Lets Encrypt - Failure to Remove Old Certs & Re-Encryption Hangs

[MattyLB]

In EE 3.4.0 when I delete a site that had --le, the script is not removing the old cert directories for the site from the /etc/letsencrypt/...archive|live|renewal folders. This causes --le encryption to hang after answering "yes" if we try to recreate the site with --le.

After removing the site.com folders from the 3 folders mentioned above, there is still something holding up the re-installation of --le for the site because the new error message is:

Unable to setup, Let's Encrypt
Please make sure that your site is pointed to
same server on which you are running Let's Encrypt Client
to allow it to verify the site automatically.

I've already pinged both www & non-www versions of my site to make sure they're directing to the correct server, so this isn't the issue. I've also ran a "ee clean --all" and rebooted the server. Same error.

[MattyLB]

On another note - when trying to open my site in a browser, I get a certificate warning that my site is trying to use the certificate of another --letsencrypt site on my server. This can't be good.

[iam404]

EE cannot delete certificate as it is a third-party assets. Also lets encrypt has limit on issuing certificates per domain or IP.

Using preexisting certificates with EE will be made possible with release of EE v3.4.1.

After removing the site.com folders from the 3 folders mentioned above, there is still something holding up the re-installation of --le for the site because the new error message is:

Please check log tail -n100 /var/log/ee/ee.log

I get a certificate warning that my site is trying to use the certificate of another --letsencrypt site on my server.

Look like issue is with lets encrypt cert authority.

[MattyLB]

I agree and I'll check with them. Thank you

On Sunday, January 17, 2016, Prabuddha Chakraborty notifications@github.com
wrote:

EE cannot delete certificate as it is a third-party assets. Also lets
encrypt has limit on issuing certificates per domain or IP.

Using preexisting certificates with EE will be made possible with release
of EE v3.4.1.

After removing the site.com folders from the 3 folders mentioned above,
there is still something holding up the re-installation of --le for the
site because the new error message is:

Please check log tail -n100 /var/log/ee/ee.log

I get a certificate warning that my site is trying to use the certificate
of another --letsencrypt site on my server.

Look like issue is with lets encrypt cert authority.

—
Reply to this email directly or view it on GitHub
#665 (comment)
.

[MattyLB]

Found this recent update on the LetsEncrypt github repository #2227 that may resolve this issue on servers where a --le enabled site was removed, then recreated and --le failed on second attempt.

NOTE: as I suspected, I created a new EC2 instance with a fresh EE 3.4.0 install and had no problem adding --letsencrypt to the site I was having problems with on the previous 2 EE 3.4.0-enabled servers.

This leads me to conclude that something is not being removed from an EE config or folder when we delete a site that has --le enabled (without using the --letsencrypt=off) command - which causes hangups when we try to recreate the site with --le on the same server.

If it's not something in the EE script causing this, possibly it is due to issue #2227 mentioned above.

• doing my part to help make EE better, sorry if it sounds like I'm complaining because I'm not. HUGE EE FAN HERE -

[MattyLB]

OK - there are some other major issues with --letsencrypt and this time it has to do with adding --hhvm=on to a site that had SSL enabled. I went into site info and found that SSL had been disabled after adding HHVM. I didn't get a warning that this would happen, so if it's a known conflict, this should be part of the warning message for adding HHVM

And - after removing HHVM from the site, I am no longer able to add --letsencrypt to the site.

Something is most definitely conflicting here. I'll give you access to this server if you wish to check further, however I believe I've lined out the steps to reproduce these issues on your own servers in several messages on this thread.

Let me know if you want access to my server if you can't reproduce. It's UBUNTU 14.04

[mrmad]

Can confirm the issue involving hhvm. Thought I was the only one.

[MattyLB]

I've been following the LetsEncrypt group on github and it appears there
are some major changes needed in regards to the packages it installs on our
servers, kernel headers and other invasive issues that they need to address.

This may lead to redundant work on EE's part if you rework your python
scripts to accommodate issues with theirs. Maybe the best approach is to
leave this issue open, let it be known and hope it gets resolved by the LE
team.

Just a thought.

On Tuesday, January 19, 2016, mrmad notifications@github.com wrote:

Can confirm the issue involving hhvm. Thought I was the only one.

—
Reply to this email directly or view it on GitHub
#665 (comment)
.