Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Cert update dates

    Scheduled Pinned Locked Moved ACME
    37 Posts 6 Posters 3.8k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • chudakC
      chudak
      last edited by chudak

      My current certificate as seeing via Browser certificate details say:

      Expires On	Tuesday, April 30, 2019 at 10:11:19 AM
      

      ACME updated this certificate on 01-04-2019 03:16:19

      I wonder, will the expiration date be automatically updated after/on April 30th?

      Thx

      P 1 Reply Last reply Reply Quote 0
      • DerelictD
        Derelict LAYER 8 Netgate
        last edited by

        The default configuration is to renew when the certificate is 60 days old. Did you change that in the certificate options on the acme cert?

        Do you have Cron Entry checked in general settings?

        You might want to manually renew and make sure it works and, if not, see what the problem/error is.

        Chattanooga, Tennessee, USA
        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
        Do Not Chat For Help! NO_WAN_EGRESS(TM)

        1 Reply Last reply Reply Quote 0
        • P
          PiBa @chudak
          last edited by

          @chudak
          Was the webgui restarted after acme renewed the certificate? The acme package allows configuring several 'actions' to restart relevant services where you might have used the certificate.

          chudakC 1 Reply Last reply Reply Quote 0
          • chudakC
            chudak
            last edited by

            I don't see any problems on ACME side.
            All worked fine dates and updates also show correct dates.

            In pfSense UI System/Certificate Manager/Certificates I see correct dates.

            Valid From: Tue, 08 Jan 2019 09:01:48 -0800
            Valid Until: Fri, 05 Jan 2029 09:01:48 -0800
            

            My question is when will those dates will be reflected when a client (browser) hits it ?

            johnpozJ 1 Reply Last reply Reply Quote 0
            • chudakC
              chudak @PiBa
              last edited by

              @PiBa said in Cert update dates:

              @chudak
              Was the webgui restarted after acme renewed the certificate? The acme package allows configuring several 'actions' to restart relevant services where you might have used the certificate.

              Do you know what services ?

              1 Reply Last reply Reply Quote 0
              • chudakC
                chudak
                last edited by chudak

                Found the answer - Restart webConfigurator fixed the issue!

                Thanks !

                1 Reply Last reply Reply Quote 0
                • DerelictD
                  Derelict LAYER 8 Netgate
                  last edited by

                  Still seems like that acme cert should have been updated by now.

                  Chattanooga, Tennessee, USA
                  A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                  DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                  Do Not Chat For Help! NO_WAN_EGRESS(TM)

                  1 Reply Last reply Reply Quote 0
                  • jimpJ
                    jimp Rebel Alliance Developer Netgate
                    last edited by

                    Check your ACME certificate entry, look in the Actions list and check for, or add, a set to run /etc/rc.restart_webgui as an enabled shell command.

                    Without that, the GUI wouldn't be restarted after renewing the certificate. Also assuming your cron job box is checked on the ACME general settings tab.

                    Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                    Need help fast? Netgate Global Support!

                    Do not Chat/PM for help!

                    chudakC 2 Replies Last reply Reply Quote 0
                    • chudakC
                      chudak @jimp
                      last edited by

                      @jimp Thanks! I did not have it added.

                      1 Reply Last reply Reply Quote 0
                      • chudakC
                        chudak @jimp
                        last edited by

                        @jimp one more question - is there a simple way to test that email works from letsencrypt ? I don't think I got any before Acme updated certificates and now have to wait for 60 days...

                        GertjanG 1 Reply Last reply Reply Quote 0
                        • jimpJ
                          jimp Rebel Alliance Developer Netgate
                          last edited by

                          No test I'm aware of. I know they still do it, though, as I received an e-mail from them over the weekend. I forgot to check the cron box on one of my lab systems.

                          Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                          Need help fast? Netgate Global Support!

                          Do not Chat/PM for help!

                          1 Reply Last reply Reply Quote 0
                          • GertjanG
                            Gertjan @chudak
                            last edited by Gertjan

                            @chudak said in Cert update dates:

                            is there a simple way to test that email works from letsencrypt ?

                            Oh, yes !
                            Get some certs from the Staging server. As soon as you get one of them, you'll be mail stormed after de delay.
                            I never received a mail that told me that I was late to renew a 'real' certificate. All my certs just renew by itself after 60 days - or the period I choose, which is generally somewhat less then 60 days.

                            Be aware that you can 'redo' your cert manually 5 times a week - just hit the renew button.

                            You could also renew from the command line : just run what the cron runs :

                            /usr/local/pkg/acme/acme_command.sh renewall
                            

                            You'll see that it comes back with

                            ....
                            Renewal number of days not yet reached.
                            

