Skip to content

Error certification on virtualmin/Nginx

Solved Linux
  • Maybe better, I don’t know how anymore in Virtualmin, there was a bug with virtualmin/Let’s encrypt, I have to look for it

  • Maybe better, I don’t know how anymore in Virtualmin, there was a bug with virtualmin/Let’s encrypt, I have to look for it

    @DownPW yes, it’s a bit hit and miss, but certbot will work. Have a look at this

  • I did like that from memory and select subdomain but I would like to take a longer time. Memorizing the certificate didn’t last long

    sudo certbot --nginx -v

  • I did like that from memory and select subdomain but I would like to take a longer time. Memorizing the certificate didn’t last long

    sudo certbot --nginx -v

    @DownPW should be 90 days?

  • Yes I guess but it’s not much but it doesn’t matter. I don’t see any commands in the help
    Should I delete the Zerro SSL certificate via Webmin before? Think yes

    image.png

    and this bug that we can’t regenerate a certificate without error via virtualmin is really annoying.

  • Yes I guess but it’s not much but it doesn’t matter. I don’t see any commands in the help
    Should I delete the Zerro SSL certificate via Webmin before? Think yes

    image.png

    and this bug that we can’t regenerate a certificate without error via virtualmin is really annoying.

    @DownPW said in Error certification on virtualmin/Nginx:

    Should I delete the Zerro SSL certificate via Webmin before? Think yes

    Yes.

    @DownPW said in Error certification on virtualmin/Nginx:

    and this bug that we can’t regenerate a certificate without error via virtualmin is really annoying.

    What is the error message?

  • I have regenerate with certbot, reload nginx without errors but it is still the zeroSSL certificate that appears in Webmin/Current Certificate

    Do you want to expand and replace this existing certificate with the new
    certificate?
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    (E)xpand/(C)ancel: E
    Renewing an existing certificate for virtuaverse.fr and 2 more domains
    Successfully received certificate.
    Certificate is saved at: /etc/letsencrypt/live/nodebbdev.xxx.fr/fullchain.pem
    Key is saved at: /etc/letsencrypt/live/nodebbdev.xxx.fr/privkey.pem
    This certificate expires on 2023-12-31.
    These files will be updated when the certificate renews.
    Certbot has set up a scheduled task to automatically renew this certificate in the background.
    Deploying certificate
    Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/xxx.fr.conf
    Successfully deployed certificate for xxx.fr to /etc/nginx/sites-enabled/xxx.fr.conf
    Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/proxy.xxx.fr.conf
    Successfully deployed certificate for proxy.xxx.fr to /etc/nginx/sites-enabled/proxy.xxx.fr.conf
    Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/nodebbdev.xxx.fr.conf
    Successfully deployed certificate for nodebbdev.xxx.fr to /etc/nginx/sites-enabled/nodebbdev.xxx.fr.conf
    Traffic on port 80 already redirecting to ssl in /etc/nginx/sites-enabled/xxx.fr.conf
    Traffic on port 80 already redirecting to ssl in /etc/nginx/sites-enabled/proxy.xxx.fr.conf
    Traffic on port 80 already redirecting to ssl in /etc/nginx/sites-enabled/nodebbdev.xxx.fr.conf
    Your existing certificate has been successfully renewed, and the new certificate has been installed.

    703b34e3-77df-4bca-9578-1d0d04b3ebe2-image.png

    ada17138-1945-4794-aa91-8865eaa0a528-image.png

    EDIT : Very Strange, i test again to regenerate certificat with let’s encrypt on virtualmin and that’s work and Current certificate is now OK on virtualmin.
    it never worked for several months and it works now, very strange 😲

  • I have regenerate with certbot, reload nginx without errors but it is still the zeroSSL certificate that appears in Webmin/Current Certificate

    Do you want to expand and replace this existing certificate with the new
    certificate?
    - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
    (E)xpand/(C)ancel: E
    Renewing an existing certificate for virtuaverse.fr and 2 more domains
    
    Successfully received certificate.
    Certificate is saved at: /etc/letsencrypt/live/nodebbdev.xxx.fr/fullchain.pem
    Key is saved at:         /etc/letsencrypt/live/nodebbdev.xxx.fr/privkey.pem
    This certificate expires on 2023-12-31.
    These files will be updated when the certificate renews.
    Certbot has set up a scheduled task to automatically renew this certificate in the background.
    
    Deploying certificate
    Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/xxx.fr.conf
    Successfully deployed certificate for xxx.fr to /etc/nginx/sites-enabled/xxx.fr.conf
    Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/proxy.xxx.fr.conf
    Successfully deployed certificate for proxy.xxx.fr to /etc/nginx/sites-enabled/proxy.xxx.fr.conf
    Deploying Certificate to VirtualHost /etc/nginx/sites-enabled/nodebbdev.xxx.fr.conf
    Successfully deployed certificate for nodebbdev.xxx.fr to /etc/nginx/sites-enabled/nodebbdev.xxx.fr.conf
    Traffic on port 80 already redirecting to ssl in /etc/nginx/sites-enabled/xxx.fr.conf
    Traffic on port 80 already redirecting to ssl in /etc/nginx/sites-enabled/proxy.xxx.fr.conf
    Traffic on port 80 already redirecting to ssl in /etc/nginx/sites-enabled/nodebbdev.xxx.fr.conf
    Your existing certificate has been successfully renewed, and the new certificate has been installed.
    

