openmediavault-letsencrypt

joq3 · 24. Oktober 2017

I'm having a problem with a few of my subdomains when generating/renewing certificates.
According to one of the Certbot engineers on the LetsEncrypt community it might have something to do with this plugin.
https://community.letsencrypt.…-invalid-response/44873/5

Check out the thread here, and ignore the error: "There were too many requests of a given type :: Error creating new cert :: too many certificates already issued for exact set of domains:". It is from me retrying to many times.

Can one of the developers help me check this out, because he seems to think this might be a plugin problem.
Thank you!

ryecoaaron · 25. Oktober 2017

Zitat von joq3

Can one of the developers help me check this out, because he seems to think this might be a plugin problem.

I wish there was someone else working on this because this is difficult for me to fix since I don't use it. That said, if you look at this line, the plugin is passing the webroot that you specify to certbot. I don't know how else this could be done. This is exactly that same as what the plugin used to do - link

joq3 · 26. Oktober 2017

Zitat von ryecoaaron

I wish there was someone else working on this because this is difficult for me to fix since I don't use it. That said, if you look at this line, the plugin is passing the webroot that you specify to certbot. I don't know how else this could be done. This is exactly that same as what the plugin used to do - link

Hi ryecoaaron, I'm thankful for the plugin you have made. Sadly I am of no use with helping, but I have tried my best to find out what is missing.
See the latest replies from the Certbot engineer/developer here:
https://community.letsencrypt.…invalid-response/44873/10

ryecoaaron · 26. Oktober 2017

Zitat von joq3

See the latest replies from the Certbot engineer/developer here:

Well, I can tell what needs to be fixed now. I'm a bit surprised that no one has run into this issue before since the plugin has never supported multiple webroots. It will need a lot of changes to accommodate this correctly.

joq3 · 27. Oktober 2017

Zitat von ryecoaaron

Well, I can tell what needs to be fixed now. I'm a bit surprised that no one has run into this issue before since the plugin has never supported multiple webroots. It will need a lot of changes to accommodate this correctly.

Yes that is very weird, and I was able to make it work for quite a few domains too.
I just realised another thing. Is it neccessary for OMV to run on port 80?
I have changed the port to 70.

Regarding this info: "Port 80 must be open for Let's Encrypt to verify your domain."

I have port 80 open, but OMV is not on port 80 anymore.

Also what's the webroot supposed to point at? My Nginx (websites) locations, like this: "/srv/91a2af43-24c7-475f-b28b-3cb663d2aa7e/Media/OMV/Web/www/"? or the standard "/var/www/openmediavault/"?
Thank you!

ryecoaaron · 27. Oktober 2017

Zitat von joq3

Is it neccessary for OMV to run on port 80?

Nope.

Zitat von joq3

Also what's the webroot supposed to point at?

You are asking the guy who doesn't use it After reading the documentation more, they verify that the file is in the webroot for the domain. If you are getting a cert for you OMV web interface, then the webroot would be /var/www/openmediavault. If you are getting a cert for a domain setup in the nginx plugin, you would have /srv/91a2af43-24c7-475f-b28b-3cb663d2aa7e/Media/OMV/Web/www/ for the webroot.

joq3 · 27. Oktober 2017

Zitat von ryecoaaron

Nope.
You are asking the guy who doesn't use it After reading the documentation more, they verify that the file is in the webroot for the domain. If you are getting a cert for you OMV web interface, then the webroot would be /var/www/openmediavault. If you are getting a cert for a domain setup in the nginx plugin, you would have /srv/91a2af43-24c7-475f-b28b-3cb663d2aa7e/Media/OMV/Web/www/ for the webroot.

Great!
Yes I understand you don't use it, but I'm just trying to figure out why this problem isn't more widespread than it is.

