Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ACME not issuing certificate

    Scheduled Pinned Locked Moved ACME
    23 Posts 8 Posters 2.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mcury Rebel Alliance @jimp
      last edited by

      Duckdns, using API key.
      22.01 on a SG-3100
      Acme: 0.7_3

      Empty:
      2d79200c-cead-42dc-b2b8-e2787024cae2-image.png

      Key only:
      d8d48274-36a3-40ec-90f0-3ac246a2cddf-image.png

      Log requested:
      [Mon Mar 7 12:38:31 -03 2022] readlink exists=0
      [Mon Mar 7 12:38:31 -03 2022] dirname exists=0
      [Mon Mar 7 12:38:31 -03 2022] Lets find script dir.
      [Mon Mar 7 12:38:31 -03 2022] SCRIPT='/usr/local/pkg/acme/acme.sh'
      [Mon Mar 7 12:38:31 -03 2022] _script='/usr/local/pkg/acme/acme.sh'
      [Mon Mar 7 12:38:31 -03 2022] _script_home='/usr/local/pkg/acme'
      [Mon Mar 7 12:38:31 -03 2022] Using config home:/tmp/acme/duckdns/
      [Mon Mar 7 12:38:31 -03 2022] ACCOUNT_CONF_PATH='/tmp/acme/duckdns/accountconf.conf'
      [Mon Mar 7 12:38:31 -03 2022] APP
      [Mon Mar 7 12:38:31 -03 2022] 3:LOG_FILE='/tmp/acme/duckdns/acme_createdomainkey.log'
      [Mon Mar 7 12:38:31 -03 2022] APP
      [Mon Mar 7 12:38:31 -03 2022] 4:LOG_LEVEL='3'
      [Mon Mar 7 12:38:31 -03 2022] LE_WORKING_DIR='/tmp/acme/duckdns/'
      [Mon Mar 7 12:38:31 -03 2022] Running cmd: createDomainKey
      [Mon Mar 7 12:38:31 -03 2022] Creating domain key
      [Mon Mar 7 12:38:31 -03 2022] Using config home:/tmp/acme/duckdns/
      [Mon Mar 7 12:38:31 -03 2022] ACCOUNT_CONF_PATH='/tmp/acme/duckdns/accountconf.conf'
      [Mon Mar 7 12:38:31 -03 2022] ACME_DIRECTORY='https://acme-v02.api.letsencrypt.org/directory'
      [Mon Mar 7 12:38:31 -03 2022] _ACME_SERVER_HOST='acme-v02.api.letsencrypt.org'
      [Mon Mar 7 12:38:31 -03 2022] _ACME_SERVER_PATH='directory'
      [Mon Mar 7 12:38:31 -03 2022] CA_CONF='/tmp/acme/duckdns//ca/acme-v02.api.letsencrypt.org/directory/ca.conf'
      [Mon Mar 7 12:38:31 -03 2022] DOMAIN_PATH='/tmp/acme/duckdns//mydomain.duckdns.org'
      [Mon Mar 7 12:38:31 -03 2022] _createkey for file:/tmp/acme/duckdns//mydomain.duckdns.org/mydomain.duckdns.org.key
      [Mon Mar 7 12:38:31 -03 2022] Use length 2048
      [Mon Mar 7 12:38:31 -03 2022] Using RSA: 2048
      [Mon Mar 7 12:38:34 -03 2022] APP
      [Mon Mar 7 12:38:34 -03 2022] 1:Le_Keylength='2048'
      [Mon Mar 7 12:38:34 -03 2022] The domain key is here: /tmp/acme/duckdns//mydomain.duckdns.org/mydomain.duckdns.org.key
      [Mon Mar 7 12:55:10 -03 2022] readlink exists=0
      [Mon Mar 7 12:55:10 -03 2022] dirname exists=0
      [Mon Mar 7 12:55:10 -03 2022] Lets find script dir.
      [Mon Mar 7 12:55:10 -03 2022] SCRIPT='/usr/local/pkg/acme/acme.sh'
      [Mon Mar 7 12:55:10 -03 2022] _script='/usr/local/pkg/acme/acme.sh'
      [Mon Mar 7 12:55:10 -03 2022] _script_home='/usr/local/pkg/acme'
      [Mon Mar 7 12:55:10 -03 2022] Using config home:/tmp/acme/duckdns/
      [Mon Mar 7 12:55:10 -03 2022] ACCOUNT_CONF_PATH='/tmp/acme/duckdns/accountconf.conf'
      [Mon Mar 7 12:55:10 -03 2022] APP
      [Mon Mar 7 12:55:10 -03 2022] 3:LOG_FILE='/tmp/acme/duckdns/acme_createdomainkey.log'
      [Mon Mar 7 12:55:10 -03 2022] APP
      [Mon Mar 7 12:55:10 -03 2022] 4:LOG_LEVEL='3'
      [Mon Mar 7 12:55:10 -03 2022] LE_WORKING_DIR='/tmp/acme/duckdns/'
      [Mon Mar 7 12:55:10 -03 2022] Running cmd: createDomainKey
      [Mon Mar 7 12:55:10 -03 2022] Creating domain key
      [Mon Mar 7 12:55:10 -03 2022] Using config home:/tmp/acme/duckdns/
      [Mon Mar 7 12:55:10 -03 2022] ACCOUNT_CONF_PATH='/tmp/acme/duckdns/accountconf.conf'
      [Mon Mar 7 12:55:10 -03 2022] ACME_DIRECTORY='https://acme-v02.api.letsencrypt.org/directory'
      [Mon Mar 7 12:55:10 -03 2022] _ACME_SERVER_HOST='acme-v02.api.letsencrypt.org'
      [Mon Mar 7 12:55:10 -03 2022] _ACME_SERVER_PATH='directory'
      [Mon Mar 7 12:55:10 -03 2022] CA_CONF='/tmp/acme/duckdns//ca/acme-v02.api.letsencrypt.org/directory/ca.conf'
      [Mon Mar 7 12:55:10 -03 2022] DOMAIN_PATH='/tmp/acme/duckdns//mydomain.duckdns.org'
      [Mon Mar 7 12:55:10 -03 2022] _createkey for file:/tmp/acme/duckdns//mydomain.duckdns.org/mydomain.duckdns.org.key
      [Mon Mar 7 12:55:10 -03 2022] Use length 2048
      [Mon Mar 7 12:55:10 -03 2022] Using RSA: 2048
      [Mon Mar 7 12:55:14 -03 2022] OK
      [Mon Mar 7 12:55:14 -03 2022] 1:Le_Keylength='2048'
      [Mon Mar 7 12:55:14 -03 2022] The domain key is here: /tmp/acme/duckdns//mydomain.duckdns.org/mydomain.duckdns.org.key

      dead on arrival, nowhere to be found.

      M 1 Reply Last reply Reply Quote 0
      • jimpJ
        jimp Rebel Alliance Developer Netgate
        last edited by

        I can reproduce it when making a completely new certificate with the nsupdate method. Renewing existing entries is OK.

        Doesn't seem to be related to wildcard entries as I tried one with and one without wildcard, both failed.

        https://redmine.pfsense.org/issues/12912

        I'll have a fix in shortly, in the meantime, edit the cert entry and check the debug option. That should allow it to work for now.

        Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

        Need help fast? Netgate Global Support!

        Do not Chat/PM for help!

        1 Reply Last reply Reply Quote 0
        • M
          mcury Rebel Alliance @mcury
          last edited by

          Thanks jimp

          To workaround this issue:

          I imported the CAs Acmecert: O=Let's Encrypt, CN=R3, C=US and Acmecert: O=Internet Security Research Group, CN=ISRG Root X1, C=US from a backup.

          Then, deleted the certificate (key_only), and imported the cert again, X.509 (PEM), including certificate data and private key data.

          The new certificate generated is working properly now.

          dead on arrival, nowhere to be found.

          1 Reply Last reply Reply Quote 0
          • D
            Donnyr
            last edited by

            I have the same as mcury - no certificate, private key only.
            I was on 0.7_1 and have now updated to 0.7_3 - same issue

            acme_createdomainkey.log
            [Mon Mar 7 18:39:19 EET 2022] readlink exists=0
            [Mon Mar 7 18:39:19 EET 2022] dirname exists=0
            [Mon Mar 7 18:39:19 EET 2022] Lets find script dir.
            [Mon Mar 7 18:39:19 EET 2022] SCRIPT='/usr/local/pkg/acme/acme.sh'
            [Mon Mar 7 18:39:19 EET 2022] _script='/usr/local/pkg/acme/acme.sh'
            [Mon Mar 7 18:39:19 EET 2022] _script_home='/usr/local/pkg/acme'
            [Mon Mar 7 18:39:19 EET 2022] Using config home:/tmp/acme/test2/
            [Mon Mar 7 18:39:19 EET 2022] ACCOUNT_CONF_PATH='/tmp/acme/test2/accountconf.conf'
            [Mon Mar 7 18:39:19 EET 2022] APP
            [Mon Mar 7 18:39:19 EET 2022] 3:LOG_FILE='/tmp/acme/test2/acme_createdomainkey.log'
            [Mon Mar 7 18:39:19 EET 2022] APP
            [Mon Mar 7 18:39:19 EET 2022] 4:LOG_LEVEL='3'
            [Mon Mar 7 18:39:19 EET 2022] LE_WORKING_DIR='/tmp/acme/test2/'
            [Mon Mar 7 18:39:19 EET 2022] Running cmd: createDomainKey
            [Mon Mar 7 18:39:19 EET 2022] Creating domain key
            [Mon Mar 7 18:39:19 EET 2022] Using config home:/tmp/acme/test2/
            [Mon Mar 7 18:39:19 EET 2022] ACCOUNT_CONF_PATH='/tmp/acme/test2/accountconf.conf'
            [Mon Mar 7 18:39:19 EET 2022] ACME_DIRECTORY='https://acme-staging-v02.api.letsencrypt.org/directory'
            [Mon Mar 7 18:39:19 EET 2022] _ACME_SERVER_HOST='acme-staging-v02.api.letsencrypt.org'
            [Mon Mar 7 18:39:19 EET 2022] _ACME_SERVER_PATH='directory'
            [Mon Mar 7 18:39:19 EET 2022] CA_CONF='/tmp/acme/test2//ca/acme-staging-v02.api.letsencrypt.org/directory/ca.conf'
            [Mon Mar 7 18:39:19 EET 2022] DOMAIN_PATH='/tmp/acme/test2//.abc.xz'
            [Mon Mar 7 18:39:19 EET 2022] _createkey for file:/tmp/acme/test2//
            .abc.xz/.abc.xz.key
            [Mon Mar 7 18:39:19 EET 2022] Use length 2048
            [Mon Mar 7 18:39:19 EET 2022] Using RSA: 2048
            [Mon Mar 7 18:39:19 EET 2022] APP
            [Mon Mar 7 18:39:19 EET 2022] 1:Le_Keylength='2048'
            [Mon Mar 7 18:39:19 EET 2022] The domain key is here: /tmp/acme/test2//
            .abc.xz/*.abc.xz.key

            last issued date is still the original
            0c0d9a02-2042-4d61-8026-ba7d32fde3d3-image.png

            certificates showing a private key only
            a693f63d-c052-44c7-b8fa-efacd0a253f3-image.png

            cloudflare
            e0e3d058-88f3-4043-af5f-5d05c77f8fe5-image.png

            1 Reply Last reply Reply Quote 0
            • jimpJ
              jimp Rebel Alliance Developer Netgate
              last edited by

              0.7_3 doesn't include the fix, it will be in 0.7_4.

              You can check the debug option on a cert to work around it until that is available (which will be shortly, it's building now).

              The debug option was the problem, it's a recent feature and seems to have some unintended side effects. I've removed it for now.

              Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

              Need help fast? Netgate Global Support!

              Do not Chat/PM for help!

              D R 2 Replies Last reply Reply Quote 1
              • D
                Donnyr @jimp
                last edited by

                @jimp thank you.
                It just took me a while to copy/paste logs and edit pictures and did not see your reply.

                thanks for your support - take your time.

                M 1 Reply Last reply Reply Quote 0
                • M
                  mrsunfire @Donnyr
                  last edited by

                  I'm having the problem with dyn.com and wildcard cert.

                  Netgate 6100 MAX

                  1 Reply Last reply Reply Quote 0
                  • R
                    raadms @jimp
                    last edited by

                    Thank you @jimp much appreciate your support. Looking forward for the new release again thank you for your effort.

                    Regards,

                    1 Reply Last reply Reply Quote 0
                    • D
                      Donnyr
                      last edited by

                      I can confirm it's working as expected in 0.7_4. Many thanks!

                      R 1 Reply Last reply Reply Quote 1
                      • R
                        raadms @Donnyr
                        last edited by

                        @donnyr @jimp it is working and I got my car renwed thank you much appreciated

                        R 1 Reply Last reply Reply Quote 0
                        • R
                          Robert de Wit @raadms
                          last edited by

                          @jimp

                          Got two questions (running on 2.6 CE):

                          1. how do I check the debug option ?
                          2. how can I run pkg version 0.7_4 ?
                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @Robert de Wit
                            last edited by

                            @robert-de-wit said in ACME not issuing certificate:

                            how can I run pkg version 0.7_4 ?

                            make sure you update your package in the package manager. Current version I show as 7.1_1

                            Which is newer then the .7_4 version...

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            R 1 Reply Last reply Reply Quote 0
                            • R
                              Robert de Wit @johnpoz
                              last edited by

                              @johnpoz

                              Running indeed on version 7.1_1.

                              I' ve got also a certificate error during creation, the logging tells me that

                              "You haven't specified the DirectAdmin Login data, URL and whether you want check the DirectAdmin SSL cert. Please try again."

                              In the array showed above this message the correct login data and URL information is displayed.

                              Any idea?

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @Robert de Wit
                                last edited by

                                @robert-de-wit said in ACME not issuing certificate:

                                DirectAdmin

                                Have no idea what that is - its not listed a supported ddns service that I see.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                R 1 Reply Last reply Reply Quote 0
                                • R
                                  Robert de Wit @johnpoz
                                  last edited by

                                  @johnpoz

                                  It should, you can select DNS-DirectAdmin and is working on older certificates but not on a new one.

                                  johnpozJ 1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator @Robert de Wit
                                    last edited by

                                    @robert-de-wit DOH!!! I was looking in ddns services ;) hehehe

                                    I don't use who ever that is, so there is no way for me to test that. Working fine here with clouldflare.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.