Let's Encrypt to obtain SSL certificate for subdomain

1

Hello!
I created an old.. subdomain for my site. I faced the problem of the inability to create a Letโ€™s Encrypt certificate for it (error 403), and the inability to transfer the certificate from the main domain.

Every time I get a nginx restart error.

Thank you for your help

2

Hi @Konstantinus,

That could mean a lot of things, what is the error in the log?

/var/log/hestia/LE-YourUser-YourDomain.log

Which one?

systemctl status nginx --no-pager -l
3 
/var/log/hestia/LE-YourUser-YourDomain.log

==[API call]==
exit status: 0

==[Step 6]==

  • status: 403
  • nonce: cZa1PNTsljqIv9klPzNTyQ1FGt7BzVNl6imbquTBp835Prsq6fg
  • payload: {โ€œcsrโ€:"MIIFJDCCAwwCAQAwgZsxJTAjBgkqhkiG9w0BCQEWFmluZm9Ab2xkLmFyY2hpdmUubWsudWExCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZ
  • certificate:
  • answer: HTTP/2 403 ^M
    server: nginx^M
    date: Wed, 16 Oct 2024 07:52:29 GMT^M
    content-type: application/problem+json^M
    content-length: 152^M
    boulder-requester: 1998115277^M
    cache-control: public, max-age=0, no-cache^M
    link: https://acme-v02.api.letsencrypt.org/directory;rel=โ€œindexโ€^M
    replay-nonce: cZa1PNTsljqIv9klPzNTyQ1FGt7BzVNl6imbquTBp835Prsq6fg^M
    ^M
    {
    โ€œtypeโ€: โ€œurn:ietf:params:acme:error:orderNotReadyโ€,
    โ€œdetailโ€: โ€œOrderโ€™s status ("invalid") is not acceptable for finalizationโ€,
    โ€œstatusโ€: 403
    }

/var/log/nginx/error.log:
2024/10/16 10:53:44 [emerg] 280763#280763: no host in โ€œ:443โ€ of the โ€œlistenโ€ directive in /etc/nginx/conf.d/domains/old.ั…ั…ั….ั…ั…ั….ั…ั….ssl.conf:8
2024/10/16 10:53:44 [emerg] 280780#280780: no host in โ€œ:443โ€ of the โ€œlistenโ€ directive in /etc/nginx/conf.d/domains/old.ั…ั…ั….ั…ั…ั….ั…ั….ssl.conf:8
2024/10/16 11:02:13 [emerg] 285776#285776: no host in โ€œ:80โ€ of the โ€œlistenโ€ directive in /etc/nginx/conf.d/domains/old.ั…ั…ั….ั…ั…ั…ั….ั…ั….conf:8
2024/10/16 11:02:13 [emerg] 285793#285793: no host in โ€œ:80โ€ of the โ€œlistenโ€ directive in /etc/nginx/conf.d/domains/old.ั…ั…ั….ั…ั…ั….ั…ั….conf:8

4

Why there is no host on listen directive? Are you using a custom template for that domain?

5

I use the standard โ€œJoomlaโ€ template.

image
image1317ร—1630 141 KB

6

Show the output of these commands (replace YourUser and old.ั…ั…ั….ั…ั…ั….ั…ั… by the actual data):

grep listen /etc/nginx/conf.d/domains/old.ั…ั…ั….ั…ั…ั….ั…ั….ssl.conf
v-list-web-domain YourUser old.ั…ั…ั….ั…ั…ั….ั…ั… json | jq -r '.[]|.IP'
7

root@web:/etc/nginx/conf.d/domains# grep listen /etc/nginx/conf.d/domains/old.archive.mk.ua.conf
listen 192.168.88.3:80;
root@web:/etc/nginx/conf.d/domains# v-list-web-domain admin old.archive.mk.ua json | jq -r โ€˜.|.IPโ€™
192.168.88.3
root@web:/etc/nginx/conf.d/domains#

8

I asked for the ssl conf:

grep listen /etc/nginx/conf.d/domains/old.archive.mk.ua.ssl.conf
9

image
image969ร—848 38.1 KB

The .ssl.conf file is not created:
root@web:/etc/nginx/conf.d/domains# grep listen /etc/nginx/conf.d/domains/old.archive.mk.ua.ssl.conf
grep: /etc/nginx/conf.d/domains/old.archive.mk.ua.ssl.conf: No such file or directory

10

Then I donโ€™t understand this error message:

How is nginx given an error about a directive in a file that doesnโ€™t exist? Right now nginx is up and running?

systemctl restart nginx
systemctl status nginx --no-pager -l

Anyway, right now you have a loop issue with cloudflare, it is redirecting one and again to the same url.

