DirectAdmin 1.50.0 has been released

You'd better not to wait but solve the issue now:

Change Directadmin settings to renew cert every 60 days (it will be a default value with new directadmin version):

Code: 
echo "letsencrypt_renewal_days=60" >> /usr/local/directadmin/conf/directadmin.conf

or change creation time to a value on far past:

Code: 
for file in `ls -1 /usr/local/directadmin/data/users/*/domains/*.cert.creation_time`; do echo -n 100 > $file; done;

and make Directadmin to renew all the certs:

Code: 
echo "action=rewrite&value=letsencrypt" >> /usr/local/directadmin/data/task.queue && /usr/local/directadmin/dataskq

Then create a script:

Code: 
touch /usr/local/directadmin/scripts/custom/recreate_ssl_combined.sh
chmod 700 /usr/local/directadmin/scripts/custom/recreate_ssl_combined.sh

with the following content:

Code: 
#!/bin/bash
#
# Written by Alex S Grebenschikov $ www.poralix.com ([email protected])
# A script to re-create combined cert for domains with Let's Encrypt SSL Certs.
#
for san in `ls -1 /usr/local/directadmin/data/users/*/domains/*.san_config`;
do
    domain=`basename ${san}`;
    dirname=`dirname ${san}`;
    domain=${domain%.san_config};
    if [ -e "${dirname}/${domain}.cert.creation_time" ] && [ -e "${dirname}/${domain}.cert" ] && [ -e "${dirname}/${domain}.key" ];
    then
        echo "[OK] Found $domain";
        cat "${dirname}/${domain}.cert" "${dirname}/${domain}.cacert" > "${dirname}/${domain}.cert.combined";
    fi;
done;
exit 0;

and run it as root:

Code: 
/usr/local/directadmin/scripts/custom/recreate_ssl_combined.sh

With it you will get all the Let's Encrypt certs updated with correct cert.combined, run:

Code: 
apachectl -t

and/or

Code: 
nginx -t

to make sure that everything is fine and restart both of them (or any depending on what server you use).
 
Last edited:
my cert is going to expire in few weeks and i cant believe directadmin are so slow with a official fix because when certificate doesnt renew it disables our site. Please fix this as soon as possible
 
It's fixed in a pre-release binary which is available through the client area on www.directadmin.com. I really hope they will release a fixed version very soon.

And still it's quite easy to request a new cert in Directadmin at user level for one-two domains.
 
Thanks Alex as always for your help on this forum :) Trying that later today.

@ DA team, are there plans to release the fix soon?
 
Renewal function works fine for the exception of creating combined/bundle cert for nginx. You can ignore this fact if you don't have Nginx.
 
zEitEr said:
You can ignore this fact if you don't have Nginx.
Click to expand...

This is on an NGINX server alright. But I'm not entirely sure what you mean with combined/bundle certs. Are these LE certs where you have added additional domains manually and then resubmitted the certificate request?
 
zmippie said:
This is on an NGINX server alright. But I'm not entirely sure what you mean with combined/bundle certs. Are these LE certs where you have added additional domains manually and then resubmitted the certificate request?
Click to expand...

If you see error like this:

https://forum.directadmin.com/showthread.php?t=52723&p=272938#post272938

Here is a solution:

https://forum.directadmin.com/showthread.php?t=52723&p=272947#post272947

Or install pre-release binary of Directadmin which has a fix.
 
any comments from directadmin staff when they release a official version for this fix??
 
A week ago I received an automatic email from Directadmin that my cert had been automatically renewed, so I tought "yes, it works". But I never realized it said it renewed the cert, but never really did it. So I hit a big SSL-error this morning, because my cert expired. Fixed it quickly by creating a new one in the interface, but it's a nasty bug.

Am I correct I have to perform all the steps as mentioned in this post or is there new information available?
 
Nginx restart is required since a cert renewal.

Directadmin is smart enough and does a test of the nginx configuration, if a test fails directadmin won't force to restart nginx. If directadmin would not check nginx configuration and force restarting, then nginx would not simply start and you would get you web-server down.

If you see an old cert in a browser, when you are 100% sure that the cert was renewed...
If a site with a newly subdomain or domain shows a blank page with "Nginx is functioning normally" instead of expected content... then it would mean that nginx was not restarted.

Am I correct I have to perform all the steps as mentioned in this post or is there new information available?
Click to expand...

