ISPConfig + letsencrypt update

Discussion in 'General' started by toffie, Jun 22, 2020.

  1. toffie

    toffie New Member

    Hey all,

    I'm in a bit of panic state.. I've forgot all about the letsencrypt update and its just a few days left.

    The server is running Debian Jessie, with Apache, in live mode - so I can't just take it down, install a new OS version and so on..
    I'm running ISPConfig version 3.1.11 - I know, there are newer versions, but the risk of crash due to possible bugs in ISPConfig makes me not wanna try, if possible. Again - Live system.

    My head is just spinning around and I really don't know what to do and I've missed a couple hundred things that you guys want to know to be able to help me. Just throw it at me and I'll reply as soon as possible.

    I really hope you can help me without taking down the server.

    Big Thanks in advance!!

    // Chris


    ---


    I've found the following things, but it didn't work;
    Code:
    apt update
    apt install software-properties-common
    add-apt-repository ppa:certbot/certbot
    apt update
    apt upgrade -y
    apt remove letsencrypt -y
    apt install python-certbot-apache -y
    from the thread; https://www.howtoforge.com/communit...ing-since-updating-to-ispconfig-3-1-13.79882/
    But that is Ubuntu and doesn't work on this specific server I'm using.

    Trying to uninstall "letsencrypt" like above says that it is not available. add-apt-repository - sure, but there are none available for Debian, only Ubuntu.

    ---
    I also followed step 1-3 on this site; https://certbot.eff.org/lets-encrypt/debianjessie-apache
    But then what.. Step 4? What should I pick - if this is even the right way to go? I really don't know as ISPConfig is supposed to handle the certbot communication for adding and renewing certs..




    Code:
    2020-06-22 12:36:03,820:DEBUG:certbot.main:certbot version: 0.24.0
    2020-06-22 12:36:03,822:DEBUG:certbot.main:Arguments: ['-n', '--text', '--agree-tos', '--expand', '--authenticator', 'webroot', '--server', 'https://acme-v01.api.letsencrypt.org/directory', '--rsa-key-size', '4096', '--email', '[email protected]', '--domains', 'domainredacted', '--webroot-path', '/usr/local/ispconfig/interface/acme']
    2020-06-22 12:36:03,822:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#apache,PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
    2020-06-22 12:36:03,850:WARNING:certbot.cli:You are running with an old copy of letsencrypt-auto that does not receive updates, and is less reliable than more recent versions. We recommend upgrading to the latest certbot-auto script, or using native OS packages.
    2020-06-22 12:36:03,851:DEBUG:certbot.cli:Deprecation warning circumstances: /opt/eff.org/certbot/venv/bin/certbot / {'LANG': 'sv_SE.UTF-8', 'SHELL': '/bin/sh', 'SHLVL': '3', 'PWD': '/usr/local/ispconfig/server', 'LOGNAME': 'root', 'HOME': '/root', 'PATH': '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin', '_': '/opt/eff.org/certbot/venv/bin/certbot'}
    2020-06-22 12:36:03,877:DEBUG:certbot.log:Root logging level set at 20
    2020-06-22 12:36:03,879:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
    2020-06-22 12:36:03,881:DEBUG:certbot.plugins.selection:Requested authenticator webroot and installer None
    2020-06-22 12:36:03,893:DEBUG:certbot.plugins.selection:Single candidate plugin: * webroot
    Description: Place files in webroot directory
    Interfaces: IAuthenticator, IPlugin
    Entry point: webroot = certbot.plugins.webroot:Authenticator
    Initialized: <certbot.plugins.webroot.Authenticator object at 0x7f7d99d59810>
    Prep: True
    2020-06-22 12:36:03,895:DEBUG:certbot.plugins.selection:Selected authenticator <certbot.plugins.webroot.Authenticator object at 0x7f7d99d59810> and installer None
    2020-06-22 12:36:03,895:INFO:certbot.plugins.selection:Plugins selected: Authenticator webroot, Installer None
    2020-06-22 12:36:03,907:DEBUG:certbot.main:Picked account: <Account(RegistrationResource(body=Registration(status=u'valid', terms_of_service_agreed=None, contact=(u'mailto:[email protected]',), agreement=u'https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf', key=JWKRSA(key=<ComparableRSAKey(<cryptography.hazmat.backends.openssl.rsa._RSAPublicKey object at 0x7f7d9919a490>)>)), uri=u'https://acme-v01.api.letsencrypt.org/acme/reg/35045007', new_authzr_uri=u'https://acme-v01.api.letsencrypt.org/acme/new-authz', terms_of_service=u'https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf'), cc3fb0fb23ab9baee09c08ea2fc2c773, Meta(creation_host=u'domainredacted', creation_dt=datetime.datetime(2018, 5, 16, 10, 58, 9, tzinfo=<UTC>)))>
    2020-06-22 12:36:03,910:DEBUG:acme.client:Sending GET request to https://acme-v01.api.letsencrypt.org/directory.
    2020-06-22 12:36:03,921:DEBUG:requests.packages.urllib3.connectionpool:Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
    2020-06-22 12:36:04,565:DEBUG:requests.packages.urllib3.connectionpool:https://acme-v01.api.letsencrypt.org:443 "GET /directory HTTP/1.1" 200 658
    2020-06-22 12:36:04,566:DEBUG:acme.client:Received response:
    HTTP 200
    Server: nginx
    Date: Mon, 22 Jun 2020 10:36:04 GMT
    Content-Type: application/json
    Content-Length: 658
    Connection: keep-alive
    Cache-Control: public, max-age=0, no-cache
    Replay-Nonce: 0001wmke8y-Ls0baOdSF9kEV7XWhOvulLoz3eaDc143WPhA
    X-Frame-Options: DENY
    Strict-Transport-Security: max-age=604800
    