โฏ curl -iL --max-redirs 2 http://old.archive.mk.ua/.well-known/acme-challenge/test
HTTP/1.1 301 Moved Permanently
Date: Wed, 16 Oct 2024 15:44:33 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Location: https://old.archive.mk.ua/.well-known/acme-challenge/test
cf-cache-status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fgh7FsyqAivL53kdYwg8dH6m6Vc8YsYPajocwszyHsO5kaagSUjftUEtlggaDH6IzACwV0Iv8gNrXkBHGXJ1KO0UrKFE2VFm8nNUOHmmiLO0hxOHfNZQySXOfxkKmN2rFpOVqOx0gKPFRai%2BZGG87A%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Speculation-Rules: "/cdn-cgi/speculation"
Server: cloudflare
CF-RAY: 8d392bc299ebdc98-FRA
alt-svc: h3=":443"; ma=86400

HTTP/2 301 
date: Wed, 16 Oct 2024 15:44:34 GMT
content-type: text/html
location: https://old.archive.mk.ua/.well-known/acme-challenge/test
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZCN1T8Ht4oHIZqf4MvbfwDRAOMejk2SEhM1uGggJBodP679PMJIqUhi%2BqmE2bmUGGottx9EsyoHt4UtzeAdknLnu3vq5MGA3pHvUtAjw0z93r%2FM3Lsl%2FyDA7vcFqlLVaAjZONw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 8d392bc4daf265b1-FRA
alt-svc: h3=":443"; ma=86400

HTTP/2 301 
date: Wed, 16 Oct 2024 15:44:34 GMT
content-type: text/html
location: https://old.archive.mk.ua/.well-known/acme-challenge/test
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nk6wC388I8%2F4m7EjMq1Qtv7tpTA8nzVOKDPEP4ajPPT1u9QnznTGL8zfziwcNxLjk5oXbaioh4rEPatrmBpln0AUmWIgLha%2BlLJVff4IOETuibLhuh01pOODKYtuWhmZVHFoog%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
speculation-rules: "/cdn-cgi/speculation"
server: cloudflare
cf-ray: 8d392bc58b9465b1-FRA
alt-svc: h3=":443"; ma=86400

curl: (47) Maximum (2) redirects followed

I donโ€™t know if you are using some rules on Cloudflareโ€™s side or you activated a redirect on Hestia but you must fix it before trying to issue a certificate.

11

I apologise for any unclear wording.

  1. I have two servers:
    One on CP 1.8.12+Ubuntu 22.04 (it is accessible from the web)
    The second on CP 1.9.0a+Ubuntu 24.04 (local)

  2. To transfer projects from the first server to the second, I created two sites on the second server:
    www.archive
    old.archive

  3. I copied the SSL certificate details of www.archive from the first server and pasted them into the appropriate fields for both sites.

  4. Everything worked. Then I made the second server (1.9.0a+Ubuntu 24.04) available from the Internet and turned off the first server.

  5. As the second server became available online, I ordered the creation of SSL for the old.archive domain

  6. I received errors and created a post on the forum. Nginx did not work and did not want to restart.

  7. I ran the command v-rebuild-web-domains admin and nginx started working.

  8. I tried to re-generate SSL creation for the old.archive domain
    Nothing worked.

    image
    image1120ร—1363 62.8 KB

Now the new server is online so you can see the error.

I apologise for any inaccuracies in the question.

I can provide access to the server.

12

I requested the SSL certificate creation again and everything worked.

Thank you!