Actually you have 3 options:

1. install pre-release binary
2. manual renew through directadmin interface per domain
3. for bulk updates use the guide in the post #203
 
Thanks zEitEr your post #203 saved my day! After I restarted apache and nginx all websites where down.
Desperately I followed your guide and all is working ok now. :) Lets hope DA will update soon.
Below my post about it somewhere else on the forum.

Wanabo said:
My first domain with a letsencrypt generated certifcate has been successfully renewed according to a DirectAdmin message, but the expiration date in the real certificate is still the old one and not extended with 3 months.
FYI the expiration date is 3 days away instead of 3 months.

Automated certificate renewal for phpfusion-nederlands.info has succeeded
Getting challenge for phpfusion-nederlands.info from acme-server...
Waiting for domain verification...
Challenge is valid.
Getting challenge for www.phpfusion-nederlands.info from acme-server...
Waiting for domain verification...
Challenge is valid.
Generating 4096 bit RSA key for phpfusion-nederlands.info...
openssl genrsa 4096 > "/usr/local/directadmin/data/users/someuser/domains/phpfusion-nederlands.info.key.new"
Generating RSA private key, 4096 bit long modulus
.......++
................++
e is 65537 (0x10001)
Certificate for phpfusion-nederlands.info has been created successfully!
<br>
Click to expand...


I expected 3 months to be added to the certificate, but it has still the old expiration date.

Is this correct? Or will the certificate be replaced automatically when the old one expires?
Click to expand...
http://forum.directadmin.com/showthread.php?t=53233&p=273056#post273056
 
First time using SSL and Let's Encrypt with DirectAdmin. It's been 90 days, but my certificates aren't auto-renewing.
I also can't recreate the certificates manually anymore either.

Code: 
Getting challenge for <mydomain>.com from acme-server...
/usr/local/directadmin/scripts/letsencrypt.sh: 319: /usr/local/directadmin/scripts/letsencrypt.sh: cannot create /var/www/html/.well-known/acme-challenge/: Is a directory
/usr/local/directadmin/scripts/letsencrypt.sh: 322: [: -ne: unexpected operator
Waiting for domain verification...
rm: cannot remove `/var/www/html/.well-known/acme-challenge/': Is a directory
Challenge is . Details: . Exiting...

Anything I can do to fix this?
 
neobim said:
First time using SSL and Let's Encrypt with DirectAdmin. It's been 90 days, but my certificates aren't auto-renewing.
I also can't recreate the certificates manually anymore either.

Code: 
Getting challenge for <mydomain>.com from acme-server...
/usr/local/directadmin/scripts/letsencrypt.sh: 319: /usr/local/directadmin/scripts/letsencrypt.sh: cannot create /var/www/html/.well-known/acme-challenge/: Is a directory
/usr/local/directadmin/scripts/letsencrypt.sh: 322: [: -ne: unexpected operator
Waiting for domain verification...
rm: cannot remove `/var/www/html/.well-known/acme-challenge/': Is a directory
Challenge is . Details: . Exiting...

Anything I can do to fix this?
Click to expand...


I fixed this by changing line 300 in /usr/local/directadmin/scripts/letsencrypt.sh from
Code: 
CHALLENGE="`echo "${RESPONSE}" | egrep -o '{[^{]*\"type\":\"http-01\"[^}]*'`"
to
Code: 
CHALLENGE="`echo "${RESPONSE}" |  tr '\n' ' '| grep -Pzo '\"type\": \"http-01\",([\s\S]+)\"\s+}'`"

I'm not sure if this is the "correct" way to do it, but it works. I have no idea why the first one doesn't.
My server is running Debian Wheezy, if it makes any difference.

I also had to change letsencrypt=1 to letsencrypt=2 in /usr/local/directadmin/conf/directadmin.conf to get it working.
 
@neobim,

Fixed in the new pre-release binary

Code: 
Compile time: May 20 2016 at 19:14:59

change:

Code: 
CHALLENGE="`echo "${RESPONSE}" | egrep -o '{[^{]*\"type\":\"http-01\"[^}]*'`"

to

Code: 
CHALLENGE="`echo "${RESPONSE}" | awk '/\"type\": \"http-01\"/,/}/'`"

in /usr/local/directadmin/scripts/letsencrypt.sh
 
Last edited:
That's John and Martynas who fixed the issue, not me. I've just shared what they wrote to me when I reported the same issue via tickets.
 
You must log in or register to reply here.
Back
Top