[solved] Letsencrypt writes certs but checkbox gets empty after a while

Discussion in 'Installation/Configuration' started by linus, Apr 5, 2017.

  1. gobrien

    gobrien New Member

    Florian,
    Just FYI, mine is doing exactly the same. I upgraded this morning to stable using the upgrade script with no errors.
    When I check the LetsEncrypt box and save, all is well ... the config updates with correct ssl locations and certs are put in
    /var/www/clients/client5/web23/ssl/hostname-le.crt (-le.key and -le.bundle)
    Next trip back to the UI, the box is unchecked and if I change something else about the config and forget to go back and recheck the LE box, it reverts to the old self-signed cert.
    Separately, I went into the database and forced it to ssl_letsencrypt='y'. It stayed that way for a minute or so and then went back to 'n'.
    This is not a problem for me now that I know to re-check the LE box. Let me know if there is anything I should check to help out.
    Gareth.
     
  2. linus

    linus Member

    No, there are no custom files there.
     
  3. till

    till Super Moderator Staff Member ISPConfig Developer

    @gobrien: You can use the ISPConfig debug mode to see why the SSL cert gets reverted.
     
  4. florian030

    florian030 Well-Known Member HowtoForge Supporter

    And: do you have a *err-file for the domain in /etc/apache2/sites-enabled?
     
  5. linus

    linus Member

    No, I don't think so?
    ls -la /etc/apache2/sites-enabled/
    Code:
    000-apps.vhost
    000-default.conf
    000-ispconfig.conf
    000-ispconfig.vhost
    100-example.com.vhost
    
     
  6. florian030

    florian030 Well-Known Member HowtoForge Supporter

    sorry. sites-availables
     
  7. linus

    linus Member

    No, I couldn't find any of those either:

    ls -la /etc/apache2/sites-available/*err*
    ls: cannot access /etc/apache2/sites-available/*err*: No such file or directory
     
  8. linus

    linus Member

    Thank you, Florian! Florian found an apache-plugin for ispconfig on my dns slave server. He said if you run a mirror ispconfig, all services will be mirrored. As long as server-plugin is active, this will be excuted and apache could not find the cert so the slave disabled LE. In the system server services for the slave I had only DNS-server checked and Is mirror of server, but somehow I had installed the apache plugin too.

    Days of wondering came to an end. =)
     
  9. Jesse Norell

    Jesse Norell Well-Known Member Staff Member Howtoforge Staff

    This problem would/could have been avoided even with the bad apache plugin present if/when the ability to mirror selected services is implemented. I found https://git.ispconfig.org/ispconfig/ispconfig3/issues/990 for DNS specifically, though I thought there was another ticket for the issue a little more generally (ie. so you could set a server to mirror another service on a per-service basis).
     
    Baptistev likes this.
  10. florian030

    florian030 Well-Known Member HowtoForge Supporter

    This problem does not exist, when you did not install "useless" software. I.e. you don't need apache on an dns-server. I don't see any problems if we send all data to a mirror. But we may can enable/disable plugins on a server when you enable/disable a service using the GUI.
     
  11. Jesse Norell

    Jesse Norell Well-Known Member Staff Member Howtoforge Staff

    Yes, it's mostly harmless the way it's currently implemented (the extra data would cause a little overhead but be unused); the per-service mirroring would be a new feature to handle scenarios like: server1 is web+dns, server2 is mail+dns mirror (ony dns service is mirrored).
     
    Baptistev and elmacus like this.

Share This Page