Solved SSL and SNI correct but apache still uses server SSL certificate

[jigster]

I use webmail.domain.com for users to login to webmail. In /usr/local/directadmin/data/templates/custom/virtual_host2_secure.conf.CUSTOM.4.post I have

</VirtualHost>
<VirtualHost |IP|:|PORT_443| |MULTI_IP|>
   ServerName webmail.|DOMAIN|
   ServerAdmin |ADMIN|
   DocumentRoot /var/www/html/roundcube

   SSLEngine on
   SSLCertificateFile |CERT|
   SSLCertificateKeyFile |KEY|
   |CAROOT|

   CustomLog /var/log/httpd/domains/|DOMAIN|.bytes bytes
   CustomLog /var/log/httpd/domains/|DOMAIN|.log combined
   ErrorLog /var/log/httpd/domains/|DOMAIN|.error.log
   <IfModule !mod_ruid2.c>
       SuexecUserGroup webapps webapps
   </IfModule>

This works correctly for all domains. EXCEPT where a domain uses external nameservers. The DNS at the nameservers are correctly set up to point 'webmail.domain.com' to the server IP. In DirectAdmin > Admin SSL I request a new SSL certificate for the domain and the system log shows the certificate is issued for the subdomains pointing to my server:

LetsEncrypt(1926525): exit code: 0 for domain='domain.com'
Ssl::set_sni_domains:username,domain.com: removed mail.domain.com from snidomains
Ssl::set_sni_domains:username,domain.com: removed webmail.domain.com from snidomains
Ssl::set_sni_domains: swapping snidomains: mail.domain.com=(null) with mail.domain.com=username:domain.com
Ssl::set_sni_domains: swapping snidomains: webmail.domain.com=(null) with webmail.domain.com=username:domain.com

/etc/virtual/snidomains correctly lists both subdomains:

mail.domain.com:username:domain.com
webmail.domain.com:username:domain.com

But DA > Admin SSL says Valid=no for the certificate and shows it using the server certificate, not the one just issued.

And in DA > Custom HTTPD Configurations > httpd.conf for the domain, it shows the SSL cert for webmail.domain.com is still using the server certificate:

ServerName webmail.domain.com
...
SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt.combined
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key
...

All other domains httpd.conf have the domain certificate at /usr/local/directadmin/data/users/username/domains/domain.com.cert.combined

So how do I force that one domain to use the correct certificate? I have already tried re-requesting the certificate, rebuilding apache, rewriting apache conf files, restarting apache etc.

Any ideas? I really REALLY need to get this working! Thanks

 

[jigster]

If I modify /usr/local/directadmin/data/users/username/httpd.conf for the domain to use the correct certificate path at /usr/local/directadmin/data/users/username/domains/domain.com.cert.combined, https://webmail.domain.com works correctly. But this file will get overwritten upon apache updates/rewrites.

How do I get the change to stick? Or better, how to get Directadmin to use the correct certificate automatically for such domains, so no custom changes are needed?

 

[jigster]

After discussing with DirectAdmin, the solution was to go into User level > SSL Certificates > Get automatic certificate from ACME Provider, then create a cert for just the subdomains that resolve to this IP. Then everything worked as it should. Just in case anyone else ever needs this.