Re: [webmin-l] Certificate Problem

Kimberly wrote:
> I am a little bit confused on this.  I thought let's encrypt tries to
> connect to the website on port 443 to test if there is an actual website
> there before it will issue the certificate.

I don't know what internal checks are done, so I may be misreading Let's 
Encrypt's internal behaviour.  It can't expect to always have the HTTPS 
site available, otherwise you'd never be able to get started.

Your situation seems to be along the lines of:

- Existing site at http://www.example.com, previously had a cert issued, 
and redirect configured so that anyone visiting the site on port 80 
(HTTP) got redirected to port 443 (HTTPS).

- Certficate expired for some reason

- Domain got changed

(Those last two steps may have been in the opposite order, or may be 
related.)

So now you have a site operating at http://www.example.net, with 
redirect to https://www.example.net, but still using the (expired) cert 
for www.example.com.

My guess is that when the LE back end tries to validate the site by 
requesting eg http://www.example.net/validationblob, and gets redirected 
to https://www.example.com/validationblob, it sees the expired cert for 
www.example.com, and errors out.

If you drop the HTTP->HTTPS redirect, LE may be able to retrieve the 
validation blob from the unencrypted access, and issue a valid cert for 
www.example.net.

You may need to read up on exactly what the "Domain has no website" 
error is really complaining about, or switch to a different validation 
method.

-kgd


>
> On 2/24/2017 4:01 PM, Kris Deugau wrote:
>> Kimberly wrote:
>>> I ran all the Virtualmin package upgrades and it still reports 5.06 and
>>> it still reports domain has no website when trying to request a certificate.
>>> Is there another way to upgrade Virtualmin other than package updates?
>>> Is this done from the command line.  Any help is appreciated.
>> I haven't looked into LE yet, but I'm wondering if there's an issue due
>> to the HTTP->HTTPS redirect:
>>
>>>>>>> virtual server.  After changing the domain name the site will load; the
>>>>>>> site is redirected to the https and loads but with a warning about the
>>>>>>> certificate.
>> The LetsEncrypt back end may be expecting either plain HTTP, or HTTPS
>> with a valid cert (right domain, not expired, etc).  wget, for instance,
>> is very picky about having a completely valid cert or it won't retrieve
>> whatever you've requested.
>>
>> I'd try disabling the HTTP->HTTPS redirect, so whatever validation blob
>> is needed can be retrieved from the HTTP site.
>>
>> -kgd
>>
>> ------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>> -
>> Forwarded by the Webmin mailing list at [email protected]
>> To remove yourself from this list, go to
>> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>>
>
>
> ------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> -
> Forwarded by the Webmin mailing list at [email protected]
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>


------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
-
Forwarded by the Webmin mailing list at [email protected]
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list