openmediavault-letsencrypt

I have upgraded from OMV 3.x to 4.x, and Let's Encrypt used to work, but now it doesn't.

I have tried everything 5 times: Forwarding ports, reinstalling plugin, updating everything incl. OMV-Extras, running apt clean, checking DNS-settings, asking nicely, yelling at my monitor. Nothing helps. I just get this message every time:

Command: export PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin; export LANG=C; /usr/bin/certbot certonly --non-interactive --rsa-key-size 2048 --text --keep-until-expiring --agree-tos --allow-subset-of-names --cert-name MYDOMAIN.COM-cert --email MY@MAIL.COM --webroot -w /var/www/openmediavault  -d MYDOMAIN.COM 2>&1


Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for MYDOMAIN.COM
Using the webroot path /var/www/openmediavault for all unmatched domains.
Waiting for verification...
Challenge failed for domain MYDOMAIN.COM
Cleaning up challenges
Challenges failed for all domains
Done...

I'm not good at using Linux, I have SSH-access but mainly use OMV WebUI.
Any suggestions? Thank you

Hi,

I am on OMV 4.x, I don't have the "Test Certificate" button enabled, certbot is running fine, BUT ...

Certificate in Tab "SSL" does NOT get renewed - it also tells me an old date in the comment: "LetsEncrypt - home.stockinger.name (20180911)"

when I directly look into corresponding directories I see that there are new certificates in the letsencrypt directory (dated 29th of Dec), but in the OMV cert and key directory they are still from 11th of Sept.

ls /etc/letsencrypt/live/home.stockinger.name -al
lrwxrwxrwx 1 root root45 Dez 29 14:26 cert.pem -> ../../archive/home.stockinger.name/cert13.pem
lrwxrwxrwx 1 root root46 Dez 29 14:26 chain.pem -> ../../archive/home.stockinger.name/chain13.pem
lrwxrwxrwx 1 root root50 Dez 29 14:26 fullchain.pem -> ../../archive/home.stockinger.name/fullchain13.pem
lrwxrwxrwx 1 root root48 Dez 29 14:26 privkey.pem -> ../../archive/home.stockinger.name/privkey13.pe


ls /etc/ssl/certs/openmediavault-* -al
-rw-r--r-- 1 root root 1826 Sep 11 14:21 /etc/ssl/certs/openmediavault-54f42090-ca0b-4565-976a-d6e42b2c1203.crt
-rw-r--r-- 1 root root 3875 Sep 11 14:21 /etc/ssl/certs/openmediavault-7f34f58c-3f7c-4866-a209-4492770c7754.crt


ls /etc/ssl/private/openmediavault-* -al
-rw-r----- 1 root root 3272 Sep 11 14:21 /etc/ssl/private/openmediavault-54f42090-ca0b-4565-976a-d6e42b2c1203.key
-rw-r----- 1 root root 1704 Sep 11 14:21 /etc/ssl/private/openmediavault-7f34f58c-3f7c-4866-a209-4492770c7754.key

I also cannot find anything in the logs:

letsencrypt.log

syslog (no trace for a call to Certifcate Management at that time):

Here is the output for the generated key, which has a different UUID - so the old one was not replaced.
omv-showkey letsencrypt

<letsencrypt>
<enable>1</enable>
<test_cert>0</test_cert>
<email>gerald@stockinger.name</email>
<name>home.stockinger.name</name>
<certuuid>7f34f58c-3f7c-4866-a209-4492770c7754</certuuid>
<keylength>2048</keylength>
<extraoptions/>
<domains>
<domain>
<uuid>c1ceba72-82d4-436e-b8e3-25fbac4c63f4</uuid>
<domain>home.stockinger.name,ftp.stockinger.name,share.stockinger.name</domain>
<webroot>/media/c8529c27-fd7a-4cd9-abf6-64d26c7489c2/Applications/www/home/public</webroot>
</domain>
</domains>
</letsencrypt>

Any ideas?

Thx, Gerald

I have a question.

I successfully got my certificate.

In order to avoid errors I set the OMV Web port access to 80, and opened this port in my router.

Now if I change this port to another of mi like when I have to renew the certificate wil I have problems?

Best regards.

Quote from ryecoaaron

yes

I guess I need por 80 to be open to keep the certificate OK, right?

Best regards.

I have an issue with my letsencrypt, every renewal I have the problem, that the cert gets renewed, but the older one kept in use by nginx. I need to apply a self-signed one to nginx, manually delete the letsentcrypt-cert in cert organisation of OMV and then try to renew the letsencrypt cert. It says that the cert is already up to date and then lists the new letsencrypt cert in OMV so that I can use it in nginx.

IS there a way to automaticly replace the cert in OMV & nginx with the new one when it gets renewed automaticly?

I use OMV4.0 with the suitable plugin.

I would like to point out that I have the same problem like riff-raff and I am using OMV 4.0 as well for some time.

I described my problem a few posts above - maybe my explanation had too much details and was therefore confusing ...

Result is the same: Letsencrypt gets a new certifcate but OMV does not use it. Need to manually delete it in OMV Frontend and then renew.

i have the same problem too. When i see the certs are expired i go to the letsencrypt plugin and do a renew,
but with the message "Cert not yet due for renewal".
After the command was issued, i get the notice that the configuration has changed, and i need to confirm,
like i have to do if i change any omv config. After i do that, the nginx config is reloaded with the right new cert.

Maybe there is a problem with the automatic reload after cert renewal by the cronjob

About renewing the certificate,for sure you do not need to do a fresh install of the container just pass
docker logs -f letsencrypt

Quote from Malefunk

i have the same problem too. When i see the certs are expired i go to the letsencrypt plugin and do a renew,
but with the message "Cert not yet due for renewal".
After the command was issued, i get the notice that the configuration has changed, and i need to confirm,
like i have to do if i change any omv config. After i do that, the nginx config is reloaded with the right new cert.

Maybe there is a problem with the automatic reload after cert renewal by the cronjob

I can confirm this behaviour and this workaround. Few days ago again my certificate expired - needed to do a manual renew.
Something is wrong here.

Quote from Gerald

I can confirm this behaviour and this workaround. Few days ago again my certificate expired - needed to do a manual renew.Something is wrong here.

Just adding that I have had the same problem for the last year or more. I've learned to just live with it every 3 months.

I have also observed this problem, but I have found that self-generating a new certificate, temporarily switching to it, and then switching back to the Let's Encrypt one gets things working again. I am not sure why or how, but that has been my workaround.

I use the same workaround within every renewal period.

Hi,

I think it is a stupid question, but I can't find the way on the web and on this forum to renew the certificate of letsEncrypt. Maybe I don't use the right keyword...

I am using docker LetsEncrypt.

Do you have a step-by-step procedure to do that ?

Thanks!

Quote from RomainD2

Hi,

I think it is a stupid question, but I can't find the way on the web and on this forum to renew the certificate of letsEncrypt. Maybe I don't use the right keyword...

I am using docker LetsEncrypt.

Do you have a step-by-step procedure to do that ?

Thanks!

Display More

Hi,
I am using letsencrypt docker for fail2ban and nginx with self signed cert but below should assist you with checking logs and giving an idea. I would first try to restart the docker and check the logs.
https://hub.docker.com/r/linuxserver/letsencrypt

Certs are checked nightly and if expiration is within 30 days, renewal is attempted. If your cert is about to expire in less than 30 days, check the logs under /config/log/letsencrypt to see why the renewals have been failing. It is recommended to input your e-mail in docker parameters so you receive expiration notices from letsencrypt in those circumstances.

https://certbot.eff.org/docs/u…new#renewing-certificates

certbot renew