Lets Encrypt validation failed for these domain(s)

[Shadowfire (Jeff Davis)]

NethServer Version: NethServer release 7.9.2009 (final)
Module: Certificates

Trying to renew my Lets Encrypt cert.

Here is what I get -

or this

I know I have things in /var/log/letsencrypt/letsencrypt.log, But I am unsure of what would be helpful to show in it.

Thanks,
-SF-

[michelandre (Michel-André)]

Hi @Shadowfire

What about DNS records from your registrer ?

Michel-André

[Shadowfire (Jeff Davis)]

For my first registrer -

For second registrer -

[dnutan (Marc)]

Give it a go:
https://letsdebug.net

[Shadowfire (Jeff Davis)]

I will take a look in to letsdebug.net.

Thanks!

[michelandre (Michel-André)]

Hi @Shadowfire

Correct me if I am wrong but www.signetring.live is defined. I do not see signetring.live as A or CNAME but the link display a page…

Also: mycomputervisions.com ? but the link display a page…

Michel-André

[Shadowfire (Jeff Davis)]

So I looked back at my registrer setup for singnetring.live…

I was using MXToolBox and getting everything on signetring.live ok. Except for the following…

So then I decided to change to the following …

Now I am seeing the following -

as well as the following -

I am unsure if it just needs to replicate and that will work itself out, or I need to fix DKIM - I copied and pasted what it told me. So it should be correct. Time will tell.

Now I have to go back to my mycomputervisions.com side and review my registrer dns for it and see if I need to clean something up on it’s side.

If any one has any suggestions I welcome them. Thanks for everyones feedback and help.

-SF-

[Shadowfire (Jeff Davis)]

First off, I have decided only to worry about mycomputervisions.com, cvserver.mycomputervisions.com, and mesh.mycomputervisions.com

So when I use Let’s Debug. On mycomputervisions.com the only one working was dns-01. Now dns-01, http-01, and tls-alpn-01 are all working.

but I am unable to get LetsEncrypt to renew the cert as seen below.

[michelandre (Michel-André)]

Hi @Shadowfire

Is the machine on the LOCAL LAN ?

Michel-André

[Shadowfire (Jeff Davis)]

@Shadowfire

cvserver.mycomputervisions.com

Yes. It is.

[michelandre (Michel-André)]

Then you nedd to use acme.sh to get the Let’s Encrypt certificate.

Michel-André

[Shadowfire (Jeff Davis)]

Oh, I saw something about acme.sh, but didn’t realize I would need it for this. I take it there is no way to do acme.sh in GUI?

[Shadowfire (Jeff Davis)]

Is this what I need to follow to get results I am looking for? or something else?

Acme.sh EOL and Let's Encrypt

Hi all, As you all know, June 2021 will be EOL for acme.sh version-1. Now, I install socat and I use the latest acme.sh version (2.8.9). Installation command: As specified by: https://wiki.nethserver.org/doku.php?id=userguide:let_s_encrypt_for_internal_servers. I use: curl https://get.acme.sh | sh From: https://github.com/acmesh-official/acme.sh/wiki/How-to-install curl https://get.acme.sh | sh -s email=my@example.com But it should be OK as I use Cloudflare.com as my dns server and I sp…

and I am looking at this too…

Acme.sh, Let's Encrypt, and ZeroSSL.com

Isn’t NethServer using certbot by default? Maybe acme.sh comes from a custom install or alternative LetsEncrypt certificate management method described in our wiki. Identifying the source might help in discerning if a note is convenient and where to place it.

and of course this…

https://wiki.nethserver.org/doku.php?id=userguide:let_s_encrypt_for_internal_servers

[dnutan (Marc)]

Is your web-server an internal server (maybe it is behind an nginx reverse proxy)?

Some options:

@giacomo

I’ve been working a little bit on adding the dns challenge instead of the http one.

Pros:

• you can request a certificate from a machine without a valid DNS and without a public accessible HTTP port (very usefull for development scenarios!)
• you can request a wildcard certificate

Cons:

• your DNS provider must be supported by certbot (CloudFlare and DigitalOcean are supported and have a free plan)
• your DNS NS records must point to the DNS provider

https://docs.nethserver.org/projects/nethserver-devel/en/latest/certificate_management.html#dns-challenge

or one of these guides depending on DNS provider:

https://wiki.nethserver.org/doku.php?id=userguide:let_s_encrypt_for_internal_servers
https://wiki.nethserver.org/doku.php?id=userguide:let_s_encrypt_acme-dns

[Shadowfire (Jeff Davis)]

Thanks for the reply above. I got challenged with a number of issue that had to be taken care of. I am just getting a chance to get back here and look what you are sharing. I will take a look at all that you have listed and linked above.

Thanks again
-=SF=-

[Shadowfire (Jeff Davis)]

I wanted to come back to this post and make sure I let others know what I did that finalized a fix for me under this issue. I had a number of items come up in my day to day work. It so happened that the LetsEncrypt Cert lapse. I tried again a this point to certify the mycomputervisions.com, cvserver.mycomputervisions, mesh.mycomputervisions.com, mail.mycomputervisions.com … and left out signetring.live. (I decided to run LetsEncrypt on the signetring.live server.)

The LetsEncrypt for mycomputervisions.com still failed.

Then I decided to take out mail.mycomputervisions.com.

So without mail.computervisions.com and signetring.live it finally allowed the LetsEncrypt Cet to complete validation and so now mycomputervisions.com and subs are validated and have a ssl cert.

Hope this in someway helps someone else.