Another thing, does the Let's Encrypt plugin support multiple domain-names? I know it does work quite well with subdomains (apart from the problems we're discussing). But will it work if I add another domain, or do I need two seperate certs? If so, how do I set it up with this plugin?
To clarify, right now I have domain.com, sub1.domain.com.... and I want to add domain2.com and sub.domain2.com to this.

Thank you!

ryecoaaron · 27. Oktober 2017

Zitat von joq3

does the Let's Encrypt plugin support multiple domain-names?

The example here shows two domains and the comment below the domain textbox says you can.

Zitat von joq3

If so, how do I set it up with this plugin?

If you need more than one webroot, you can't right now until I change the plugin. If you don't, then just separate the domain with commas like the comment says.

Fitty · 28. Oktober 2017

Hallo Guys, i end up with

"Saving debug log to /var/log/letsencrypt/letsencrypt.log
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for xxx.org
Using the webroot path /srv/dev-disk-by-id-ata-ADATA_SP900_2G0920019205-part3/www/nextcloud for all unmatched domains.
Waiting for verification...
Challenge failed for domain xxx.org
Cleaning up challenges
Challenges failed for all domains
Fertig..."

what am i doing wrong here?

EDIT
Ok, i got it working - had to stop my NGINX Server to get it working. Stupid beginner Mistake.
WORKING PERFECTLY NOW with Nextcloud 12.0.3

ryecoaaron · 28. Oktober 2017

Zitat von joq3

If so, how do I set it up with this plugin?

I just pushed the multiple webroot change to the omv 3.x testing repo and omv 4.x repo. Try it out and let me know if it is working.

ryecoaaron · 28. Oktober 2017

Another note, I found a place (multiple domains and webroots) I can actually use the letsencrypt plugin. So, I should be a little better at testing now

joq3 · 29. Oktober 2017

Zitat von ryecoaaron

I just pushed the multiple webroot change to the omv 3.x testing repo and omv 4.x repo. Try it out and let me know if it is working.

I just did my first test, no success
This is the log (I have added an extra domain now):

Code

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for linkd.se
http-01 challenge for www.linkd.se
http-01 challenge for vpn.linkd.se
http-01 challenge for ftp.linkd.se
http-01 challenge for mov.linkd.se
http-01 challenge for tv.linkd.se
http-01 challenge for media.linkd.se
http-01 challenge for bt.linkd.se
http-01 challenge for home.linkd.se
http-01 challenge for boxstudio.se
http-01 challenge for www.boxstudio.se
http-01 challenge for dev1.boxstudio.se
http-01 challenge for dev2.boxstudio.se
http-01 challenge for dev3.boxstudio.se
Using the webroot path /srv/91a2af43-24c7-475f-b28b-3cb663d2aa7e/Media/OMV/Web/dev3 for all unmatched domains.
Waiting for verification...


>>> *************** Error ***************
Bad Gateway
<<< *************************************
Challenge failed for domain dev3.boxstudio.se
Challenge failed for domain dev2.boxstudio.se
Challenge failed for domain dev1.boxstudio.se
Challenge failed for domain boxstudio.se
Challenge failed for domain media.linkd.se
Challenge failed for domain www.boxstudio.se
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0027_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0027_csr-certbot.pem
An unexpected error occurred:
OSError: [Errno 2] No such file or directory: '/etc/letsencrypt/renewal/linkd.se/boxstudio.se.conf'
Please see the logfiles in /var/log/letsencrypt for more details.
Done...

Alles anzeigen

This part of the log is weird too:
"Using the webroot path /srv/91a2af43-24c7-475f-b28b-3cb663d2aa7e/Media/OMV/Web/dev3 for all unmatched domains" I have not selected that.

