OPNsense Forum

Archive => 18.1 Legacy Series => Topic started by: elektroinside on February 02, 2018, 01:16:14 pm

Title: 18.1.1 & acme client
Post by: elektroinside on February 02, 2018, 01:16:14 pm: Think this was fixed, was it a patch that fixed it?

[Fri Feb 2 14:10:45 EET 2018] original='{
"type": "urn:acme:error:malformed",
"detail": "Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]",
"status": 400
}'
Title: Re: 18.1.1 & acme client
Post by: franco on February 02, 2018, 01:20:59 pm: Still not quite, have to ask Frank on the status... acme.sh was updated, but did not fix this (expectations that it would were not clear anyway at least that is what one user reported testing it).

Cheers,
Franco
Title: Re: 18.1.1 & acme client
Post by: elektroinside on February 02, 2018, 01:24:00 pm: Okay Franco,

Thank you!
Title: Re: 18.1.1 & acme client
Post by: bigops on February 02, 2018, 04:47:45 pm: I have always found the ACME client to be a pain to use especially when you have to renew a certificate and you are using the DNS validation. ZeroSSL is much more easier to use and then to import the certificate.
Title: Re: 18.1.1 & acme client
Post by: fraenki on February 02, 2018, 10:23:34 pm: Quote from: elektroinside on February 02, 2018, 01:16:14 pm
Think this was fixed, was it a patch that fixed it?

[Fri Feb 2 14:10:45 EET 2018] original='{
"type": "urn:acme:error:malformed",
"detail": "Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf]",
"status": 400
}'

I've been pretty sure that acme.sh 2.7.5 would fix this error:
https://github.com/opnsense/plugins/issues/470

Apparently I was wrong. It will not be fixed until acme.sh 2.7.6 is released. I'll reopen this issue.

Regards
- Frank
Title: Re: 18.1.1 & acme client
Post by: elektroinside on February 02, 2018, 11:32:58 pm: No worries :)

Thank you.
Title: Re: 18.1.1 & acme client
Post by: eshield on February 03, 2018, 01:50:47 pm: Hello,

Some additional info to 400 tos error:
Quote
PHP Warning: cert_action_validator(): Node no longer exists in
/usr/local/opnsense/scripts/OPNsense/AcmeClient/certhelper.php on line 122
PHP Warning: cert_action_validator(): Node no longer exists in /usr/local/opnsense/scripts/OPNsense/AcmeClient/certhelper.php on line 122
Crash always happens after cert issue attempt.
Title: Re: 18.1.1 & acme client
Post by: franco on February 03, 2018, 03:41:18 pm: It's a cosmetic PHP issue since 7.0, ticket here....

https://github.com/opnsense/plugins/issues/333

Cheers,
Franco
Title: Re: 18.1.1 & acme client
Post by: elektroinside on February 11, 2018, 09:34:21 pm: I had enough of that agreement error so I "hacked" acme.sh to take the correct one.
I also needed to comment a validation because of a freak error, but it worked... got a new cert.
Title: Re: 18.1.1 & acme client
Post by: eshield on February 12, 2018, 03:01:08 pm: acme.sh 2.7.6 has been released 3 days ago, any ETA on LE package update?

Thanks.
Title: Re: 18.1.1 & acme client
Post by: franco on February 12, 2018, 03:36:13 pm: As soon as it hits FreeBSD as it is tested as it is shipped in OPNsense. :)

Cheers,
Franco
Title: Re: 18.1.1 & acme client
Post by: eshield on February 12, 2018, 03:42:58 pm: ouch! well, updated acme.sh by myself and everything works fine :o
Title: Re: 18.1.1 & acme client
Post by: franco on February 12, 2018, 03:49:19 pm: Nice! Will you share your solution with everyone? :)
Title: Re: 18.1.1 & acme client
Post by: eshield on February 12, 2018, 04:37:23 pm: Quote from: franco on February 12, 2018, 03:49:19 pm
Nice! Will you share your solution with everyone? :)
There is no special magic involved. I just replaced /usr/local/sbin/acme.sh with a new one and set permissions to 0555 using WinSCP :o
Title: Re: 18.1.1 & acme client
Post by: elektroinside on February 14, 2018, 10:28:56 am: Confirming it works (replacing with the new one) :)
No other hacks, just chmod 0555

