Re: [webmin-l] Certificate Problem

Hi

LetsEncrypt actually connects to http not https to request a file
(temporary validation cooke sorts of) for issuing cefrt for the first time
if im not mistaken renevals are validated same way.

it's usually located (the dir is created when you try to get the cert or
at least it should be) in a directory that is located in a directory
starting with . its actually a text file within: 
public_html/.well-known/acme-challenge which is deleted right after the
attempt to get certificate is made

where the public_html is your website root
If you hace any .htaccess file that prevents remote server to get the file
entire process fails.
The name of the file inside acme-challenge is random and changes every
time

Regards

On Mon, 27 Feb 2017 09:37:20 -0500, Kris Deugau <[email protected]> wrote:
> Kimberly wrote:
>> I am a little bit confused on this.  I thought let's encrypt tries to
>> connect to the website on port 443 to test if there is an actual
website
>> there before it will issue the certificate.
> 
> I don't know what internal checks are done, so I may be misreading Let's

> Encrypt's internal behaviour.  It can't expect to always have the HTTPS 
> site available, otherwise you'd never be able to get started.
> 
> Your situation seems to be along the lines of:
> 
> - Existing site at http://www.example.com, previously had a cert issued,

> and redirect configured so that anyone visiting the site on port 80 
> (HTTP) got redirected to port 443 (HTTPS).
> 
> - Certficate expired for some reason
> 
> - Domain got changed
> 
> (Those last two steps may have been in the opposite order, or may be 
> related.)
> 
> So now you have a site operating at http://www.example.net, with 
> redirect to https://www.example.net, but still using the (expired) cert 
> for www.example.com.
> 
> My guess is that when the LE back end tries to validate the site by 
> requesting eg http://www.example.net/validationblob, and gets redirected

> to https://www.example.com/validationblob, it sees the expired cert for 
> www.example.com, and errors out.
> 
> If you drop the HTTP->HTTPS redirect, LE may be able to retrieve the 
> validation blob from the unencrypted access, and issue a valid cert for 
> www.example.net.
> 
> You may need to read up on exactly what the "Domain has no website" 
> error is really complaining about, or switch to a different validation 
> method.
> 
> -kgd
> 
> 
>>
>> On 2/24/2017 4:01 PM, Kris Deugau wrote:
>>> Kimberly wrote:
>>>> I ran all the Virtualmin package upgrades and it still reports 5.06
and
>>>> it still reports domain has no website when trying to request a
>>>> certificate.
>>>> Is there another way to upgrade Virtualmin other than package
updates?
>>>> Is this done from the command line.  Any help is appreciated.
>>> I haven't looked into LE yet, but I'm wondering if there's an issue
due
>>> to the HTTP->HTTPS redirect:
>>>
>>>>>>>> virtual server.  After changing the domain name the site will
>>>>>>>> load; the
>>>>>>>> site is redirected to the https and loads but with a warning
about
>>>>>>>> the
>>>>>>>> certificate.
>>> The LetsEncrypt back end may be expecting either plain HTTP, or HTTPS
>>> with a valid cert (right domain, not expired, etc).  wget, for
instance,
>>> is very picky about having a completely valid cert or it won't
retrieve
>>> whatever you've requested.
>>>
>>> I'd try disabling the HTTP->HTTPS redirect, so whatever validation
blob
>>> is needed can be retrieved from the HTTP site.
>>>
>>> -kgd
>>>
>>>
------------------------------------------------------------------------------
>>> Check out the vibrant tech community on one of the world's most
>>> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>>> -
>>> Forwarded by the Webmin mailing list at
>>> [email protected]
>>> To remove yourself from this list, go to
>>> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>>>
>>
>>
>>
------------------------------------------------------------------------------
>> Check out the vibrant tech community on one of the world's most
>> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
>> -
>> Forwarded by the Webmin mailing list at
>> [email protected]
>> To remove yourself from this list, go to
>> http://lists.sourceforge.net/lists/listinfo/webadmin-list
>>
> 
> 
>
------------------------------------------------------------------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, SlashDot.org! http://sdm.link/slashdot
> -
> Forwarded by the Webmin mailing list at
[email protected]
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, SlashDot.org! http://sdm.link/slashdot
-
Forwarded by the Webmin mailing list at [email protected]
To remove yourself from this list, go to
http://lists.sourceforge.net/lists/listinfo/webadmin-list