Still showing old SSL after renewing/replacing

drukpa

Verified User
Joined
Aug 30, 2019
Messages
22
My existing commercial wildcard SSL for the server is expiring soon and I have renewed and received a new certificate.

I have uploaded the SSL/Key to the /usr/local/directadmin/conf/ to cacert.pem and cakey.pem files and restarted DA.

But when I access DA it still shows the old about to expire certificate. Have restarted DA multiple times, checked on a different computer to rule out browser SSL caching, but it's the same result.

I know that I also need to update certificate files for exim, but do I need to do anything for Apache and Nginx? I believe the DA service is provided by a directadmin daemon and not apache/nginx.
 
How are you "seeing" the old certificate? If you're looking via a browser, try incognito mode and see if it's still showing the old certificate.
 
Maybe this helps

also this might help

I have same issue
==========================================================================
Written by Alex Grebenschikov ([email protected]), 2015,2017,2021
==========================================================================
[INFO] Validating CERT /usr/local/directadmin/conf/cacert.pem
[OK] The cert md5 hash: decbfcf2ba8b56cf45a80fb0e3b96c4b

[INFO] Validating CERT /usr/local/directadmin/conf/cakey.pem
[OK] The key md5 hash: decbfcf2ba8b56cf45a80fb0e3b96c4b

[OK] CERT and KEY match each other!

[INFO] You provided CACERT /usr/local/directadmin/conf/carootcert.pem
[INFO] Validating CERT /usr/local/directadmin/conf/carootcert.pem
[OK] The cert md5 hash: 6e1860ff2074bc0587e9aba832417b95

[OK] Installing cert/key for Directadmin
cp: ‘/usr/local/directadmin/conf/cacert.pem’ and ‘/usr/local/directadmin/conf/cacert.pem’ are the same file
cp: ‘/usr/local/directadmin/conf/cakey.pem’ and ‘/usr/local/directadmin/conf/cakey.pem’ are the same file
cp: ‘/usr/local/directadmin/conf/carootcert.pem’ and ‘/usr/local/directadmin/conf/carootcert.pem’ are the same file
mode of ‘/usr/local/directadmin/conf/cacert.pem’ changed from 0644 (rw-r--r--) to 0600 (rw-------)
mode of ‘/usr/local/directadmin/conf/cakey.pem’ changed from 0400 (r--------) to 0600 (rw-------)
mode of ‘/usr/local/directadmin/conf/carootcert.pem’ changed from 0644 (rw-r--r--) to 0600 (rw-------)
ownership of ‘/usr/local/directadmin/conf/cacert.pem’ retained as diradmin:diradmin
ownership of ‘/usr/local/directadmin/conf/cakey.pem’ retained as diradmin:diradmin
ownership of ‘/usr/local/directadmin/conf/carootcert.pem’ retained as diradmin:diradmin

[OK] Restarting service directadmin

[OK] Installing cert/key for Litespeed
‘/usr/local/directadmin/conf/cacert.pem’ -> ‘/etc/httpd/conf/ssl.crt/server.crt’
‘/usr/local/directadmin/conf/cacert.pem’ -> ‘/etc/httpd/conf/ssl.crt/server.crt.combined’
‘/usr/local/directadmin/conf/cakey.pem’ -> ‘/etc/httpd/conf/ssl.key/server.key’
‘/usr/local/directadmin/conf/carootcert.pem’ -> ‘/etc/httpd/conf/ssl.crt/server.ca’
mode of ‘/etc/httpd/conf/ssl.crt/server.crt’ retained as 0600 (rw-------)
mode of ‘/etc/httpd/conf/ssl.key/server.key’ retained as 0600 (rw-------)
mode of ‘/etc/httpd/conf/ssl.crt/server.ca’ retained as 0600 (rw-------)
mode of ‘/etc/httpd/conf/ssl.crt/server.crt.combined’ retained as 0600 (rw-------)
ownership of ‘/etc/httpd/conf/ssl.crt/server.crt’ retained as root
ownership of ‘/etc/httpd/conf/ssl.key/server.key’ retained as root
ownership of ‘/etc/httpd/conf/ssl.crt/server.ca’ retained as root
ownership of ‘/etc/httpd/conf/ssl.crt/server.crt.combined’ retained as root
group of ‘/etc/httpd/conf/ssl.crt/server.crt’ retained as root
group of ‘/etc/httpd/conf/ssl.key/server.key’ retained as root
group of ‘/etc/httpd/conf/ssl.crt/server.ca’ retained as root
group of ‘/etc/httpd/conf/ssl.crt/server.crt.combined’ retained as root

[OK] Restarting service litespeed
Failed to restart litespeed.service: Unit not found.

[OK] Installing cert/key for Exim and Dovecot
‘/usr/local/directadmin/conf/cacert.pem’ -> ‘/etc/exim.cert’
‘/usr/local/directadmin/conf/cakey.pem’ -> ‘/etc/exim.key’
mode of ‘/etc/exim.key’ retained as 0600 (rw-------)
mode of ‘/etc/exim.cert’ retained as 0600 (rw-------)
ownership of ‘/etc/exim.key’ retained as mail
ownership of ‘/etc/exim.cert’ retained as mail
group of ‘/etc/exim.key’ retained as mail
group of ‘/etc/exim.cert’ retained as mail

[OK] Restarting service exim

[OK] Restarting service dovecot

[OK] Installing cert/key for PureFTPd
mode of ‘/etc/pure-ftpd.pem’ retained as 0600 (rw-------)
ownership of ‘/etc/pure-ftpd.pem’ retained as root:root

[OK] Restarting service pure-ftpd

that scipt do well, but SSL for port 2222 not change to use new key.
I do check ssl date and confirm file is ok:
openssl x509 -in /usr/local/directadmin/conf/cacert.pem -noout -dates
notBefore=May 22 00:00:00 2022 GMT
notAfter=Apr 28 23:59:59 2023 GMT

And that my check on port 2222
notBefore=Apr 28 00:00:00 2021 GMT
notAfter=May 29 23:59:59 2022 GMT

Any other information for fix that issue =(
 
Found on this case also.
already did restart directadmin , httpd service but still same result (browser already remember old expired cert) -> open with incognito
however information on https://crt.sh already show new cert but on da not update

openssl x509 -in /usr/local/directadmin/conf/cacert.pem -noout -dates
notBefore=Dec 26 00:00:00 2022 GMT
notAfter=Dec 26 23:59:59 2023 GMT
 
Last edited:
Found on this case also.
already did restart directadmin , httpd service but still same result (browser already remember old expired cert) -> open with incognito
however information on https://crt.sh already show new cert but on da not update

openssl x509 -in /usr/local/directadmin/conf/cacert.pem -noout -dates
notBefore=Dec 26 00:00:00 2022 GMT
notAfter=Dec 26 23:59:59 2023 GMT
Finally found cause , user use same domain as da url and need to update in ssl user cert also
Thank you.
 
Back
Top