How to change all SSL ISPConfig 3 certs to let's encrypt

Discussion in 'General' started by Alex Tovey, Feb 27, 2019.

  1. Alex Tovey

    Alex Tovey New Member

    Hi,

    Is there a way to replace all ssl certificates with a let's encrypt one as users are getting cert pop ups on their mail clients and also the site is not letting them access their back end panel because of the security certificate.
    ]I'm running the latest version from 2 days ago when i built the machine.

    Thank you in advance.
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

  3. Alex Tovey

    Alex Tovey New Member

    I've tried going through that but just get an error when trying to create the certificate :(
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

  5. Alex Tovey

    Alex Tovey New Member

    ah wicked :) i'll pop on my reading glasses and go through it. thank you till once again you have helped me.
     
  6. Alex Tovey

    Alex Tovey New Member

    i've got no live folder on /etc/letsencrypt/live
     
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    Please go trough all the steps in the FAQ and look ath the letsencrypt.log file and use ispconfig debug mode. Most likely the server hostname does not point to the server Ip and therefore a lets encrypt ssl cert can not be issued.
     
  8. Alex Tovey

    Alex Tovey New Member

    im getting this on the steps.
    [email protected]:/usr/local/ispconfig/interface/ssl# mv ispserver.pem ispserver.pem-$(date +"%y%m%d%H%M%S").bak
    mv: cannot stat 'ispserver.pem': No such file or directory
    [email protected]:/usr/local/ispconfig/interface/ssl# ln -s /etc/letsencrypt/live/$(hostname -f)/fullchain.pem ispserver.crt
    [email protected]:/usr/local/ispconfig/interface/ssl# ln -s /etc/letsencrypt/live/$(hostname -f)/privkey.pem ispserver.key
    [email protected]:/usr/local/ispconfig/interface/ssl# cat ispserver.{key,crt} > ispserver.pem
    cat: ispserver.key: No such file or directory
    cat: ispserver.crt: No such file or directory
    [email protected]:/usr/local/ispconfig/interface/ssl#
     
  9. till

    till Super Moderator Staff Member ISPConfig Developer

    This means that you don't have got a LE ssl cert, see my post above and the FAQ for possible reasons and how to find out why LE was unable to issue you a cert.
     
  10. Alex Tovey

    Alex Tovey New Member

    all i get in the log is this.
    2019-02-26 03:00:17,716:DEBUG:certbot.main:certbot version: 0.23.0
    2019-02-26 03:00:17,722:DEBUG:certbot.main:Arguments: ['-n', '--post-hook', "echo '1' > /usr/local/ispconfig/server/le.restart"]
    2019-02-26 03:00:17,723:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
    2019-02-26 03:00:17,740:DEBUG:certbot.log:Root logging level set at 20
    2019-02-26 03:00:17,741:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
    2019-02-26 03:00:17,782:DEBUG:certbot.renewal:no renewal failures
    2019-02-26 03:43:13,421:DEBUG:certbot.main:certbot version: 0.23.0
    2019-02-26 03:43:13,426:DEBUG:certbot.main:Arguments: ['-q']
    2019-02-26 03:43:13,427:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
    2019-02-26 03:43:13,444:DEBUG:certbot.log:Root logging level set at 30
    2019-02-26 03:43:13,447:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
    2019-02-26 03:43:13,449:DEBUG:certbot.renewal:no renewal failures
    2019-02-26 20:30:20,948:DEBUG:certbot.main:certbot version: 0.23.0
    2019-02-26 20:30:20,954:DEBUG:certbot.main:Arguments: ['-q']
    2019-02-26 20:30:20,955:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
    2019-02-26 20:30:20,974:DEBUG:certbot.log:Root logging level set at 30
    2019-02-26 20:30:20,975:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
    2019-02-26 20:30:20,978:DEBUG:certbot.renewal:no renewal failures
    2019-02-27 03:00:17,688:DEBUG:certbot.main:certbot version: 0.23.0
    2019-02-27 03:00:17,694:DEBUG:certbot.main:Arguments: ['-n', '--post-hook', "echo '1' > /usr/local/ispconfig/server/le.restart"]
    2019-02-27 03:00:17,695:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
    2019-02-27 03:00:17,714:DEBUG:certbot.log:Root logging level set at 20
    2019-02-27 03:00:17,715:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
    2019-02-27 03:00:17,719:DEBUG:certbot.renewal:no renewal failures
    2019-02-27 08:52:18,436:DEBUG:certbot.main:certbot version: 0.23.0
    2019-02-27 08:52:18,441:DEBUG:certbot.main:Arguments: ['-q']
    2019-02-27 08:52:18,442:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
    2019-02-27 08:52:18,459:DEBUG:certbot.log:Root logging level set at 30
    2019-02-27 08:52:18,460:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
    2019-02-27 08:52:18,462:DEBUG:certbot.renewal:no renewal failures
     
  11. Alex Tovey

    Alex Tovey New Member

    Bit of an odd one now i get this:

    Feb 27 11:07: servername.web.com sshd[8416]: Received disconnect from 115.159.216.187 port 38930:11: Bye Bye [preauth]
    Feb 27 11:07:13 servername.web.com sshd[8416]: Disconnected from invalid user zu 115.159.216.187 port 38930 [preauth]
    Feb 27 11:07:15 servername.web.com postfix/smtpd[8418]: warning: cannot get RSA private key from file "/etc/postfix/smtpd.key": disabling TLS support
    Feb 27 11:07:15 servername.web.com postfix/smtpd[8418]: warning: TLS library problem: error:2807106B:UI routines:UI_process:processing error:../crypto/ui/ui_lib.c:493:while reading strings:
    Feb 27 11:07:15 servername.web.com postfix/smtpd[8418]: warning: TLS library problem: error:0906406D:pEM routines:pEM_def_callback:problems getting password:../crypto/pem/pem_lib.c:64:
    Feb 27 11:07:15 servername.web.com postfix/smtpd[8418]: warning: TLS library problem: error:0906A068:pEM routines:pEM_do_header:bad password read:../crypto/pem/pem_lib.c:418:
    Feb 27 11:07:15 servername.web.com postfix/smtpd[8418]: warning: TLS library problem: error:140B0009:SSL routines:SSL_CTX_use_PrivateKey_file:pEM lib:../ssl/ssl_rsa.c:550:
    Feb 27 11:07:15 servername.web.com postfix/smtpd[8418]: connect from unknown[209.14.0.42]
    ~
    But i never set a key for this cert :(
     
  12. till

    till Super Moderator Staff Member ISPConfig Developer

    You get these error messages because there was no let's encrypt ssl cert issued. when you login to ispconfig, is the let's encrypt checkbox for the website of the server hostname still enabled? If no, then the server hostname probably does not has a correct dns setup which means that LE can not verify it and issue a cert.
     
  13. Alex Tovey

    Alex Tovey New Member

    We are using an external nameservers should i input dns settings in this one too?
     
  14. till

    till Super Moderator Staff Member ISPConfig Developer

    You have to put it only on the external dns server if that's the one which is authoritative for the zone.
     
  15. Alex Tovey

    Alex Tovey New Member

    I have yes, but still nothing
     

Share This Page