SSL certificate generation fails due to renewal, but CLI thinks everything is okay and continues

[kirrg001]

I ran into the following situation.

I was prompted for ssl certificate generation and hitted "yes"

? Enter your email (used for SSL certificate generation) kate@ghost.org
Running sudo command: service nginx restart
Certificate not due for renewal yet, skipping
? Ghost-CLI would like to generate a ssl parameters file. Yes, write config file

But a warning popped up Certificate not due for renewal yet, skipping.
The CLI continued with trying to generate the certificate and then it prompted me for ssl parameter file generation, i hitted yes (i knew this is going to fail).

Then i ran into:

Job for nginx.service failed because the control process exited with error code. See "systemctl status nginx.service" and "journalctl -xe" for details.
✖ Setting up ssl
A ProcessError occured.
Error occurred running command: '/bin/sh -c sudo service nginx restart'

I had to manually delete the ssl setup from my nginx config and restart Ghost.
This was caused by a rate limit from Letsencrypt.

What's weird here is that the CLI continues trying to generate my ssl certificate and then it prompts me for ssl parameter generation, but the ssl certificate was never created.

[acburdine]

I mean technically if the certificate already exists, then the setup should still work. Gonna update the error handling to not output the "renewal" line though - might be confusing.

[mathewtrivett]

Hello Ghost team. I'm having issues with this. I ran a failed install (bad mysql settings) but it got to generate a cert. I deleted the ghost instance then tried to run the installer again and keep failing on ssl params file.

What is the best fix to delete the cert and regenerate with ghost? Actually think I might have hit the letsencrypt rate limit

[acburdine]

@mathewtrivett there's some fixes in master that should be able to help - there will be a new version of the CLI released today so you should be able to get the fixes in a bit.

[mathewtrivett]

Grand, well i'll get it setup without SSL for now. Download the new CLI in 5 days or so and run the setup-ssl program. :) And sorry to jump into pull request comments, just wasn't sure where to put it.