letsencrypt not auto renew(Thread Closed)

Discussion in 'Installation/Configuration' started by anthonywang, Apr 6, 2017.

  1. anthonywang

    anthonywang Member

    I have lot of domain name setup in ispconfig,
    some of domain get auto renew but some of domain name not,
    here is letsencrypt.log.10
    Code:
    2017-04-03 07:00:24,805:DEBUG:certbot.main:Root logging level set at 20
    2017-04-03 07:00:24,805:INFO:certbot.main:Saving debug log to /var/log/letsencrypt/letsencrypt.log
    2017-04-03 07:00:24,805:WARNING:certbot.cli:You are running with an old copy of letsencrypt-auto that does not receive updates, and is less reliable than more recent versions. We recommend upgrading to the latest certbot-auto script, or using native OS packages.
    2017-04-03 07:00:24,805:DEBUG:certbot.cli:Deprecation warning circumstances: /root/.local/share/letsencrypt/bin/letsencrypt / {'LANG': 'en_US.UTF-8', 'SHELL': '/bin/sh', 'SHLVL': '3', 'PWD': '/usr/local/ispconfig/server', 'LOGNAME': 'root', 'HOME': '/root', 'PATH': '/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin:/usr/X11R6/bin', '_': '/root/.local/share/letsencrypt/bin/letsencrypt'}
    2017-04-03 07:00:24,806:DEBUG:certbot.main:certbot version: 0.9.3
    2017-04-03 07:00:24,806:DEBUG:certbot.main:Arguments: ['-n']
    2017-04-03 07:00:24,806:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#standalone,PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#webroot,PluginEntryPoint#apache,PluginEntryPoint#null)
    2017-04-03 07:00:24,818:INFO:certbot.renewal:Cert not yet due for renewal
    2017-04-03 07:00:24,826:INFO:certbot.renewal:Cert not yet due for renewal
    2017-04-03 07:00:24,839:INFO:certbot.renewal:Cert not yet due for renewal
    2017-04-03 07:00:24,845:INFO:certbot.renewal:Cert not yet due for renewal
    2017-04-03 07:00:24,852:INFO:certbot.renewal:Cert not yet due for renewal
    2017-04-03 07:00:24,861:INFO:certbot.renewal:Cert not yet due for renewal
    2017-04-03 07:00:24,868:INFO:certbot.renewal:Cert not yet due for renewal
    2017-04-03 07:00:24,873:INFO:certbot.renewal:Cert not yet due for renewal
    2017-04-03 07:00:24,874:DEBUG:certbot.renewal:no renewal failures
    
    when i use ssl checker check one of my domain name on https://www.sslshopper.com/ssl-checker.html,show me these info.,
    Common name: exampleA.com
    SANs: exampleA.com, exampleB.com, www.exampleA.com
    Valid from January 3, 2017 to April 3, 2017
    it's really confuse me,exampleA.com and exampleB.com is different domain name,but why in the SANs together?

    I follow the till said (https://www.howtoforge.com/community/threads/lets-encrypt-issues.74251/)
    To fix your issue, remove the symlink of thsi vhost in the sites-enabled directory, restart apache, login to ispconfig, go to the ssl tab, empty all fields, chose delete certificate as action and press save. Then delete all ssl certs in the ssl folder f the website manually. Wait 2 minues. Login to ispconfig, enable the letsencrypt checkbox and press save. And do nothing else on the ssl tab!
    and it's not work for me.
    i already try every way 3 days,google or ispconfig forum,but still can't get it work
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    An apache or nginx vhost has one ssl cert. If you add alias or subdomains to a website, then all alias and subdomains have to be in the same SSL cert, and that's exactly what ISPConfig is doing.
     
  3. anthonywang

    anthonywang Member

    Hi till,
    exampleA.com, exampleB.com, www.exampleA.com
    the exampleB.com is other domain not subdomain or alias
    just like A.com and B.com
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Was it an alias domain before?
     
  5. anthonywang

    anthonywang Member

    nope and i think B.com is impossible a alias name for A.com,right?
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    Any domain can be an alias of another domain in an SSL cert, but ISPConfig will do that only when the domain is configured as alias. So there are several options, either the ssl check tool is mixing something up when the domains are on the same IP or the domain was an alias at some time in ispconfig or there is some kind of database corruption so that both domains are connected as alias domains in the ISPConfig DB or the ssl cert has been created or modified outside of ispconfig or maybe you used some early version or third party ispconfig plugin to create this cert, as I'm not aware of any issues with the current implementations.
     
  7. anthonywang

    anthonywang Member

    Okay,
    I delete theDomain's website,mail domain,database,database user 10 min ago,then five min. ago i recreate website again and no db,dbuser... ,but until now it's looks like still have the same certificate
    certificate has expired (3 days ago)
     
  8. anthonywang

    anthonywang Member

    I checked all domain name,only two domain can't renew,

    as is mentioned above,A.com have the problem with cert,because the cert come from my other domain name,

    B.com is normal but not auto renew
    Common name: exampleB.com
    SANs: exampleB.com, www.exampleB.com <---
    Valid from January 3, 2017 to April 3, 2017
     
  9. anthonywang

    anthonywang Member

    if not auto renew,
    is there any normal renew way,like command line for normal renew?
     
  10. anthonywang

    anthonywang Member

    Found Other solution.thanks for help!
    Thread Closed
     

Share This Page