Let's encrypt certificates not auto-renewed (symlink archive vs live)

Discussion in 'ISPConfig 3 Priority Support' started by KoS, Jan 23, 2017.

  1. KoS

    KoS Member HowtoForge Supporter

    The first Let's encrypt certificates are expiring and not being replaced by the latest ones. When I check the configuration I see that the cert & key files from the /ssl subdir are being used and that there are symlinks to the /etc/letsencrypt/archive files. Going further I saw that indeed certbot had renewed the certificates, so there is cert2.pem instead of cert1.pem in the archive, but ISPconfig hasn't replaced it's symlinks.
    What could be the issue? Why isn't ISPconfig using the /live dir instead of the /archive?
    I suppose ISPconfig is triggering the certbot renew command, right?

    I am using ISPconfig 3.1.1 and coudln't find the changelog/diff to 3.1.1p1 to check if that would resolve the issue.
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    The live dir is used for the symlink in 3.1.1 and 3.1.1p1. Most likely the LE cert was created in 3.1.0 which has a bug in the symlinks.
     
  3. KoS

    KoS Member HowtoForge Supporter

    thanks for your reply.
    don't know with which version the LE was enabled on this site. I am running right now a re-sync of the websites, it takes quite a while with allt he restarting of apache. I suppose this will fix the symlink? Or do I need to manually fix it?
    What was changed from 3.1.1 to 3.1.1p1 so that i know if i need to upgrade?
     
  4. KoS

    KoS Member HowtoForge Supporter

    Unfortunately the re-sync doesn't seem to fix the symlinks.
     
  5. till

    till Super Moderator Staff Member ISPConfig Developer

    A typo in the nginx vhost file.
     
  6. KoS

    KoS Member HowtoForge Supporter

    @till How can I fix my invalid/old symbolic links? When are they being recreated?
     
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    There is currently no way to let ispconfig do it as ispconfig will not set new symlinks if there is already a symlink in place. I'm currently working on a change in the code to recreate the symlinks when you disable / enable LE in a site. I'll push it to git stable-3.1 branch later today.
     
  8. KoS

    KoS Member HowtoForge Supporter

    thanks! will check the repo later to see how i'll update it then.
     
  9. KoS

    KoS Member HowtoForge Supporter

    I used some "find" magic (and bash) to fix all the paths on my system. For reference if anybody else runs into that issue, as I didn't want to go site by site and disable & enable LE manually.
    Code:
    find /var/www/clients -maxdepth 4 -type l -ilname "*/etc/letsencrypt/archive/*"  -exec bash -c '\
       old_link_target=$(readlink "$0"); \
       new_link_target=${old_link_target//archive/live}; \
       new2_link_target=${new_link_target//[0-9]*.pem/.pem}; \
       echo "change to $new2_link_target"; \
       ln -snf $new2_link_target $0' {} \;
    
     
    Last edited: Jan 25, 2017
    chico11mbit and till like this.

Share This Page