renew ssl certificate for iddev #9530

New issue

Closed

opened 2020-12-14 10:37:04 +00:00 by suanand · 6 comments

suanand commented

2020-12-14 10:37:04 +00:00

Describe what you would like us to do:

Kindly renew SSL certificate at iddev.fedorainfracloud.org

Exception: HTTPSConnectionPool(host='iddev.fedorainfracloud.org', port=443): Max retries exceeded with url: /openidc/Token (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1122)')))

When do you need this to be done by? (YYYY/MM/DD)

2020/12/31

# Describe what you would like us to do: ---- Kindly renew SSL certificate at **iddev.fedorainfracloud.org** ``` Exception: HTTPSConnectionPool(host='iddev.fedorainfracloud.org', port=443): Max retries exceeded with url: /openidc/Token (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1122)'))) ``` # When do you need this to be done by? (YYYY/MM/DD) ---- 2020/12/31

smooge commented

2020-12-14 12:28:42 +00:00

We only give power/ping to this system. I don't see that we set up letsencrypt for the server so it was done by the admins of the box.

What I have done:
0. Checked playbooks to see if iddev was using certgetter for certs. (No)

Checked certgetter01 just in case the certs were there.
logged into iddev to see what was going on.
run yum update (this does not seem to have been done in a long time)
ran systemctl status certbot-renew.service

This gave the error

-- Subject: Unit certbot-renew.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
-- 
-- Unit certbot-renew.service has begun starting up.
Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Saving debug log to /var/log/letsencrypt/letsencrypt.log
Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Processing /etc/letsencrypt/renewal/iddev.fedorainfracloud.org.conf
Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Cert is due for renewal, auto-renewing...
Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Plugins selected: Authenticator standalone, Installer None
Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: Renewing an existing certificate
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: Performing the following challenges:
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: http-01 challenge for iddev.fedorainfracloud.org
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: Cleaning up challenges
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: Attempting to renew cert (iddev.fedorainfracloud.org) from /etc/letsencrypt/renewal/iddev.fedorainfracloud.org.conf produced an une
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: All renewal attempts failed. The following certs could not be renewed:
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: /etc/letsencrypt/live/iddev.fedorainfracloud.org/fullchain.pem (failure)

Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: All renewal attempts failed. The following certs could not be renewed:
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: /etc/letsencrypt/live/iddev.fedorainfracloud.org/fullchain.pem (failure)
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: 1 renew failure(s), 0 parse failure(s)
Dec 14 12:17:15 iddev.fedorainfracloud.org systemd[1]: certbot-renew.service: main process exited, code=exited, status=1/FAILURE
Dec 14 12:17:15 iddev.fedorainfracloud.org systemd[1]: Failed to start This service automatically renews any certbot certificates found.

We only give power/ping to this system. I don't see that we set up letsencrypt for the server so it was done by the admins of the box. What I have done: 0. Checked playbooks to see if iddev was using certgetter for certs. (No) 1. Checked certgetter01 just in case the certs were there. 2. logged into iddev to see what was going on. 3. run yum update (this does not seem to have been done in a long time) 4. ran ```systemctl status certbot-renew.service``` This gave the error ``` -- Subject: Unit certbot-renew.service has begun start-up -- Defined-By: systemd -- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel -- -- Unit certbot-renew.service has begun starting up. Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Saving debug log to /var/log/letsencrypt/letsencrypt.log Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Processing /etc/letsencrypt/renewal/iddev.fedorainfracloud.org.conf Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Cert is due for renewal, auto-renewing... Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Plugins selected: Authenticator standalone, Installer None Dec 14 12:17:14 iddev.fedorainfracloud.org certbot[21399]: Starting new HTTPS connection (1): acme-v02.api.letsencrypt.org Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: Renewing an existing certificate Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: Performing the following challenges: Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: http-01 challenge for iddev.fedorainfracloud.org Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: Cleaning up challenges Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: Attempting to renew cert (iddev.fedorainfracloud.org) from /etc/letsencrypt/renewal/iddev.fedorainfracloud.org.conf produced an une Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: All renewal attempts failed. The following certs could not be renewed: Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: /etc/letsencrypt/live/iddev.fedorainfracloud.org/fullchain.pem (failure) ``` Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: All renewal attempts failed. The following certs could not be renewed: Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: /etc/letsencrypt/live/iddev.fedorainfracloud.org/fullchain.pem (failure) Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Dec 14 12:17:15 iddev.fedorainfracloud.org certbot[21399]: 1 renew failure(s), 0 parse failure(s) Dec 14 12:17:15 iddev.fedorainfracloud.org systemd[1]: certbot-renew.service: main process exited, code=exited, status=1/FAILURE Dec 14 12:17:15 iddev.fedorainfracloud.org systemd[1]: Failed to start This service automatically renews any certbot certificates found. ```

smooge commented

2020-12-14 12:28:43 +00:00

Metadata Update from @smooge:

Issue assigned to smooge
Issue tagged with: cloud, low-gain, medium-trouble, ops

**Metadata Update from @smooge**: - Issue assigned to smooge - Issue tagged with: cloud, low-gain, medium-trouble, ops

smooge commented

2020-12-14 12:30:50 +00:00

I found that I needed to stop apache

[root@iddev ~][PROD]# systemctl stop httpd
[root@iddev ~][PROD]# /usr/bin/certbot renew --noninteractive --no-random-sleep-on-renew --force-renewal --standalone

and this updated the certs. I have restarted apache. I believe that the scripts for certbot have updated and the system owner will need to make changes in their configurations.

I found that I needed to stop apache ``` [root@iddev ~][PROD]# systemctl stop httpd [root@iddev ~][PROD]# /usr/bin/certbot renew --noninteractive --no-random-sleep-on-renew --force-renewal --standalone ``` and this updated the certs. I have restarted apache. I believe that the scripts for certbot have updated and the system owner will need to make changes in their configurations.

smooge commented

2020-12-14 12:30:50 +00:00

Metadata Update from @smooge: