Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    ACME not issuing certificate

    Scheduled Pinned Locked Moved ACME
    23 Posts 8 Posters 2.7k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mcury Rebel Alliance @mcury
      last edited by

      Thanks jimp

      To workaround this issue:

      I imported the CAs Acmecert: O=Let's Encrypt, CN=R3, C=US and Acmecert: O=Internet Security Research Group, CN=ISRG Root X1, C=US from a backup.

      Then, deleted the certificate (key_only), and imported the cert again, X.509 (PEM), including certificate data and private key data.

      The new certificate generated is working properly now.

      dead on arrival, nowhere to be found.

      1 Reply Last reply Reply Quote 0
      • D
        Donnyr
        last edited by

        I have the same as mcury - no certificate, private key only.
        I was on 0.7_1 and have now updated to 0.7_3 - same issue

        acme_createdomainkey.log
        [Mon Mar 7 18:39:19 EET 2022] readlink exists=0
        [Mon Mar 7 18:39:19 EET 2022] dirname exists=0
        [Mon Mar 7 18:39:19 EET 2022] Lets find script dir.
        [Mon Mar 7 18:39:19 EET 2022] SCRIPT='/usr/local/pkg/acme/acme.sh'
        [Mon Mar 7 18:39:19 EET 2022] _script='/usr/local/pkg/acme/acme.sh'
        [Mon Mar 7 18:39:19 EET 2022] _script_home='/usr/local/pkg/acme'
        [Mon Mar 7 18:39:19 EET 2022] Using config home:/tmp/acme/test2/
        [Mon Mar 7 18:39:19 EET 2022] ACCOUNT_CONF_PATH='/tmp/acme/test2/accountconf.conf'
        [Mon Mar 7 18:39:19 EET 2022] APP
        [Mon Mar 7 18:39:19 EET 2022] 3:LOG_FILE='/tmp/acme/test2/acme_createdomainkey.log'
        [Mon Mar 7 18:39:19 EET 2022] APP
        [Mon Mar 7 18:39:19 EET 2022] 4:LOG_LEVEL='3'
        [Mon Mar 7 18:39:19 EET 2022] LE_WORKING_DIR='/tmp/acme/test2/'
        [Mon Mar 7 18:39:19 EET 2022] Running cmd: createDomainKey
        [Mon Mar 7 18:39:19 EET 2022] Creating domain key
        [Mon Mar 7 18:39:19 EET 2022] Using config home:/tmp/acme/test2/
        [Mon Mar 7 18:39:19 EET 2022] ACCOUNT_CONF_PATH='/tmp/acme/test2/accountconf.conf'
        [Mon Mar 7 18:39:19 EET 2022] ACME_DIRECTORY='https://acme-staging-v02.api.letsencrypt.org/directory'
        [Mon Mar 7 18:39:19 EET 2022] _ACME_SERVER_HOST='acme-staging-v02.api.letsencrypt.org'
        [Mon Mar 7 18:39:19 EET 2022] _ACME_SERVER_PATH='directory'
        [Mon Mar 7 18:39:19 EET 2022] CA_CONF='/tmp/acme/test2//ca/acme-staging-v02.api.letsencrypt.org/directory/ca.conf'
        [Mon Mar 7 18:39:19 EET 2022] DOMAIN_PATH='/tmp/acme/test2//.abc.xz'
        [Mon Mar 7 18:39:19 EET 2022] _createkey for file:/tmp/acme/test2//
        .abc.xz/.abc.xz.key
        [Mon Mar 7 18:39:19 EET 2022] Use length 2048
        [Mon Mar 7 18:39:19 EET 2022] Using RSA: 2048
        [Mon Mar 7 18:39:19 EET 2022] APP
        [Mon Mar 7 18:39:19 EET 2022] 1:Le_Keylength='2048'
        [Mon Mar 7 18:39:19 EET 2022] The domain key is here: /tmp/acme/test2//
        .abc.xz/*.abc.xz.key

        last issued date is still the original
        0c0d9a02-2042-4d61-8026-ba7d32fde3d3-image.png

        certificates showing a private key only
        a693f63d-c052-44c7-b8fa-efacd0a253f3-image.png

        cloudflare
        e0e3d058-88f3-4043-af5f-5d05c77f8fe5-image.png

        1 Reply Last reply Reply Quote 0
        • jimpJ
          jimp Rebel Alliance Developer Netgate
          last edited by

          0.7_3 doesn't include the fix, it will be in 0.7_4.

          You can check the debug option on a cert to work around it until that is available (which will be shortly, it's building now).

          The debug option was the problem, it's a recent feature and seems to have some unintended side effects. I've removed it for now.

          Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

          Need help fast? Netgate Global Support!

          Do not Chat/PM for help!

          D R 2 Replies Last reply Reply Quote 1
          • D
            Donnyr @jimp
            last edited by

            @jimp thank you.
            It just took me a while to copy/paste logs and edit pictures and did not see your reply.

            thanks for your support - take your time.

            M 1 Reply Last reply Reply Quote 0
            • M
              mrsunfire @Donnyr
              last edited by

              I'm having the problem with dyn.com and wildcard cert.

              Netgate 6100 MAX

              1 Reply Last reply Reply Quote 0
              • R
                raadms @jimp
                last edited by

                Thank you @jimp much appreciate your support. Looking forward for the new release again thank you for your effort.

                Regards,

                1 Reply Last reply Reply Quote 0
                • D
                  Donnyr
                  last edited by

                  I can confirm it's working as expected in 0.7_4. Many thanks!

                  R 1 Reply Last reply Reply Quote 1
                  • R
                    raadms @Donnyr
                    last edited by

                    @donnyr @jimp it is working and I got my car renwed thank you much appreciated

                    R 1 Reply Last reply Reply Quote 0
                    • R
                      Robert de Wit @raadms
                      last edited by

                      @jimp

                      Got two questions (running on 2.6 CE):

                      1. how do I check the debug option ?
                      2. how can I run pkg version 0.7_4 ?
                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @Robert de Wit
                        last edited by

                        @robert-de-wit said in ACME not issuing certificate:

                        how can I run pkg version 0.7_4 ?

                        make sure you update your package in the package manager. Current version I show as 7.1_1

                        Which is newer then the .7_4 version...

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        R 1 Reply Last reply Reply Quote 0
                        • R
                          Robert de Wit @johnpoz
                          last edited by

                          @johnpoz

                          Running indeed on version 7.1_1.

                          I' ve got also a certificate error during creation, the logging tells me that

                          "You haven't specified the DirectAdmin Login data, URL and whether you want check the DirectAdmin SSL cert. Please try again."

                          In the array showed above this message the correct login data and URL information is displayed.

                          Any idea?

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @Robert de Wit
                            last edited by

                            @robert-de-wit said in ACME not issuing certificate:

                            DirectAdmin

                            Have no idea what that is - its not listed a supported ddns service that I see.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            R 1 Reply Last reply Reply Quote 0
                            • R
                              Robert de Wit @johnpoz
                              last edited by

                              @johnpoz

                              It should, you can select DNS-DirectAdmin and is working on older certificates but not on a new one.

                              johnpozJ 1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @Robert de Wit
                                last edited by

                                @robert-de-wit DOH!!! I was looking in ddns services ;) hehehe

                                I don't use who ever that is, so there is no way for me to test that. Working fine here with clouldflare.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                1 Reply Last reply Reply Quote 0
                                • First post
                                  Last post
                                Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.