ISP Config auto renew wrong old host-certificate

Discussion in 'ISPConfig 3 Priority Support' started by chico11mbit, Dec 22, 2021.

  1. chico11mbit

    chico11mbit Member

    Hi,
    the server's certificate, which was created with ispconfig during the update of ispconfig, was automatically renewed yesterday. But ispconfig linked the postfix smptd.cert to a certificate of the former hostname of the server. The hostname was changed some time ago. If I manually do a force update of ISPConfig, then the correct certificate of the host is created again (answering the Question with Yes) and also the symlinks are correct again.
    I am now afraid that it will happen again in three months. How can I fix this?

    Best regards
    Chico
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Why should it happen again when you don't change the hostname again?
     
  3. chico11mbit

    chico11mbit Member

    I changed it 3 month ago and renewed the cert manually with force update. All good. Now with automatic cert update after the three month the cert symlink was wrong. so i manually made a force update again and all is good. When the automatic update in 3 month will happen I think the old cert symlink will be reactivated again from ispconfig like today.
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Did you remove the old cert with certbot delete command?
    Did you run an ispconfig update with reconfigure services right after you changed the hostname to let ISPConfig create the new cert?

    If not, then certbot might have changed the symlinks back using it's renewal mechanism and by not letting ISPConfig create the new cert, your new cert probably did not had correct renewal config scripts attached.
     
  5. chico11mbit

    chico11mbit Member

    ok,
    yes, i reconfigured the services.
    Now i removed the old cert with acme.sh --remove --domain XYZ.COM and the actual host certifiacte with acme.sh --remove --domain aÁBC.COM and made a new host certificate with ispconfig_update.sh --force and reconfigure the services. I hope now it will be fine.
     
  6. chico11mbit

    chico11mbit Member

    Can I delete the files in
    /usr/local/ispconfig/interface/ssl/backup
    ?
     
  7. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    I guess so, but why not leave them?
     

Share This Page