When a SSL certificate fails to be generated - add these warnings

[shoulders]

SYSTEM INFORMATION
OS type and version	Ubuntu Linux 22.04.5
Usermin version	2.102
Virtualmin version	7.20.2 Pro
Theme version	21.20.7
Apache version	2.4.52
Package updates	8 package updates are available

background

I imported a website from a cpanel account, though the source could be anywhere or even a fresh website.

the issue

I tried unsuccessfully to get my SSL certificate generated and I could not figure out why.

When I did figure it out it was caused by 2 reasons:

• the DNS change had not propagated completely across the internet
• I had the following code in the .htaccess

  <IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
  </IfModule>

the DNS propagation issue is obvious and the htaccess code was causing the http requests for the lets encrypt connection to be upgraded to a HTTPS connection however this would not work becasue the cert was self signed and invalid.

proposed solution

• Maybe popup a message outlining these potential issues above is the get cert fails.
• This message might only show if the cert is self signed or the cert currently present is expired.

Manage Web Server --> Setup SSL Certificates --> Let's Encrypt

[iliajie]

Manage Web Server --> Setup SSL Certificates --> Let's Encrypt

Don’t we already display that under the "Setup SSL Certificates —> Let's Encrypt" tab? I distinctly remember fixing it, so the full error message should be shown there already...

[shoulders]

I do get the letsencypt error message but these 2 particular errors that would not get directly flagged up could be the cause of a lot of errors, we'll for noobies and me.

The letsencypt error message, for the error with htaccess, showed my IP and Https and a fail message. I can't remember what it said but I don't remember it saying that the cert was expired and because of that it failed. However I could be wrong.

My feature request was really for a prompt in certain circumstances to educate the user and have them check propagation and the presence of dodgy htaccess rules.

[jcameron]

Having a self-signed cert isn't itself bad, as long as there's no unilateral redirect to HTTPS. When Virtualmin sets up that redirect it excludes Let's Encrypt validation requests for this exact reason .... but we can't do that in all cases, like where there's a migrated or manually created .htaccess file.