new acme ssl system insufficient for handling domain name changes

[fln]

@johannes, unchecking the "Prefer wildcard certificates" should be used only as the last resort if automatic external DNS detection does not work. Using external DNS and keeping the "Prefer wildcard certificates" ON should be ok for most of the servers. If auto-detection does not work please open a support ticket and let us investigate the server environment to find out why auto-detection had a false-positive. It would be much better in the long run to improve the auto-detection or fix the issues on your server if there are any.

 

[Imtek]

Please can you make the "uncheck the "Prefer wildcard certificates" check-box in the domain ACME settings page" a system- and userwide setting for us admins? We have all domains on external DNS and it would be many hours or even days of work to go through each customerdomain in the GUI to just uncheck it for each single domain. Thank you

+1

 

[digignosis]

We will provide an official way to migrate to the new ACME system (or do it automatically) once the migration path is finalized. Can't give any guarantees. I'd expect it to be available within a couple of DA releases.

To get back to these comments from sewiti (following my opening posts in this thread), to sum up after reading other users replies here:

- Maybe not make any big global updates before that migration path is finalized at all. Just throwing out updates like these and then saying "maybe some things that maybe helpful will happen a few releases from now, but no guarantees" is just asking for trouble.

- Instead of waiting for a vaguely planned 'official way to migrate' or again something that will just happen automatically, clearly defined admin-manageable options are needed in the short term, to be precise the following:

1. Admin actions to set all (or checkbox selected) users to acme / no acme.

2. Admin actions to set all (or checkbox selected) acme users to wildcard / no wildcard.

3. Toggles for these as global defaults in the conf files.

4. Better on-screen info text to clarify what the options do, including hints for troubleshooting the top issues.

Please pass this on to the developers.

Thanks for understanding, have a good one.

 

[Active8]

This is really bad, now we have to check each
domain /customer to see if ACME is enabled and remove the wildcard setting ?

 

[zEitEr]

domain /customer to see if ACME is enabled and remove the wildcard setting ?

A quick life-hack is here:

Run

/usr/local/directadmin/scripts/letsencrypt.sh request <domain>

in a loop against all hosted domains to enable ACME and try a certificate renewal. Be prepared to a bunch of alerts about failed attempts from DirectAdmin.

p.s. you might use a filtered list of domains, just to make sure you don't overwrite those ones which use paid certificates. In old days one could rely on an existence of the file /usr/local/directadmin/data/users/*/domains/*.cert.creation_time

 

[Active8]

Hi @zEitEr thank you for the hack so this will enable ACME and disable wildcart then.
Is there something that can be used to do all the domains at once ? like @digignosis said , we dont use paid certificates

 

[fln]

@Active8, if you do have a server where preferred-wildcard option is enabled and DA does not fallback to HTTP challenge, then please open a support ticket for us to investigate it further. Having prefer wildcard enabled and not using DNS challenge should be fine (DA should auto-detect and switch to HTTP challenge).

 

[zEitEr]

so this will enable ACME and disable wildcart then

Yes, it will enable ACME, and enable wildcard certificates, if they are configured to be used by default (not too sure there is a changeable global option for it yet)

Is there something that can be used to do all the domains at once ? , we dont use paid certificates

I would not recommend do it against all domains at once. One by one domain would be better.

The command:

awk -F: '{print $1}' /etc/virtual/domainowners

would list all hosted domains.

The following should be used for testing purposes:

for DOMAIN in $(awk -F: '{print $1}' /etc/virtual/domainowners | sort | uniq); do echo /usr/local/directadmin/scripts/letsencrypt.sh request ${DOMAIN}; done;

remove echo for actual run.

p.s. use the commands on your own risk. Though they work on my end, I don't guarantee they work the same on your server.