-
|
Using XCA, handler has been copied per https://github.com/grindsa/acme2certifier/blob/master/docs/xca.md#configuration. Running this command on the server requesting the cert: Even tried appending (Names used are the internal names.) (Apache) |
Beta Was this translation helpful? Give feedback.
Replies: 5 comments 9 replies
-
|
Please enable debugging in by setting Attaching logs/console output from certbot would also be helpful. Thx G. |
Beta Was this translation helpful? Give feedback.
-
|
It's probably relevant to note I'm using OpenSSL 1.1.1h and Certbot 1.3.0. Of course, both are a number of years old. I'd update them, but that'd require an OS upgrade. acme.sh is an option, but if this turns out to be an OpenSSL issue (or some other system package) then I guess I'll have to tackle the OS first. For certbot, it's really just Looking at the certifier logs, I noticed it complained about not finding the handler. My mistake, I merely copied the file without renaming it. Corrected that; however, same error from What stands out to me is (Contents below somewhat redacted.) |
Beta Was this translation helpful? Give feedback.
-
|
I realized the upgrade wouldn't be so bad, so I went ahead and did it (since it needed to be done anyway). Now I'm getting a "ContextualVersionConflict" error from certbot. I'll have to address that separately before I can go any farther. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, thank you for sharing the logs. Your original problem is not related to the key-lengh. You rather got trapped in a kind of Certbot dependency hell. See here and here for further information. So when updating certbot please make sure that pyOpenSSL and cryptography modules get updated accordingly. Another option would be to use an alternate acme-client like lego for testing. HTH |
Beta Was this translation helpful? Give feedback.
-
|
I decided to go with acme.sh as that's pure bash, and installing/updating packages on this "appliance" is difficult.
Returns "Order status is 'processing', let's sleep and retry.", waits 600 seconds and repeats. |
Beta Was this translation helpful? Give feedback.
-
|
Hi, the processing loop indicates an issue with the handler configuration. Can you please share the logs again? Thanks... |
Beta Was this translation helpful? Give feedback.
-
|
I believe I found the culprit: Looks like it's pulling a traditional system environment variable. How do you recommend the variable be set? |
Beta Was this translation helpful? Give feedback.
-
|
So I decided to skip environment variables until I can get this working. Set Debug is still on yet that's all it gives, "unable to open database file". Using the following as a reference: Running interactively as root works fine. import sqlite3
con = sqlite3.connect("/path/to/db.xdb")
cur = con.cursor()
cur.execute("SELECT * FROM view_requests")Which lead me to wonder if the handler was running as root. I'm not familiar at all with Apache web applications, a quick Google of "apache wsgi user account" made me realize it's running as |
Beta Was this translation helpful? Give feedback.
-
|
I am using the feature to pass env variables in containerized environments as it allows me to pass configuration parameters during instantiation process. Not sure if there is a similar mechanism on a legacy bm or VM installation. Let me check... |
Beta Was this translation helpful? Give feedback.
-
|
Some feedback on my experience...
|
Beta Was this translation helpful? Give feedback.
-
|
thank you for your feedback. Your proposals make absolute sense. Let me work on it. |
Beta Was this translation helpful? Give feedback.
-
|
Quick question as for your item #2. Are you referring to the XCA database or to the a2c database? as for item #1. This is rather an acme-sh issue, but I have an idea how to improve it. Improvements for #3, #4 are included in my local development branch. If you want to test let me know. |
Beta Was this translation helpful? Give feedback.
-
|
Yes, sorry, # 2 I was referring to the XCA database. Sweet, I'll test those out soon. |
Beta Was this translation helpful? Give feedback.
-
|
All changes have been included in the devel branch. For item 2, the implementation has been updated: a2c now checks the CA-handler configuration when querying the directory resource. If it encounters a problem, it will throw a 403 error instead of allowing the client to continue further. changes are included in examples/ca_handler/xca_handler.py and acme_srv/directory.py only. It should be sufficient to replace the existing versions with the ones from the devel branch. Please let me know if this works for you. Feedback is always welcome. |
Beta Was this translation helpful? Give feedback.
So I decided to skip environment variables until I can get this working. Set
passphraseinstead, eliminated special characters (because I was unsure how to escape them). DB path is owned, recursively, by root, and 640 set on the DB itself. The path is correct and can be enumerated by root.