I had the same problem...
You don't have to renew Certificate with "renew" option. You have to run the same command you ran for Certificate creation.
It detects your Certificate needs renew, and it will ask you the new DNS record "_acme-challenge" modification. You must change record as it will tell you, and continue and Voila: Certificate will renew next ...
After successfully running Lets Encrypt for example.com, the latest certificate files can be found in the following location:
cert.pem: The private certificate for your domain
You can use the JkUnMount directive to prevent a directory from being handled by Tomcat. You can let the acme challenge directory be handled by Apache.
The configuration for that might look like:
JkUnMount /.well-known/acme-challenge/* *
The final * should unmount it from all configured workers. If you want to exclude that directory for just one of ...
/etc/letsencrypt/live/domain.com/privkey.pem (Private Key)
You are looking for file like cert.crt, actually letsencrypt uses cert.pem for your certificate and privkey.pem for private key.
So they always use .pem extension which can be confusing.
Your normal site running on port 443 is using the SSL you've installed but you haven't installed the same certification for your second site (Webmin running on port 10000). So your site is using a self-certified SSL, which isn't bad because you can trust it, because it's yours.
Safely ignore it as it poses no security risk to you or your sites.
Just to get the order of things right. Can I just move everything to a .wordpress.org blog - test it - then just buy their hosting and change my DNS and my new site is ready? Or do I have to move straight to a say WordPress custom domain site?
To clarify: WordPress.com is the managed hosting and that seems to be what you refer to above. WordPress.org ...
I have managed to resolve the issue.
When you first see the 'Internet Security Warning', select 'View Certificate'.
What you then need to do, is identify who the Certificate has been issued to. Refer to the below image, for where to find this information. Once you have identified the location, copy the entry exactly as is.
how can this work when it takes so long for the changes to propagate?
The propagation time (“up to 48 hours for the changes to be known world wide”) is a conservative estimate of the time that various DNS servers around the world may have records for your domain stored in their internal cache. However, when carrying out its DNS validation (as per the ACME ...
You can create a self-signed certificate on the server, and use that with CF's Full, but not Full (strict) SSL setting. I don't know if you'd have to create a new self-signed certificate each time the IP changes though.
Okay, after many headscratching I figured it out. In my renewal conf I stated to stop apache... thus my site was down and let's encrypt was not able to connect hence the error.
Underneath the correct settings I can use to renew my certificate using webroot method (instead of apache plugin using tls-sni-01 which somehow does not function).
The Acme Challenge protocol that the LetsEncrypt bot uses will happily follow redirects. There is no need to reverse proxy the requests to another machine, you can simply redirect those requests there.
I would first create a specific redirect for the challenge and then redirect everything else to HTTPS:
For want of a better solution, and to get this working, I've ended up creating multiple sets of the codebase onto 'fake' domains and pointing a number of the aliases toward each one.
If anyone has a better approach I'd still be very interested to hear about it, and change the accepted answer.
Per https://letsencrypt.org/docs/integration-guide/ :
Let’s Encrypt accepts RSA keys from 2048 to 4096 bits in length, and P-256 and P-384 ECDSA keys. That’s true for both account keys and certificate keys. You can’t reuse an account key as a certificate key.
So you can have EC-based certificates, but note that they will for now still be signed by a RSA-...
The source of the file (at https://github.com/certbot/certbot/blob/master/certbot-auto like Stephen wrote)
Download and run the latest release version of the Certbot client.
certbot-auto is a wrapper around certbot, as explained later in comments:
USAGE="Usage: $BASENAME [OPTIONS] A self-updating wrapper script for
the Certbot ACME ...
Update: My experience was weird and defied all expectations.
I was checking the certificate that was being served right up until about 10 seconds before the expiration date, using a variety of applications and devices (curl, Firefox, Safari, Chrome, an iOS app). All of them indicated that certificate expiry was imminent.
But when I checked again, the ...
Install ssfhs or a FUSE (filesystem in user space) type of tool that allows you to mount remote file systems via SSH. You can use sshfs-win for Windows or possibly FUSE for macOS but I did this on Windows.
Open your Managed WordPress dashboard and locate your SSL credentials:
Open a command terminal on your local computer and execute the following command ...
You have multiple questions in one.
Let's Encrypt Rate Limiting
For the rate limiting part it just means that you already asked Let's Encrypt too often for the same thing.
When you say "When I tried to add SSL to the hosting domain" what did you do exactly?
As the error message says, you can not have more than 20 certificates to be issued per registered ...
Is there any reason to prefer one option over the other?
Assuming the use of Let's Encrypt and that each certificate lists just the www and non-www versions of a single domain, the only likely drawback to using a SAN certificate is the possibility of some compatibility issues with older browsers, mostly prior to 2003.
On the positive side, there would be ...
You would just need to order the one cert for example.com. The www is part of it or included by default. If you wanted other sub-domains, ie server.example.com, then you would either need a wildcard domain cert [*.example.com] or order two to cover the extra domain. Hope this helps answer your question.