    {
      "F8phwSnWdMM": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417",
      "key-change": "https://acme-v01.api.letsencrypt.org/acme/key-change",
      "meta": {
        "caaIdentities": [
          "letsencrypt.org"
        ],
        "terms-of-service": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf",
        "website": "https://letsencrypt.org"
      },
      "new-authz": "https://acme-v01.api.letsencrypt.org/acme/new-authz",
      "new-cert": "https://acme-v01.api.letsencrypt.org/acme/new-cert",
      "new-reg": "https://acme-v01.api.letsencrypt.org/acme/new-reg",
      "revoke-cert": "https://acme-v01.api.letsencrypt.org/acme/revoke-cert"
    }
    2020-06-22 12:36:04,585:INFO:certbot.renewal:Cert not yet due for renewal
    2020-06-22 12:36:04,586:INFO:certbot.main:Keeping the existing certificate
     
  2. ahrasis

    ahrasis Well-Known Member

    In my view simply remove letsencrypt and certbot and then install certbot-auto would be the best option, instead of adding certbot repo and install certbot.

    Certbot-auto will auto update by checking update first when its command is being called and since you were using letsencrypt / certbot, IMHO your system should run fine with it.

    Or if you wish to use acme.sh, simply remove certbot and let ISPConfig install it for you.

    This acme.sh script will also auto update itself, but in using it, you'll find that its directory structures are different if compared to certbot; thuswise IMHO this should not be tried in production server like yours.
     
  3. nhybgtvfr

    nhybgtvfr Active Member

    the first step is to calm down and stop panicking. you're much more likely to make a mistake and break things if you're panicking.

    secondly, and this is much quicker/easier if you don't have a lot of domains with certificates.
    if, and ONLY if your certificates are still able to renew ok, in ispconfig, deselect letsencrypt on those websites. then delete the conf files for them in /etc/letsencrypt/renewal and the domain's folders in /etc/letsencrypt/archive and /etc/letsencrypt/live.
    re-enable the letsencrypt certs on those websites.
    you now have completely new letsencrypt certificates on all those sites. since they're should only auto-renew when they're within 30 days of expiry, you now have 60 days in which to update your letscencrypt/certbot software before you run into any problems.
    that should help you calm down a bit...
    hopefully you won't have anyone wanting new letsencrypt certs until you've got a solution in place.

    i'd now suggest you spend the 60 day window you've given yourself getting a new server instance with debian buster installed and working with the latest ispconfig as per the perfect server tutorial, and migrate your existing system to the new one. especially since jessie goes end-of-life in 8 days time. even if you do this just on a temporary vps so you can keep everything live and active whilst you re-install/upgrade the old server without having to worry about downtime and then migrate everything back to the old server.
    as an added bonus to this getting you onto the latest debian and ispconfig releases, it also resolves your outdated letsencrypt/certbot software issue.
     
    30uke and Th0m like this.
  4. toffie

    toffie New Member

    Thanks ahrasis!
    I believe I have "installed" certbot-auto when following this link, as it says certbot-auto in step 3
    https://certbot.eff.org/lets-encrypt/debianjessie-apache

    However, there are more steps to the guide and I do not know if ISPConfig wants me to do
    Code:
    /usr/local/bin/certbot-auto --apache
    as it says in the guide.

    Also, I have no idea on how to use acme.sh and I don't know how to remove certbot/lets encrypt from the system.

    UPDATE
    Anyhow..
    With my panicking.. :) I went full on.. I said screw it and started updating screws, bolts, software, patch cables.. well.. ok.. not really :)

    But I looked back at the howtoforge guide I used for the installation
    https://www.howtoforge.com/tutorial...ovecot-ispconfig-3-1/2/#-install-lets-encrypt

    and I saw.. hey.. I should have downloaded certbot into the /opt/certbot folder.. so I checked.. and sure enough.. there it was! I ran the script ./certbot-auto and it started updating to v2 and it all went on extremely smoothly. It also asked which domain I wanted to renew and I did that - worked perfectly.

    But just to F things up, I went into ISPConfig and disabled SSL + Let's Encrypt and then reenable it, just to see that it works from ISPConfig.. and no.. it didn't..

    Checked the logfiles and ISPConfig got a complaint that Let's Encrypt is still running v1.

    Removed all account files and settings for Let's Encrypt.. did a new ./certbot-auto and it tries to enable the SSL but.. it can, but not completely.. ok..

    so I thought.. hmm, I'll do an ISPConfig update - which is very smooth (I know this from before) - and hope for no bugs. and sure enough.. now it works..

    ISPConfig 3.1.15p3 is now up and running.. and uses v2 of Certbot Let's Encrypt..

    so now it can renew the certificates without problems..


    However.. the system went down.. so might have to do a field trip to reset shits.. fun stuff!! ;)

    EDIT
    No, it seems that everything went up as it should. So all in all, panic.. panic.. now relax :) Thanks for your help guys!

    ahrasis - you got me thinking a little more, that's why I went for the howtoguide I used and eventually found the certbot-auto in the /opt/ folder :)
     
    Last edited: Jun 22, 2020
    Richard Foley, ahrasis and Th0m like this.

Share This Page