Request Lets Encrypt module broken

letsencrypt
v7
(Lovemussell) #1

NethServer Version: 7.4.1708 (Final)
Module: Server Certificte > Request new lets encrypt cert

Im having an issue requesting lets encrypt certs through the webUI. The logs show it is using a mistyped email domain. I am not sure how to fix this, changing the email field on the request page isn’t fixing it. I’ve tried to signal-event nethserver-letsencrypt-update, signal-event system-init and running through the first time setup config first.

It has the incorrect spelling cached on the lets encrypt request page whenever I go to request another. I’ve tried requesting it via cerbot through cli and it appears to work, but doesn’t display them on the Server Certificate module.

[root@ns ~]# cat /var/log/letsencrypt/letsencrypt.log

{
  "type": "urn:acme:error:invalidEmail",
  "detail": "Error creating new registration :: DNS problem: NXDOMAIN looking up MX for nethworksandchill.com",
  "status": 400
}
2018-01-02 23:11:46,200:DEBUG:acme.client:Storing nonce: fbc9CfOFEPOKkjpxut2f1yLg9UmU3kV1U5SHnOCs0QM
2018-01-02 23:11:46,200:DEBUG:certbot.main:The ACME server believes randy@nethworksandchill.com is an invalid email address. Please ensure it is a valid email and attempt registration again.
(Lovemussell) #2

to be clear, when I request a cert I am trying to use @networksandchill.com domain, not @nethworksandchill.com. It’s not letting me correct this from the webUI.

hopefully this makes sense:

8DUOmUI.png1245x649 134 KB

(Markus Neuberger) #3

Could it be that the commas in “Domains” are wrong? I don’t have them, when I try to request a cert on my servers.

Found two threads, where just trying again a few times helped:

(Stéphane de Labrusse) #4

Yep it works without commas on my server

(Lovemussell) #5

Well is not the commas. It should accept them anyway as certbot through cli says you can spaces and or commas for separating sub domains. Regardless, I get the same error when using a single domain without spaces and commas. The module is trying to use a misspelled domain Wich doesn’t have a MX record behind it. Please see the error more closely, im not able to correct the notification email error using the server certificate module.

(Dan) #6

Can you try it without entering an email address at all, or does the Neth panel make the email address mandatory? Let’s Encrypt will happily issue without an email address.

(Lovemussell) #7

I will try that out. I’m pretty sure that the method nethserver is using to handle the let’s encrypt auth/domain verification requires it, but I may be wrong.

(Dan) #8

No, no flavor of validation through Let’s Encrypt requires an email address. They’ll take one, but it’s purely optional. The Neth panel might make it mandatory, but if so, that’s entirely on the Neth side.

(Filippo Carletti) #9

It’s optional.

(Lovemussell) #10

The panel still returns an error that the acme server could not create an account when I exclude the email. I’m on mobile at the moment but I’ll see what the logs say now when I get to a computer. Thanks for the help so far everyone

(Giacomo Sanchietti) #12

The error is quite clear:

Remove the mail from the web interface or use a valid one :slight_smile:

(Marc) #13

This might give us some clues:

config getprop pki LetsEncryptMail
grep -r 'randy@nethworksandchill.com' /etc/letsencrypt/accounts/