Mixing LetsEncrypt SSL Certificates

Discussion in 'Server Operation' started by kameleon1er, Nov 30, 2020.

  1. kameleon1er

    kameleon1er Member

    Hello everyone
    I have a very small problem with Letsencrypt and 2 domain aliases "sandybeearts.com" and "ianpatrickimages.com" related to my main domain; democrasite.com.

    Method: I added in ispconfig the first domain alias > "sandybeearts.com" with the add certificate box unchecked.
    Then I went back to Website > democrasite.com > SSL > create a LetsEncrypt certificate = OK

    But for the second alias "ianpatrickimages.com" it doesn't want to work and when I go to its page "unprotected website" and if I click on "certificate information" in the browser, it doesn't show me the information of my main domain "democrasite.com" but the information of the first domain alias "sandybeearts.com".
  2. nhybgtvfr

    nhybgtvfr Well-Known Member HowtoForge Supporter

    can you post a screenshot of this certificate information.
  3. kameleon1er

    kameleon1er Member

    hi @nhybgtvfrActive, thanks for your help
    MainDomain : democrasite.com

    First DomainAlias : sandybeearts.com
    Second Domainalias : ianpatrickimages.com
    Thanks for your help.
    Last edited: Nov 30, 2020
  4. Taleman

    Taleman Well-Known Member HowtoForge Supporter

    The certificate has only domain sandybeerts.com.
    ISPConfig includes subdomains and aliasdomains to LE certificate, so something is wrong here if you indeed created the three domains and certificates as you described. But democrasite.com does not have a certificate at all, which sounds fishy. Verify democrasite.com really has LE ticked on.
    Last edited: Dec 1, 2020
  5. nhybgtvfr

    nhybgtvfr Well-Known Member HowtoForge Supporter

    are you creating these as normal domain aliases, or as vhost domain aliases?
    it's just that if democrasite.com doesn't have a letsencrypt certificate, then it shouldn't be creating one for the standard domain aliases either, and if democrasite.com does have one, then that domain will be listed as the subject and the aliases would be listed as 'subject alternate names', not as the subject.
    vhost domain aliases will have their own certificate, separate from the main domain vhost. which looks to be the case with sandybeearts.com.
    and i'm not sure how you're getting any certificate for ianpatrickimages.com, the only possible way i can see, is if it doesn't have any certificate at all, but https is enabled and sandybeearts.com is the only vhost, or the first vhost alphabetically, which does have a certificate.
  6. kameleon1er

    kameleon1er Member

    Hi Telman, thank you. I just restarted the certificate generation for democrasite.com, I put the screenshot and it seems that it now relies on ianpatrickimages.com as a referrer.
    It's a bit confusing for the steps to follow in ispconfig.
    If I understood correctly what to do (I read in a post on the forum)

    • 1 - create the main domain (democrasite.com) > then create a certificate (public / private key) for the main domain.

    • 2 - go to "website" > create a domain alias for website > add new domain alias > create > don't check "don't add LetsEncrypt certificate". Let the process be done.

    • 3 - go back to "Site / Website" > select the main domain > uncheck the SSL box (it automatically deselects LetsEncrypt at the same time...) > Save.

    • 4 - click again on the main domain > select the LetsEncrypt SSL box (this automatically deselects the SSL box above > Save.

    Either I make a mistake somewhere, or there is a bug, democrasite.com always has as comon name SSL ianpatrickimages.com oO !

    democrasite_cert.png ianpatrickimages_chrome_cert.png

    and when I go back to Ssite > democrasite.com > SSL > SSL Key field ; SSL Request field ; SSL Certificate are empty.
    I check too certs with : https://decoder.link/

    Thanks :)
  7. nhybgtvfr

    nhybgtvfr Well-Known Member HowtoForge Supporter

    not quite.

    do step 1.
    do step 2.
    repeat step 2 until all additional domain aliases have been added.
  8. nhybgtvfr

    nhybgtvfr Well-Known Member HowtoForge Supporter

    for a letsencrypt certificate these will always be empty, they are only used when manually adding a paid for certificate.

Share This Page