Creating letsencryot certificates with ISPCONFIG

Discussion in 'Installation/Configuration' started by kmchen, Jan 21, 2019.

  1. kmchen

    kmchen Member

    I found 2 tuto to create Letsencrypt certificates for ISPCONFIG domains:
    Both methods, by symlinks or by copy/paste are a little heavy if you have to do that for every domain

    I used the very simple letsencryot original method, a year ago, to automaticaly create certificates for all vhosts present in Apache that worked fine
    certbot-auto --apache
    Why should I rely thoose certificates to ISPCONFIG as it only adds overhead ?
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Both tutorials are completely outdated and therefore wrong. Why don't you just follow the official ISPConfig documentation and manual?

    Creating a LE cert for a site is so easy, all you have to do is to login to ispconfig, go to the website settings of the site where you want to have an LE SSL cert, enable the SSL and let's encrypt checkbox of the site. That's all.
  3. kmchen

    kmchen Member

    That's what I expected but when I do that and save, no message is shown but it doesn't work. When I come back to the website's panel the checboxes LE and SSL that I checed earlier are unchecked
    ispconfig.log is empty
  4. till

    till Super Moderator Staff Member ISPConfig Developer

  5. kmchen

    kmchen Member

    Thanks for the link. I have put ispconfig in debug mode and now I get the ispconfig.log message:
    Failed authorization procedure. (http-01): urn:acme:error:unauthorized :: The client lacks sufficient authorization :: Invalid response from "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"
    But when I reach the page in a browser or wget since the server I get the index.html I created "Bienvenue à" (php pages do not work for now cause of problems with php5.6)
  6. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    As you said initially, you originally setup your certificates outside of ispconfig, so the setup is incompatible with what ISPConfig uses. What I would do is try to remove the old setup and use ISPConfig going forward.

    Try turning the ssl and letsencrypt checkboxes off for both sites and save the settings. Then rename the current /etc/letsencrypt directory, and install certbot according to the Perfect Server guide for your OS. Then either re-run update.php from the ISPConfig installation files and let it reconfigure services, or at least verify that there is an alias for your web server pointing /.well-known/acme-challenge to the /usr/local/ispconfig/interface/acme/.well-known/acme-challenge directory (eg. in /etc/apache2/sites-enabled/000-ispconfig.conf on debian with apache). Then enable the ssl and letsencrypt checkbox for one of your sites and see if it works.

    Don't ever use the --apache option, it is incompatible with ISPConfig (both certbot and ISPConfig will make changes to the vhost files that are incompatible with the other).
  7. kmchen

    kmchen Member

    Debug mode permted me to discover that webroots were not write enable... Sorry guys
    Last edited: Jan 22, 2019

Share This Page