search

antevens / letsencrypt-freeipa

Scripts to automate installation, configuration and renewal of LetsEncrypt certificates on FreeIPA Servers.
MIT License
59 stars 17 forks source link

'ipa-server-certinstall -w -d fullchain.pem privkey.pem' throwing error #21

Open toxynoid opened 3 years ago

toxynoid commented 3 years ago

With ipa-server-certinstall -w -d fullchain.pem privkey.pem I've got following error The full certificate chain is not present in fullchain.pem, privkey.pem I instead had success with ipa-server-certinstall -w -d cert.pem privkey.pem I'm not sure if my fullchain.pem is broken or if there have been recent changes in certbot.

antevens commented 3 years ago

This is due to the recent changes in the intermediate authority and the change to using their own root cert, thx for the bug report.

dilruacs commented 3 years ago

Thank you for acknowledging the problem, but how do we solve this?

antevens commented 3 years ago

The workaround is posted above, just use the cert instead of the chain.

dilruacs commented 3 years ago

Thank you, sorry for not reading the report good enough :blush:

Edit to add: I am running renew.sh from cron, I suppose this needs to be changed also.

grossws commented 3 years ago

Workaround from issue itself didn't work for me.

From what I found new Let's Encrypt cert are signed with CN=R3 but chain.pem/fullchain.pem in my case containded only CN=X3 intermediate cert.

When I update with privkey.pem cert.pem lets-encrypt-r3.pem all seems ok.

UPD: I had to add dst-root-x3 root ca since I had le-r3 signed with that CA.