Bench setup lets-encrypt failed 2018.01.09

revant_one · January 10, 2018, 4:59pm

Fixes to bench setup lets-encrypt command

opened 11:53AM - 12 Jan 18 UTC

closed 09:00AM - 20 Jan 18 UTC

Related posts: https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-…sni-01-and-shared-hosting-infrastructure/49996 https://community.letsencrypt.org/t/help-test-certbot-apache-and-nginx-fixes-for-tls-sni-01-outage/50207 Steps done manually (must be part of command `bench setup lets-encrypt`) - Added lines to nginx.conf under site's server block listening to port 80 ``` location '/.well-known/acme-challenge' { default_type "text/plain"; root /tmp/acme-challenge-public/; } ``` example in frappe's context: ``` # http to https redirect server { listen 80; server_name <sitename> ; #return 301 https://$host$request_uri; # commenting redirect ### new lines ### location '/.well-known/acme-challenge' { default_type "text/plain"; root /tmp/acme-challenge-public/; } ### new lines ### } ``` - reload nginx - Add directory `/tmp/acme-challenge-public` and set owner `sudo chown -R root:root /tmp/acme-challenge-public` - run certbot Use this command for testing on staging server for development / testing https://letsencrypt.org/docs/rate-limits/ ``` sudo /opt/certbot-auto --verbose --staging --break-my-certs certonly -d <sitename> --webroot -w /tmp/acme-challenge-public/ ``` for production ``` sudo /opt/certbot-auto --verbose certonly -d <sitename> --webroot -w /tmp/acme-challenge-public/ ```

clarkej · January 14, 2018, 3:23am

Latest let-encrypt error - January 10, 2018 02:16 UTC[Investigating] The tls-sni challenge has been disabled due to strong credibility of a vulnerability report - #10 by lasalesi