No domain's certificate is used on OpenLiteSpeed

[zEitEr]

Hello,

DirectAdmin 1.706 d4436d7f787e07ef11787cdec9fadc31739231d6
OpenLitespeed: 1.9.1

A bunch of domains do not use their own certificates on OpenLiteSpeed, keeping using server's cert. What am I doing wrong?

[root@poralix]# grep -E "keyFile|certFile" /usr/local/directadmin/data/users/di***k/openlitespeed.conf
    keyFile                 /etc/openlitespeed/certs/server.key
    certFile                /etc/openlitespeed/certs/server.crt.combined
[root@poralix]#

Even with the following settings:

The file /usr/local/directadmin/data/users/di****ek/domains/di****ek.nl.conf is missing lines

SSLCACertificateFile=
SSLCertificateFile=
SSLCertificateKeyFile=

having:

UseCanonicalName=OFF
acme_enabled=yes
acme_provider=letsencrypt
active=yes

And for sure the script is no longer working:

/usr/local/directadmin/scripts/letsencrypt.sh request die****ek.nl

How can i fix it? Kindly advice.

 

[fln]

It is ok for the SSL options to be empty in the domain configuration file. It means the correct certificate should be picked by consulting the /etc/virtual/snidomains file. This file is already used for Exim and main DA server, the new TLS system wipes out the SSL entries from domain config to start using the same source of truth for certificates for webserver as well.

Please check if the /etc/virtual/snidomains has the entries for this domain certificate. It can be regenerated with:

da taskq --run='action=rewrite&value=snidomains'

 

[zEitEr]

Finally it turned out, that a new certificate is needed to be requested.

1. Remove existing one
2. Install a new one

All domains with valid SSL certificates without valid lines

SSLCACertificateFile=
SSLCertificateFile=
SSLCertificateKeyFile=

in their domain's config are now failing over SSL.

p.s. No words....

 

[fln]

I would guess the new certificate request just triggered a snidomains file rewrite.

 

[zEitEr]

I would guess the new certificate request just triggered a snidomains file rewrite.

Maybe. Does the command

da taskq --run='action=rewrite&value=snidomains'

create missing SNI files in the folder "/etc/dovecot/conf/sni"?

 

[fln]

Yes. Updating snidomains file also causes the dovecot configs to be updated and web server configuration to be regenerated. Because both might change if there are new certificates present or absent.

 

[zEitEr]

The sni rewrite command did not update the file "/etc/dovecot/conf/sni" as well as did not create a sni config for a domain in the past in case the domain is missing in the file. Is it working differently since the update?

 

[fln]

This taskq action used to update dovecot and webserver configs in older DA versions. The snidomains file is created slightly differently in the latest releases (better handles domain isolation).