FYI, without 0555, it will fail to validate this:

Code: [Select]
if [ ! -f "$CERT_KEY_PATH" ] || [ "$_key_length" != "$_key" ] || [ "$Le_ForceNewDomainKey" = "1" ]; then if ! createDomainKey "$_main_domain" "$_key_length"; then _err "Create domain key error." _clearup _on_issue_err "$_post_hook" return 1 fi fi
Title: Re: 18.1.1 & acme client
Post by: dcol on February 14, 2018, 10:12:29 pm: So it's a permissions issue.

I would like to see someone (hint! hint!) write up a nice tutorial on using the acme client plugin to create certs.
Title: Re: 18.1.1 & acme client
Post by: TheWebWasher on February 15, 2018, 09:00:27 am: Does anybody know when the update for acme 2.6.7 (ETA on LE package) is coming ??
Title: Re: 18.1.1 & acme client
Post by: TheWebWasher on February 15, 2018, 09:12:47 am: Sorry 2.7.6 of course
Title: Re: 18.1.1 & acme client
Post by: franco on February 15, 2018, 10:03:14 am: I will ping the FreeBSD maintainer.
Title: Re: 18.1.1 & acme client
Post by: franco on February 16, 2018, 07:24:06 am: https://bsd.network/@dvl/99531493305337397
Title: Re: 18.1.1 & acme client
Post by: elektroinside on February 16, 2018, 08:10:13 am: Nice :) Thanks, Franco!
Title: Re: 18.1.1 & acme client
Post by: TheWebWasher on February 16, 2018, 09:49:45 am: Thanks Franco, how can we update the acme package ??
Title: Re: 18.1.1 & acme client
Post by: franco on February 16, 2018, 07:50:38 pm: # opnsense-code tools ports
# cd /usr/ports/sysutils/acme.sh
# make
# make deinstall
# make install

Will also be in 18.1.3, but that takes two more weeks.

Cheers,
Franco
Title: Re: 18.1.1 & acme client
Post by: TheWebWasher on February 16, 2018, 08:53:44 pm: Thank you, it works! In your description is a mistake

The correct directory is:

# cd /usr/ports/security/acme.sh

I am very exicited about the quick answers here. Thank you at all people !!
Title: Re: 18.1.1 & acme client
Post by: dcol on February 24, 2018, 08:31:00 pm: Can't get a cert issued. Log shows 'Create domain key error'
I can see the key file was created.

What am I doing wrong?
Title: Re: 18.1.1 & acme client
Post by: eshield on February 25, 2018, 01:40:12 pm: Quote from: dcol on February 24, 2018, 08:31:00 pm
Can't get a cert issued. Log shows 'Create domain key error'
I can see the key file was created.

What am I doing wrong?
Well, um, bro, update your acme.sh script or wait for 8.1.3 in a week or so 8) How to? :o This has been answered few times some posts above :-\
Title: Re: 18.1.1 & acme client
Post by: dcol on February 25, 2018, 06:21:19 pm: acme.sh was updated. This is not the reason.
Title: Re: 18.1.1 & acme client
Post by: BeNe on February 25, 2018, 06:49:32 pm: Quote
acme.sh was updated. This is not the reason.
Still Create domain key error ?

I did what franco posted:
Code: [Select]
# opnsense-code tools ports # cd /usr/ports/sysutils/acme.sh # make # make deinstall # make installAfter that i deleted the certificated that are in a failed status und created them successfully again.
Title: Re: 18.1.1 & acme client
Post by: eshield on February 26, 2018, 10:57:19 am: Quote from: dcol on February 25, 2018, 06:21:19 pm
acme.sh was updated. This is not the reason.
Well, there is very only thing left: Your validation method fails. Personally, I always used a non-standard port for GUI so a HTTP-01 method never worked for me. I use DNS-01 with Hurricane Electric. I've configured DigitalOcean 2 droplets in a week and both works with DNS-01 challenge and doesn't validate with HTTP-01.