Issue Let's Encrypt with pointer/alias domains on OpenLiteSpeed

[virtio]

Hello,

We are experiencing problems generating an LE SSL for alias/pointer domain names on DirectAdmin with OpenLiteSpeed. We debugged the issue with the below instruction (except for step 2) but it always ends with a 404. When we remove the domain as an alias/pointer and create a user with it, we immediately succeed in creating an LE SSL. It therefore seems that alias/pointer domain names are not (properly) included in the configuration.

• https://help.directadmin.com/item.php?id=646

Debug info (not the actual domain or IP):


+ CURRENT_RESOLV=12.34.56.78
+ '[' '!' -z 12.34.56.78 ']'
+ /usr/local/bin/curl --help connection
+ grep -m1 -q resolve
+ CURL_RESOLV_OPTIONS='--resolve domainname.ext:80:12.34.56.78 --resolve domainname.ext:443:12.34.56.78'
+ /usr/local/bin/curl --connect-timeout 40 -k --silent --resolve domainname.ext:80:12.34.56.78 --resolve domainname.ext:443:12.34.56.78 -I -L -X GET http://domainname.ext/.well-known/acme-challenge/letsencrypt_1605173885
+ grep -m1 -q 'HTTP.*200'
+ '[' '' = silent ']'
+ echo 'Challenge pre-checks for http://domainname.ext/.well-known/acme-challenge/letsencrypt_1605173885 failed... Command:'
Challenge pre-checks for http://domainname.ext/.well-known/acme-challenge/letsencrypt_1605173885 failed... Command:
+ echo '/usr/local/bin/curl --connect-timeout 40 -k --silent --resolve domainname.ext:80:12.34.56.78 --resolve domainname.ext:443:12.34.56.78 -I -L -X GET http://domainname.ext/.well-known/acme-challenge/letsencrypt_1605173885'
/usr/local/bin/curl --connect-timeout 40 -k --silent --resolve domainname.ext:80:12.34.56.78 --resolve domainname.ext:443:12.34.56.78 -I -L -X GET http://domainname.ext/.well-known/acme-challenge/letsencrypt_1605173885
+ echo Exiting.
Exiting.
+ rm -f /var/www/html/.well-known/acme-challenge/letsencrypt_1605173885
+ exit 1


Checked parts:

• ensured that letsencrypt=1 is present in directadmin.conf.
• IPv6 disabled in DirectAdmin
• DNS checked
  
  
• Rebuild relevant parts:
  updated cb
  rebuild le / lego
  rebuild openlitespeed
  rewrite_confs

 

[scriptkitty]

Hi!

It looks like the domain didn't pass domain verification:

+ echo 'Challenge pre-checks for http://domainname.ext/.well-known/acme-challenge/letsencrypt_1605173885 failed... Command:'
Challenge pre-checks for http://domainname.ext/.well-known/acme-challenge/letsencrypt_1605173885 failed... Command:
+ echo '/usr/local/bin/curl --connect-timeout 40 -k --silent --resolve domainname.ext:80:12.34.56.78 --resolve domainname.ext:443:12.34.56.78 -I -L -X GET http://domainname.ext/.well-known/acme-challenge/letsencrypt_1605173885'

What was the result of running the curl command above manually?


I had this issue with a client last night with a pointer. The pointer no longer resolved. What I ended up doing was editing the san_config file manually to remove the pointer from it, and then running letsencrypt.sh with the edited file like so:

bash -x ./letsencrypt.sh request DOMAIN.TLD 4096 /usr/local/directadmin/data/users/USERNAME/domains/DOMAIN.TLD.san_config

Worked like a charm.