wildcard letsencrypt certificates are not working as they should

S

sec-is

Verified User
Joined
Feb 14, 2020
Messages
100
Ever since the update of letsencrypt 2.0.17 which was done on the 17th of May, all my domains running on a wildcard certificate by letsencrypt are getting a certificate generated by Direct Admin without the wildcard in it. Only the main domain is in the 'common' of the certificate.
This problem is happening on more than 10 servers running -up to date- Direct Admin on them which I have under my supervision (yes, because they are auto-updated. I had so often problems with missing updates on letsencrypt, that I had no other choice).

If I do a './build versions', it says I already have the current letsencrypt version which is 2.0.17
When I look here https://files.directadmin.com/services/all/letsencrypt/ , I see 2.0.18 exists as well.
So I thought: okay, they have found the bug and there is a new version available. So I go into custombuild 2.0, and I set the version manually to 2.0.18 and install it.

Next thing, I try and install the letsencrypt certificate for one of the domains which needs the wildcard version.
When the certificate is done, I check the SSL page in DA, and I see there is NO wildcard shown below the certificate.

I need to update many SSL certificates, so I keep on testing (trying to fix it). I now set the version to 2.0.16 and install it.
And now? Yes. It works again. (not strange, since it was working up to that version).

I am posting this, because I could not find ANY hit when searching for 'letsencrypt directadmin wildcard problem'. And now it will find my text here.

Now I will wait and sit, and see when DA picks up this problem and solve it. Something has been 'broken', so it must be easy to fix it back again.

For anyone else hitting the problem, if you can downgrade without any problems, that is the way to go.
If you can not downgrade, you MAY downgrade, create AND copy the certificate and upgrade (revert) back. After that you can install the working certificate (the COPIED one), so you have 60 days to fix this problem.
 
Something is wrong indeed. I have a domain which expires june 10th so it should be renewed already, but it's not renewed.
With my script, I can't even find the domain, while it's present in Directadmin itself.

After checking, it seems the san_config file is not present in the users domain directory.
So this might be related.
 
As I said, I installed 2.0.18 and it did not work. Please let me know when it is actually fixed.
 
sec-is said:
As I said, I installed 2.0.18 and it did not work. Please let me know when it is actually fixed.
Click to expand...
You installed it when it was not yet released :) That's why it did not work for you, as the codebase just wasn't there to fix the problem.
 
Richard G said:
I presume this means the domains which are affected by this need to be renewed manually after installing 2.0.18?
Click to expand...
2.0.16 was fine, so, only the ones (if any) that were wildcard and renewed with 2.0.17 (it was there for a couple of days only).
 
Thank you smtalk.
I have removed the 'custom version' setting, clicked the 'custombuild' button and installed letsencrypt 2.0.18
Then I renewed one of my domains, and it works again.
Now I need to update all of my servers again (pfffff). But most importantly: it is fixed.
 
Hi, thanks for the valuable information.

But i couldn't find a solution for update my DA server's Let's Encrypt version. I couldn't find any help articles about this topic either.

Could you help me about this?
 
yavuzgm said:
But i couldn't find a solution for update my DA server's Let's Encrypt version.
Click to expand...
At this moment, you need the newest DA version. If your OS is up to date and not EOL according to DA standards, it's easy to do.
Via SSH
Code: 
cd /usr/local/directadmin/custombuild
./build update
./build update_versions
if it won't update LE, you can either run the last line again afterwards or use:
./build letsencrypt
 
Which LE version do you have at the moment? If it's not 2.0.30 try like this and then overwrite the old one.

wget https://files.directadmin.com/services/all/letsencrypt/letsencrypt.sh
 
My letsencrypt.sh file shows "#VERSION=2.0.30" at this path: /usr/local/directadmin/scripts

Still wildcard certificate can not create from the user interface.

I have a same version Directadmin server with the same OS but it has wildcard option for LE certificates.
 
You must log in or register to reply here.
Back
Top