an oddity with LE - actually two of them...

Discussion in 'ISPConfig 3 Priority Support' started by craig baker, Sep 27, 2023.

Page 2 of 2
  1. till

    till Super Moderator Staff Member ISPConfig Developer

    If you don't care that these sites will get broken SSL wise, then you can probably still switch the LE client.
     
    till, Sep 28, 2023
    #21
  2. craig baker

    craig baker Member HowtoForge Supporter

    so... if I want to delete the existing sites how to I switch to certbot? I assume thats what you are suggesting?
    and I would have to redo all the system certs as well. i assume we cant mix the two?
    also - can I switch from amavisd to rspamd on centos? is that simple? or painful? or Something To Be Avoided?
    oh - of course you were right - the mx record had just not percolated to outlook yet . mail flows now.
    the two CNAMEs godaddy gave explictly did NOT put a '.' after autodiscover etc. so I did not either!
     
    craig baker, Oct 2, 2023
    #22
  3. till

    till Super Moderator Staff Member ISPConfig Developer

    It's enough to disable SSL for the sites, then move /root/acme.sh folder to a different place as a backup, install certbot and run "ispconfig_update.sh --force" and let the ISPConfig updater create a new system SSL cert.

    Then they will likely fail until you add the dot. That Godady did not show a dot does not necessarily mean that you do not have to add one when using a BIND DNS server.

    See:

    https://www.zytrax.com/books/dns/ch8/cname.html

    I've never Tested Rspamd on Centos with ISPConfig, so not sure if it works there at all.
     
    till, Oct 2, 2023
    #23
    ahrasis likes this.
  4. craig baker

    craig baker Member HowtoForge Supporter

    and does debian use acme? or can it be convinced to use certbot? and is acme in any way better? worth the change?
     
    craig baker, Oct 5, 2023
    #24
  5. till

    till Super Moderator Staff Member ISPConfig Developer

    That's not OS specific. You are free to choose wich LE client you use On Debian, CentOS, and Ubuntu. You should use the client that you used on the old system that you like to migrate to this server, as you would otherwise lose all existing certs.
     
    till, Oct 5, 2023
    #25
  6. craig baker

    craig baker Member HowtoForge Supporter

    ok so if I take the plunge and your debian autoinstaller - it installs postfix, rspamd, redis, LE (certbot??) etc etc? all magically?
    I've taken to installing google authenticator on my servers now. you can never be too careful!
    I guess I might consider nginx as well if I'm going whole-hog. but I do have honest-to-got cgi programs I run. I see there may be workarounds. but is current apache that much worse if you have gobs of memory?
    Inquiring minds etc etc!
     
    craig baker, Oct 7, 2023
    #26
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    It's PSaaS - Perfect Server as a Script ;) But in fact, the setup is even more extended than what is covered in the Perfect Server guides.
    Regarding certbot, it will use acme.sh unless you specify to use Certbot, see commandline options at the end of the tutorial!

    https://www.howtoforge.com/ispconfig-autoinstall-debian-ubuntu/

    If you are not familiar with Nginx yet, you'd better go with Apache. Nginx is great and I don't use Apache anymore for years, all my systems use Nginx. But most CMS and websites need a customized config as that's what the cms deliver for apache in .htaccess file must be rewritten to a Nginx compatible config as .htaccess is an Apache only technology, Nginx has a different config syntax. And regarding speed, most CPU cycles get consumed by PHP and MySQL today anyway and not Apache or Nginx.
     
    till, Oct 7, 2023
    #27
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    Btw. I recommend that you just spin up a VM with en empty Debian 12 system, you can even do that on your desktop or get a cheap cloud server from hetzner or Digitalocean, run the auto-installer and test things to see if you like that setup or not.
     
    till, Oct 7, 2023
    #28
  9. craig baker

    craig baker Member HowtoForge Supporter

    ok bog DAM you Till. I wiped rocky 8 and did a debian 12 install. That HURT!
    autoinstaller all seemed good playing with it.
    I noticed though that the debian 11 instructions for installing google-authenticator do not yield joy . it was easy to install under redhat/centos, but it does not seem to play nice with debian 12.
    I found debian 11 instructions, followed them but they dont work. One of the lines ChallengeResponseAuthentication was missing from sshd_config added it, did other things, but could not log in at all. glad I had another ssh session active at the same time so I could undo it!
    apart from that. pretty dam nice :)
    almost ready to use the migtool. now, I forgot to force certbot to be used. but have no websites up. so whats our instructions for converting to certbot?
    or can I use the autoinstaller to correct this?
    then after using migtool, I plan on retiring ns10 in favor of ns11 (now debian 12 AAAARRRGGGH gnaashing of teeth ). so I need to so a mysql update to change all the ips from the ns10 server to the ns11 server.
    thats that syntax? phpmyadmin seems running fine.
    Then I have to manually tell the registrars that nameservers are now ns11 and ns4 instead of ns10 and ns4 on all my hundreds of websites.
    Or may be I pull a switcheroo and rename ns11 to ns10 then I just need to change all the ips? is that a better tack?
    then all I have to do is change the hostname def on godaddy of ns10 from ns10-ip to ns11-newip.
    I could not do that while ns10 was still live on the network (LE would find the old server), but is there a clean way to do this?
    what do you think?
     
    Last edited: Oct 14, 2023
    craig baker, Oct 14, 2023
    #29
  10. craig baker

    craig baker Member HowtoForge Supporter

    first tiny contribution - in Debian 12 (as opposed to 11) the parameter
    ChallengeResponseAuthentication no longer exists it is now:
    KbdInteractiveAuthentication yes instead. then 2fa works as expected
     
    craig baker, Oct 14, 2023
    #30
Page 2 of 2

Share This Page