And the weird thing is that it fails on the same things every time.
"Challenge failed for domain dev3.boxstudio.se
Challenge failed for domain dev2.boxstudio.se
Challenge failed for domain dev1.boxstudio.se
Challenge failed for domain boxstudio.se
Challenge failed for domain media.linkd.se
Challenge failed for domain http://www.boxstudio.se"

Everything here except media.linkd.se is for Nginx (websites) which I have set the webroot to the locations of the web files.
And media.linkd.se is set to "/var/lib/docker/overlay2/9c456d9636e71fbf11f2e3e1f3720380b8f721abf112807dd5e4a70a3a05901f/diff/opt/ombi/Views/" which I think is the webroot of Ombi, but I am not sure.

Where do I find the OpenVPN Access Server webroot?

Also this error is weird: "OSError: [Errno 2] No such file or directory: '/etc/letsencrypt/renewal/linkd.se/boxstudio.se.conf'" I deleted the old certificate completely before pressing generate, to avoid problems.

joq3 · 29. Oktober 2017

Now everything is going to shit here. I wanted a completely fresh try. So I went and deleted every Server in NGinx Websites, deleted the old certificate and deleted Let's Encrypt plugin. And also the Nginx (websites) plugin.
But when uninstalling Nginx (websites) I got this error:

I click Close, and page reloads, then I get these errors: "RPC service 'PhpFpm' not found." and "RPC service 'Nginx' not found.".
The plugin is gone, and if I reinstall it, and try to enable it, this error occurs:
"An error has occured" without any explaination at all when I press more info, it is empty.

So now I am stuck, I've made everything worse than before, I can't get Nginx (websites) to work at all.
And if I try to generate a new certificate after all this, this is the turnout (challenge fails for every domain):

Code

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Starting new HTTPS connection (1): acme-v01.api.letsencrypt.org
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for boxstudio.se
http-01 challenge for www.boxstudio.se
http-01 challenge for dev1.boxstudio.se
http-01 challenge for dev2.boxstudio.se
http-01 challenge for dev3.boxstudio.se
http-01 challenge for bt.linkd.se
http-01 challenge for home.linkd.se
http-01 challenge for media.linkd.se
http-01 challenge for mov.linkd.se
http-01 challenge for tv.linkd.se
http-01 challenge for linkd.se
http-01 challenge for www.linkd.se
http-01 challenge for vpn.linkd.se
http-01 challenge for ftp.linkd.se
Using the webroot path /home/docker/.config/organizr/www/Dashboard for all unmatched domains.
Waiting for verification...


>>> *************** Error ***************
Bad Gateway
<<< *************************************
Challenge failed for domain dev3.boxstudio.se
Challenge failed for domain boxstudio.se
Challenge failed for domain dev2.boxstudio.se
Challenge failed for domain mov.linkd.se
Challenge failed for domain ftp.linkd.se
Challenge failed for domain dev1.boxstudio.se
Challenge failed for domain tv.linkd.se
Challenge failed for domain home.linkd.se
Challenge failed for domain vpn.linkd.se
Challenge failed for domain www.linkd.se
Challenge failed for domain bt.linkd.se
Challenge failed for domain media.linkd.se
Challenge failed for domain www.boxstudio.se
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/0000_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/0000_csr-certbot.pem
IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/NAS/fullchain.pem. Your cert will expire on
   2018-01-27. To obtain a new or tweaked version of this certificate
   in the future, simply run certbot again. To non-interactively renew
   *all* of your certificates, run "certbot renew"
 - If you lose your account credentials, you can recover through
   e-mails sent to admin@linkd.se.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.
 - If you like Certbot, please consider supporting our work by:


   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le


Done...

Alles anzeigen

EDIT: I did try after clearing cookies (private window), same issues.

ryecoaaron · 29. Oktober 2017

The plugin works on my sites except for one. Not sure why but I couldn't investigate (my internet was out for almost 12 hours yesterday).

Did you fill in everything on the Settings tab? I added a name field so the cert filename doesn't use the first domain.

I have no idea how to find the webroot of a docker plugin.

Zitat von joq3

"Using the webroot path /srv/91a2af43-24c7-475f-b28b-3cb663d2aa7e/Media/OMV/Web/dev3 for all unmatched domains" I have not selected that.