                            So, force it like this :

                            /usr/local/pkg/acme/acme_command.sh  renewall -force
                            

                            You'll be seeing a boat-load of lines on the screen, and finally, after the DNS delay etc, you obtain a new cert.
                            (don't forget to restart all services that use the certificate- as you already figured out)

                            .......
                            Rm2nmWhlbYL+R+4lLJmrPlkl6tSkxk05AOHF
                            -----END CERTIFICATE-----
                            [Mon Apr 15 13:03:04 CEST 2019] Your cert is in  /tmp/acme/V2_brit-hotel-fumel.net//brit-hotel-fumel.net/brit-hotel-fumel.net.cer
                            [Mon Apr 15 13:03:04 CEST 2019] Your cert key is in  /tmp/acme/V2_brit-hotel-fumel.net//brit-hotel-fumel.net/brit-hotel-fumel.net.key
                            [Mon Apr 15 13:03:04 CEST 2019] The intermediate CA cert is in  /tmp/acme/V2_brit-hotel-fumel.net//brit-hotel-fumel.net/ca.cer
                            [Mon Apr 15 13:03:04 CEST 2019] And the full chain certs is there:  /tmp/acme/V2_brit-hotel-fumel.net//brit-hotel-fumel.net/fullchain.cer
                            [Mon Apr 15 13:03:04 CEST 2019] Run reload cmd: /tmp/acme/V2_brit-hotel-fumel.net/reloadcmd.sh
                            
                            IMPORT CERT V2_brit-hotel-fumel.net, /tmp/acme/V2_brit-hotel-fumel.net/brit-hotel-fumel.net/brit-hotel-fumel.net.key, /tmp/acme/V2_brit-hotel-fumel.net/brit-hotel-fumel.net/brit-hotel-fumel.net.cer
                            update cert![Mon Apr 15 13:03:11 CEST 2019] Reload success
                            [Mon Apr 15 13:02:54 CEST 2019] key /tmp/acme/V2_brit-hotel-fumel.net/brit-hotel-fumel.netnsupdate.key is unreadable
                            [Mon Apr 15 13:02:54 CEST 2019] Error rm webroot api for domain:dns_nsupdate
                            [Mon Apr 15 13:03:00 CEST 2019] key /tmp/acme/V2_brit-hotel-fumel.net/brit-hotel-fumel.netnsupdate.key is unreadable
                            [Mon Apr 15 13:03:00 CEST 2019] Error rm webroot api for domain:dns_nsupdate
                            [Mon Apr 15 13:03:00 CEST 2019] key /tmp/acme/V2_brit-hotel-fumel.net/brit-hotel-fumel.netnsupdate.key is unreadable
                            [Mon Apr 15 13:03:00 CEST 2019] Error removing txt for domain:_acme-challenge.brit-hotel-fumel.net
                            [Mon Apr 15 13:03:00 CEST 2019] key /tmp/acme/V2_brit-hotel-fumel.net/brit-hotel-fumel.netnsupdate.key is unreadable
                            [Mon Apr 15 13:03:00 CEST 2019] Error removing txt for domain:_acme-challenge.brit-hotel-fumel.net
                            
                            [2.4.4-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root: ls -al /tmp/acme/V2_brit-hotel-fumel.net
                            total 248
                            drwxr-xr-x  5 root  wheel     512 Apr  9 16:50 .
                            drwxr-xr-x  3 root  wheel     512 Feb  7 14:37 ..
                            -rw-r--r--  1 root  wheel     431 Apr 15 13:03 accountconf.conf
                            -rw-r--r--  1 root  wheel  209317 Apr 15 13:03 acme_issuecert.log
                            drwxr-xr-x  3 root  wheel     512 Apr  9 16:51 brit-hotel-fumel.net
                            -rw-r--r--  1 root  wheel     105 Apr 15 12:59 brit-hotel-fumel.netnsupdate_acme-challenge.brit-hotel-fumel.net.key
                            -rw-r--r--  1 root  wheel      13 Apr 15 12:59 brit-hotel-fumel.netnsupdate_acme-challenge.brit-hotel-fumel.net.server
                            drwxr-xr-x  3 root  wheel     512 Feb  7 14:37 ca
                            -rw-r--r--  1 root  wheel     592 Apr 15 13:03 http.header
                            drwxr-xr-x  2 root  wheel     512 Apr  9 16:50 httpapi
                            -rwxr-xr-x  1 root  wheel     394 Apr 15 12:59 reloadcmd.sh
                            [2.4.4-RELEASE][admin@pfsense.brit-hotel-fumel.net]/root:
                            

                            Strange. It tries to delete
                            brit-hotel-fumel.netnsupdate.key
                            But the file is really called :
                            brit-hotel-fumel.netnsupdate_acme-challenge.brit-hotel-fumel.net.key

                            Looks like the "_acme-challenge.brit-hotel-fumel.net" part is missing when it constructs the file to delete.
                            Minor issue actually.