    703b34e3-77df-4bca-9578-1d0d04b3ebe2-image.png

    ada17138-1945-4794-aa91-8865eaa0a528-image.png

    EDIT : Very Strange, i test again to regenerate certificat with let’s encrypt on virtualmin and that’s work and Current certificate is now OK on virtualmin.
    it never worked for several months and it works now, very strange 😲

    @DownPW go figure…

  • yep very very erratic

    In any case, thank you for the support.

  • undefined DownPW has marked this topic as solved on 2 Oct 2023, 22:07
  • yep very very erratic

    In any case, thank you for the support.

    @DownPW anytime

  • Did this solution help you?
    Did you find the suggested solution useful? Why not buy me a coffee? It's a nice gesture, and a great way to show your appreciation 💗


16/17

2 Oct 2023, 22:07



Related Topics
  • 3 Votes
    4 Posts
    874 Views
    @crazycells hi - no security reason, or anything specific in this case. However, the nginx.conf I posted was from my Dev environment which uses this port as a way of not interfering with production. And yes, I use clustering on this site with three instances.
  • 3 Votes
    10 Posts
    1k Views
    @Hari DDoS protection is not just a switch, or one component. It’s a collection of different and often disparate technologies that when grouped together form the basis of a combined toolset that can be used in defence. Typically these consist of IDS (Instrusion Detection System) and IPS (Intrusion Prevention System) components that detect irregularities in network traffic, and will take decisive action based on predefined rulesets, or in the case of more modern systems, AI and ML. Traditional “traffic shaping” technology is also deployed, so if an attack cannot be easily identified as malicious, the bandwidth available to that connection is severely limited to nothing more than a trickle rather than a full flow. Years ago, ISP’s used traffic shaping (also called “policers”) as an effective means of stopping applications such as BearShare, eDonkey, Napster, and other P2P based sharing systems from functioning correctly - essentially reducing the “appeal” of distributing and seeding illegal downloads. This was essentially the ISP’s way of saying “stop what you are doing please” without actually pulling the plug. These days, DDoS attacks are designed to overwhelm - not assume control of - webservers and other public facing components. It’s rare for small entities to be attacked unless there is some form of political agenda driven by your site or product. A classic example is governmental institutions or lawmakers who effectively are classed as “enforcers” and those who disagree are effectively making a statement in the form of Denial of Service. DDoS protection is effectively the responsibility of the hosting provider, but you shouldn’t just assume that they will protect you or your site. Their responsibility stops at their infrastructure, so it’s then up to you too decide how you full the gap in between your host and the website. Typically, you’d leverage something like Imunify360 which you can get for Plesk (and something I’d strongly recommend) but it’s not free, and is a paid (not expensive per month) subscription. If you want to use VirtualMin then there are a variety of tools readily available out of the box such as firewalls and fail2ban.
  • 4 Votes
    10 Posts
    831 Views
    @phenomlab thanks for sharing, after four or five months I will migrate to DO 2 or 4gb RAM droplet.
  • 14 Votes
    65 Posts
    7k Views
    @crazycells huh. Thanks. Will need to check that as well.
  • 11 Votes
    26 Posts
    2k Views
    i think we can mark this discussion as solved learned how to install virtualmin with NGINX We can easily point the DNS by mentioning server IP at CF a name record learned how to install SSL
  • Email issue (virturalmin)

    Solved Hosting 10 Oct 2021, 21:00
    0 Votes
    5 Posts
    469 Views
    @gotwf said in Email issue (virturalmin): @jac Typically you want your domain’s MX records to point to FQDN server name, e.g. foo.example.eg % drill stockportcounty.fans mx ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 63911 ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; stockportcounty.fans. IN MX ;; ANSWER SECTION: stockportcounty.fans. 600 IN MX 10 stockportcounty.fans. Yours do not. Although a bit more drillin’ and reverse lookup indicates thusly; % drill stockportcounty.fans ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 160 ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; stockportcounty.fans. IN A ;; ANSWER SECTION: stockportcounty.fans. 600 IN A 65.108.63.35 ;; AUTHORITY SECTION: ;; ADDITIONAL SECTION: ;; Query time: 127 msec ;; SERVER: 204.8.232.207 ;; WHEN: Sun Oct 10 19:37:02 2021 ;; MSG SIZE rcvd: 54 <kvg@loon:~>% drill -x 65.108.63.35 ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 57802 ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; 35.63.108.65.in-addr.arpa. IN PTR ;; ANSWER SECTION: 35.63.108.65.in-addr.arpa. 86400 IN PTR vps.stockportcounty.fans. I think you probably want your mx record to point to vps.stockportcountry.fans. It is important for forward and reverse lookups for MX records jive. Maybe you are looking like a spammer in that they do not? Edit: But at least you have a reverse record, many spammers do not, so that is a big red flag. Thanks for the advice, will look into it all later once back home.
  • Digitalocean Ubuntu configuration

    Solved Linux 9 Oct 2021, 13:15
    12 Votes
    33 Posts
    3k Views
    @phenomlab thank you! not me
  • 0 Votes
    5 Posts
    1k Views
    @Ash3T I’m going to mark this post as solved as I’ve not heard from you in a while. Let me know if this isn’t the case and you need more help.