search

uboslinux / ubos-admin

UBOS administration tools
Other
15 stars 3 forks source link

More defensive code for letsencrypt #899

Open jernst opened 6 months ago

jernst commented 6 months ago

Under some unclear circumstances we get this:

ERROR: Cannot read LetsEncrypt live (1) key and crt file: <undef> <undef>
Use of uninitialized value $keyFile in concatenation (.) or string at /usr/share/perl5/vendor_perl/UBOS/Roles/apache2.pm line 286.
Use of uninitialized value $crtFile in concatenation (.) or string at /usr/share/perl5/vendor_perl/UBOS/Roles/apache2.pm line 286.
ER

It may or may not have something to do with a suddenly-inactive LetsEncrypt account. But the result is that the apache config has an invalid syntax (no value for the key/cert files) and we should not end up there regardless.

jernst commented 6 months ago

This apparently happens when the symlinks in /etc/letsencrypt/live/<domain>/ point to non-existing files.

lrwxrwxrwx 1 root root   40 May  6 22:53 cert.pem -> ../../archive/<domain>/cert7.pem
lrwxrwxrwx 1 root root   41 May  6 22:53 chain.pem -> ../../archive/<domain>/chain7.pem
lrwxrwxrwx 1 root root   45 May  6 22:53 fullchain.pem -> ../../archive/<domain>/fullchain7.pem
lrwxrwxrwx 1 root root   43 May  6 22:54 privkey.pem -> ../../archive/<domain>/privkey7.pem

Index 7 in those destination files apparently correspond to the 7th generation of the cert for this domain, and if there is no 7th generation there (because it ends at 6, for example), things end up badly. Why it would end up at 6, as it did in my case just now, I don't know, so it's not obvious how to fix it either ...