                            @jimp : can you confirm ?

                            My settings :
                            b9c9d6ac-1235-405e-8c40-e9dfa6141e9f-image.png

                            No "help me" PM's please. Use the forum, the community will thank you.
                            Edit : and where are the logs ??

                            chudakC 1 Reply Last reply Reply Quote 0
                            • chudakC
                              chudak @Gertjan
                              last edited by

                              @Gertjan said in Cert update dates:

                              @chudak said in Cert update dates:

                              is there a simple way to test that email works from letsencrypt ?

                              Oh, yes !
                              Get some certs from the Staging server. As soon as you get one of them, you'll be mail stormed after de delay.
                              I never received a mail that told me that I was late to renew a 'real' certificate. All my certs just renew by itself after 60 days - or the period I choose, which is generally somewhat less then 60 days.

                              I was looking for a simple way to either trigger email or see what certificates associated with my email.

                              Thanks for details !

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @chudak
                                last edited by

                                @chudak said in Cert update dates:

                                Valid From: Tue, 08 Jan 2019 09:01:48 -0800
                                Valid Until: Fri, 05 Jan 2029 09:01:48 -0800

                                That is not a ACME cert

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                chudakC 1 Reply Last reply Reply Quote 0
                                • jimpJ
                                  jimp Rebel Alliance Developer Netgate
                                  last edited by

                                  To help with some of this confusion, ACME 0.5.7, which I just committed a few minutes ago, now uses RFC 2822 format dates to show the last renewal. This makes it consistent with the dates shown on other certificate-related pages.

                                  Remember: Upvote with the πŸ‘ button for any user/post you find to be helpful, informative, or deserving of recognition!

                                  Need help fast? Netgate Global Support!

                                  Do not Chat/PM for help!

                                  chudakC 1 Reply Last reply Reply Quote 1
                                  • chudakC
                                    chudak @jimp
                                    last edited by

                                    @jimp Thanks looks good !

                                    1 Reply Last reply Reply Quote 0
                                    • chudakC
                                      chudak @johnpoz
                                      last edited by

                                      @johnpoz

                                      I am still not 100% sure what's going on with update dates.
                                      So I am a new user of ACME and like it a lot!

                                      Last time I manually updated certificates were April 7th

                                      I expected to start seeing emails 20 days before expiration sometime around 10th of July.

                                      I actually saw that certificates were renewed yesterday June 7th.

                                      What am I missing ?

                                      Thx

                                      1 Reply Last reply Reply Quote 0
                                      • DerelictD
                                        Derelict LAYER 8 Netgate
                                        last edited by

                                        It was automatically-renewed like it was supposed to be.

                                        Certbot runs every day. It checks the dates. If it needs to be renewed it runs the process. If everything works you have a refreshed cert.

                                        Chattanooga, Tennessee, USA
                                        A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                                        DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                                        Do Not Chat For Help! NO_WAN_EGRESS(TM)

                                        chudakC 1 Reply Last reply Reply Quote 0
                                        • chudakC
                                          chudak @Derelict
                                          last edited by

                                          @Derelict said in Cert update dates:

                                          It was automatically-renewed like it was supposed to be.

                                          Certbot runs every day. It checks the dates. If it needs to be renewed it runs the process. If everything works you have a refreshed cert.

                                          I get that, but why I did not get any emails ?

                                          GertjanG 1 Reply Last reply Reply Quote 0
                                          • GertjanG
                                            Gertjan @chudak
                                            last edited by Gertjan

                                            @chudak said in Cert update dates:

                                            I get that, but why I did not get any emails ?

                                            From who ?
                                            acme works has the FreeBSD/Linux mentality : no news is good news.
                                            There isn't a checkbox that states : "send me a mail" neither.
                                            Although the question was asked before.

                                            When you visit your setup, and the cert is 3 or 4 week, just hit the Renew yourself, and observer the process.
                                            When no errors, and you don't break things afterwards, renewing will just go fine in the future.

                                            edit : or : help yourself : write a small shell script that collects some data , activate it in the Action list and our done.

                                            /usr/local/pkg/acme/acme.sh --home /tmp/acme/[your-domain]/ --list
                                            

                                            to see actual cert details.

                                            No "help me" PM's please. Use the forum, the community will thank you.
                                            Edit : and where are the logs ??

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.