No domain's certificate is used on OpenLiteSpeed

zEitEr

zEitEr

Super Moderator
Joined
Apr 11, 2005
Messages
16,247
Location
www.poralix.com
Hello,

DirectAdmin 1.706 d4436d7f787e07ef11787cdec9fadc31739231d6
OpenLitespeed: 1.9.1

A bunch of domains do not use their own certificates on OpenLiteSpeed, keeping using server's cert. What am I doing wrong?

Bash: 
[root@poralix]# grep -E "keyFile|certFile" /usr/local/directadmin/data/users/di***k/openlitespeed.conf
    keyFile                 /etc/openlitespeed/certs/server.key
    certFile                /etc/openlitespeed/certs/server.crt.combined
[root@poralix]#

Even with the following settings:
2026-07-30_033123_poralix.png


The file /usr/local/directadmin/data/users/di****ek/domains/di****ek.nl.conf is missing lines

Bash: 
SSLCACertificateFile=
SSLCertificateFile=
SSLCertificateKeyFile=

having:

Bash: 
UseCanonicalName=OFF
acme_enabled=yes
acme_provider=letsencrypt
active=yes

And for sure the script is no longer working:

Bash: 
/usr/local/directadmin/scripts/letsencrypt.sh request die****ek.nl

How can i fix it? Kindly advice.
 
It is ok for the SSL options to be empty in the domain configuration file. It means the correct certificate should be picked by consulting the /etc/virtual/snidomains file. This file is already used for Exim and main DA server, the new TLS system wipes out the SSL entries from domain config to start using the same source of truth for certificates for webserver as well.

Please check if the /etc/virtual/snidomains has the entries for this domain certificate. It can be regenerated with:

Code: 
da taskq --run='action=rewrite&value=snidomains'
 
Finally it turned out, that a new certificate is needed to be requested.

1. Remove existing one
2. Install a new one

All domains with valid SSL certificates without valid lines

Code: 
SSLCACertificateFile=
SSLCertificateFile=
SSLCertificateKeyFile=

in their domain's config are now failing over SSL.

p.s. No words....
 
I would guess the new certificate request just triggered a snidomains file rewrite.
 
You must log in or register to reply here.
Back
Top