Not sure why it would do that. That would be a good question for certbot people. I need to add the command line command that the plugin uses to show the certbot people what we are using.

Sounds like your nginx/php-fpm config is messed and/or omv is partial uninstalled. What is the output of: dpkg -l | grep openm

joq3 · 29. Oktober 2017

Zitat von ryecoaaron

The plugin works on my sites except for one. Not sure why but I couldn't investigate (my internet was out for almost 12 hours yesterday).

Did you fill in everything on the Settings tab? I added a name field so the cert filename doesn't use the first domain.

I have no idea how to find the webroot of a docker plugin.
Not sure why it would do that. That would be a good question for certbot people. I need to add the command line command that the plugin uses to show the certbot people what we are using.
Sounds like your nginx/php-fpm config is messed and/or omv is partial uninstalled. What is the output of: dpkg -l | grep openm

Alles anzeigen

Not a fun day yesterday, without internet

Yes, I have filled in name, I called it NAS this time (not the same name as before), also used a new email.

I understand that, I will try to look inside all the folders.

I figured out the part why it used that adress for the unmatched domains, it will use the last domain you add, so I changed it so my main domain is at the bottom of the list and it will be choosen for unmatched domains.

This is the output:

Code

ii  openmediavault                                              3.0.90                           all          Open network attached storage solution
ii  openmediavault-backup                                       3.6                              all          backup plugin for OpenMediaVault.
ii  openmediavault-cups                                         3.1.2                            all          OpenMediaVault CUPS (network printer server) plugin.
ii  openmediavault-docker-gui                                   3.1.10                           amd64        OpenMediaVault plugin for Docker
ii  openmediavault-fail2ban                                     1.3.1                            all          OpenMediaVault Fail2ban plugin
ii  openmediavault-keyring                                      1.0                              all          GnuPG archive keys of the OpenMediaVault archive
ii  openmediavault-letsencrypt                                  3.4                              all          Generate free and valid SSL certificates for OMV
ii  openmediavault-mysql                                        3.0.4                            all          MySQL plugin for OpenMediaVault.
ii  openmediavault-nginx                                        3.0.11                           all          Nginx plugin for OpenMediaVault.
ii  openmediavault-omvextrasorg                                 3.4.29                           all          OMV-Extras.org Package Repositories for OpenMediaVault
ii  openmediavault-plexmediaserver                              3.8.1                            all          OpenMediaVault Plex Media Server plugin
ii  openmediavault-radarr                                       3.0                              all          OpenMediaVault Radarr plugin
ii  openmediavault-resetperms                                   3.3                              all          Reset Permissions
ii  openmediavault-sonarr                                       3.2                              all          OpenMediaVault Sonarr plugin
ii  openmediavault-transmissionbt                               3.0.9                            all          OpenMediaVault Transmission (BitTorrent client) plugin.
ii  openmediavault-unionfilesystems                             3.1.17                           all          Union filesystems plugin for OpenMediaVault.

Alles anzeigen

(This output is after I installed the nginx plugin again).

joq3 · 29. Oktober 2017

And this happened now when I tried to uninstall the plugin, another error:

Now the output is like this:

Code

root@nas:~# dpkg -l | grep openm
ii  openmediavault                                              3.0.90                           all          Open network attached storage solution
ii  openmediavault-backup                                       3.6                              all          backup plugin for OpenMediaVault.
ii  openmediavault-cups                                         3.1.2                            all          OpenMediaVault CUPS (network printer server) plugin.
ii  openmediavault-docker-gui                                   3.1.10                           amd64        OpenMediaVault plugin for Docker
ii  openmediavault-fail2ban                                     1.3.1                            all          OpenMediaVault Fail2ban plugin
ii  openmediavault-keyring                                      1.0                              all          GnuPG archive keys of the OpenMediaVault archive
ii  openmediavault-letsencrypt                                  3.4                              all          Generate free and valid SSL certificates for OMV
ii  openmediavault-mysql                                        3.0.4                            all          MySQL plugin for OpenMediaVault.
ii  openmediavault-omvextrasorg                                 3.4.29                           all          OMV-Extras.org Package Repositories for OpenMediaVault
ii  openmediavault-plexmediaserver                              3.8.1                            all          OpenMediaVault Plex Media Server plugin
ii  openmediavault-radarr                                       3.0                              all          OpenMediaVault Radarr plugin
ii  openmediavault-resetperms                                   3.3                              all          Reset Permissions
ii  openmediavault-sonarr                                       3.2                              all          OpenMediaVault Sonarr plugin
ii  openmediavault-transmissionbt                               3.0.9                            all          OpenMediaVault Transmission (BitTorrent client) plugin.
ii  openmediavault-unionfilesystems                             3.1.17                           all          Union filesystems plugin for OpenMediaVault.

Alles anzeigen

EDIT: But the Nginx (websites still shows up in OMV).
And gives me these errors when trying to access it:
"RPC service 'Nginx' not found."
"RPC service 'PhpFpm' not found."

ryecoaaron · 29. Oktober 2017

I would try:

omv-mkconf nginx
omv-mkconf php5fpm
systemctl restart nginx
systemctl restart php5-fpm

nginx still showing up in OMV is a browser cache issue. Try control-shift-R

joq3 · 29. Oktober 2017

Zitat von ryecoaaron

I would try:

omv-mkconf nginx
omv-mkconf php-fpm
systemctl restart nginx
systemctl restart php5-fpm

nginx still showing up in OMV is a browser cache issue. Try control-shift-R

Alles anzeigen

Tried it (with Nginx uninstalled), the result:

Code

root@nas:~# omv-mkconf nginx
root@nas:~# omv-mkconf php-fpm
ERROR: The script '/usr/share/openmediavault/mkconf/php-fpm' does not exist
root@nas:~# systemctl restart nginx
root@nas:~# systemctl restart php5-fpm

ryecoaaron · 29. Oktober 2017

I had a typo with omv-mkconf php5-fpm. Retry the commands. Do an omv-aptclean as well and post the output of: ls -al /var/www/openmediavault/js/omv/module/admin/service/

joq3 · 29. Oktober 2017

Zitat von ryecoaaron

I had a typo with omv-mkconf php5-fpm. Retry the commands. Do an omv-aptclean as well and post the output of: ls -al /var/www/openmediavault/js/omv/module/admin/service/

Typo again I think, I had to do this:
omv-mkconf nginx

omv-mkconf php5fpm
systemctl restart nginx

systemctl restart php5-fpm

This is the output:

Code

root@nas:~# ls -al /var/www/openmediavault/js/omv/module/admin/service/
total 76
drwxrwxr-x 18 openmediavault-webgui openmediavault-webgui 4096 Oct 29 15:26 .
drwxrwxr-x  8 openmediavault-webgui openmediavault-webgui 4096 Oct 19 18:59 ..
drwxrwxr-x  4 openmediavault-webgui openmediavault-webgui 4096 Oct 20 20:46 cups
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 23 09:13 docker
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 27 09:22 fail2ban
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 29 08:40 ftp
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 29 10:56 letsencrypt
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 19 21:28 mysql
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 29 08:40 nfs
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 21 15:20 plexmediaserver
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 24 07:59 radarr
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 29 08:40 rsync
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 29 08:40 rsyncd
-rw-rw-r--  1 openmediavault-webgui openmediavault-webgui 1014 May  5 00:46 Service.js
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 29 08:40 smb
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 29 08:40 snmp
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 24 07:59 sonarr
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 29 08:40 ssh
drwxrwxr-x  2 openmediavault-webgui openmediavault-webgui 4096 Oct 20 20:20 transmissionbt

Alles anzeigen

Jetzt mitmachen!