Lets Encrypt not issued after installation using servisys / ispconfig_setup

Hi,

I've just setup a new server using the servisys / ispconfig_setup script on Debian 9. I wanted to use Debian 10 but it looks like some features are not available on Buster (Postgrey, OpenDKIM etc). Is this true?

Everything seems to have gone smoothly except the Admin has not been protected by a Let's Encrypt certificate automatically even though the option to do so was selected:

Code:

Checking / creating certificate for server2.serverdomain.co.uk
Using certificate path /etc/letsencrypt/live/server2.serverdomain.co.uk
Using nginx for certificate validation
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for server2.serverdomain.co.uk
Using the webroot path /usr/local/ispconfig/interface/acme for all unmatched domains.
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. server2.serverdomain.co.uk (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://server2.serverdomain.co.uk/.well-known/acme-challenge/XAMjkrLzkPTL59zGovNNpx06-BsBzgIDe3TRkILy4hE: Connection refused
Issuing certificate via certbot failed. Please check log files and make sure that your hostname can be verified by letsencrypt
Could not issue letsencrypt certificate, falling back to self-signed.

 

So I used the auto installed and all went smoothly, but have two questions:

1. Even though Lets Encrypt is installed, the admin is still only protected by a Self Signed Cert. I've made sure I can telnet to server2.serverdomain.co.uk from another server on both 80 and 443 and it works so do not understand why it hasn't worked?
   Code:

   [INFO] Letsencrypt installed.

2. The script has installed the Apache webserver, how to you get it to install nginx instead? Managed to do this by adding --use-nginx

 

I've looked at the FAQ's and cannot find anything that stands out. My server is at server2.serverdomain.co.uk, I added another domain as server3.serverdomain.co.uk and made sure the A recorded pointed to the same IP as the server in the external DNS records. After requesting SSL and Let's Encrypt in ISPConfig Admin panel, it successfully issued the Let's Encrypt certificate. This shows Let's Encrypt is working but has not protected the installation using the the auto installer?

 

So that's strange...
Typing ispconfig_updates.sh --force gave the following error:

Code:

bash: ispconfig_updates.sh: command not found

So I went down the wget https://ispconfig.org/downloads/ISPConfig-3.2.2.tar.gz route and did it that way and after answering yes to requesting a certificate it worked with the following message:

Code:

Create new ISPConfig SSL certificate (yes,no) [no]: yes

Checking / creating certificate for server2.serverdomain.co.uk
Using certificate path /root/.acme.sh/server2.serverdomain.co.uk
Using nginx for certificate validation
Symlink ISPConfig SSL certs to Postfix? (y,n) [y]: y

Symlink ISPConfig SSL certs to Pure-FTPd? Creating dhparam file may take some time. (y,n) [y]: 

1. Is it correct that the cert acme is stored in the root folder?:
   
2. This is a fresh server setup on AWS, setup using the minimal Debian 10 guide, all correct ports are open on the firewall (AWS) and lastly it was setup using the install script, so why would the Let's Encrypt script not work first time round?
3. Why did it come up with a "bash: ispconfig_updates.sh: command not found" is everything was setup using the guide and auto installer?

 

1. Yes.
2. Domain or subdomain may take some times to properly propagate.
3. Typo error.

 

Everything seems fine with the above, only issue now is the following after the auto-script:

Code:

Err:5 https://rspamd.com/apt-stable buster InRelease
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY FFA232EDBF21E25E
Reading package lists... Done
W: GPG error: https://rspamd.com/apt-stable buster InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY FFA232EDBF21E25E
E: The repository 'http://rspamd.com/apt-stable buster InRelease' is not signed.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.

 

That worked, now only seeing this message on Debian 10, is this normal?

Code:

The following packages have been kept back:
  rspamd