handle this suffix if I am right. When do ispconfig_update.sh a self signed certificate is created by the script.

I tried to set it as an alternative for hostname in letsencrypt_renew_hook.sh:

Code:

elif [ -d "/root/.acme.sh/${hostname}_ecc" ] ; then
        lelive="/root/.acme.sh/${hostname}_ecc" ;

But that was not a solution.
Only when I hard set ECC_SUFFIX="", in /root/.acme.sh/acme.sh the issued certificate is used by ISPConfig. This seems an unwanted workaround to me. In my opinion, the suffix needs to be detected in installer_base_lib.php?

 

hi Till,
no I did not modify any of acme.sh config. The only thing what I had changed is the isp_config port in the ispconfig-autoinstaller (lines 1928 and 1972 of lib/os/class.ISPConfigDebianOS.inc.php, as I use jenkins on port 8080). I am (almost 100%) sure that does not interfere with acm.sh or its config.

If you like, I can setup a testserver, with an unmodified autoinstaller to be 100% sure. Let me know, and if yes, are there particular logs I can take?

edit: doing that test anyway atm, as I need to be sure for myself

 

on vanilla installer, immediately after the installer ends, the certificate folder is in _ecc dir.
Used commands and truncated output, with ofc changed credentials

Code:

hostname: test.it-cas.nl

git clone https://git.ispconfig.org/ispconfig/ispconfig-autoinstaller.git
cd ispconfig-autoinstaller/
./ispc3-ai.sh
<logging>
....
....
[INFO] Installing acme.sh (Let's Encrypt).
[INFO] acme.sh (Let's Encrypt) installed.
....
....
[INFO] Your ISPConfig admin password is: welcome01
[INFO] Your MySQL root password is: welcome02
[INFO] Warning: Please delete the log files in /root/ispconfig-autoinstaller/var/log/setup-* once you don't need them anymore because they contain your passwords!
root@test:~/ispconfig-autoinstaller# ls /root/.acme.sh/
account.conf  acme.sh  acme.sh.env  ca  deploy  dnsapi  http.header  notify  test.it-cas.nl_ecc
root@test:~/ispconfig-autoinstaller# ls -lart /root/.acme.sh/
total 260
drwx------ 5 root root   4096 Jan 29 20:43 ..
-rw-r--r-- 1 root root     78 Jan 29 20:43 acme.sh.env
-rwxr-xr-x 1 root root 221225 Jan 29 20:43 acme.sh
drwxr-xr-x 2 root root   4096 Jan 29 20:43 dnsapi
drwxr-xr-x 2 root root   4096 Jan 29 20:43 deploy
drwxr-xr-x 2 root root   4096 Jan 29 20:43 notify
drwxr-xr-x 3 root root   4096 Jan 29 20:46 ca
drwx------ 7 root root   4096 Jan 29 20:46 .
drwxr-xr-x 3 root root   4096 Jan 29 20:46 test.it-cas.nl_ecc
-rw-r--r-- 1 root root   1306 Jan 29 20:46 http.header
-rw-r--r-- 1 root root    293 Jan 29 20:46 account.conf

edit: this was done on a fresh debian 11 install on a hetzner CX11 cloud VPS using hetzners debian11 image

 

I will test ubuntu 22.04 as well tomorrow. I will check the issue tracker and add my findings there.

 

I would suggest ISPConfig use its own path from now which can be set via acme.sh command. If that is attended, do review the acme.sh install command which is basically just a copy command that you do not need to do since it will double the certs storage size, one in acme.sh and one in ispconfig and website's SSL folder respectively. Merely symlinking from the original folder to SSL folder should suffice IMHO.

 

Same on ubuntu 22.04

see https://github.com/acmesh-official/acme.sh/issues/2350#issuecomment-1407813289
The acme.sh behaviour is changed in this commit which was added afer the latest release (3.0.5) but somehow ended up in a (afaik unannounced) live version

It seems that adding "-k 4096" to the acme.sh --issue command solves it, maybe a consideration is to switch to ECDSA keys by default (later?)

 

Time to (finally) sign up and follow

 

Tested with a fresh image and install, now working as expected now. Thanks @till !

 

Just fyi, I ran into the same issue and was able to resolve it with the following:
ln -s /root/.acme.sh/domain.name_ecc /root/.acme.sh/domain.name
I then reran update_ispconfig.sh --force and ti worked.
A quick work around if someone needs to get it up fast before the fix comes out in stable.

 

Nice idea, but basically, others won't need that trick approach since new version 3.2.9p1 is already out, fixing this problem.

 

I am still using
This Version: 3.2.4
if I update to the following new version
New Version : 3.2.9p1
will it trouble my centos 7 operation?

 

thanks for your info buddy