In Progress [CPANEL-33077] Letsencrypt transition to ISRG’s Root (Important!!!!!)

[mtindor]

@mtindor: CL 7.9, cPanel 98.0.8, yum update done, patches run
@cPRex: switching to Sectigo does not solve the exim problem either (port 465 returning certificate with system hostname as common name and not mail.company.com)

Not sure what to say about that. No issues here with Exim on CL6 ELS.

 

[DHarry]

For those who've run the autofixer manually, did you have to restart your server as well? Or, at least, is that recommended?

 

[cPRex]

There are no server restarts required with any updates to cPanel software.

 

[Misiek]

Not sure what to say about that. No issues here with Exim on CL6 ELS.

The issue exists when you use client domain name as smtp server not the hostname of your server

Sending of the message failed.
Unable to communicate securely with peer: requested domain name does not match the server’s certificate.
The configuration related to mail.domain.pl must be corrected.

 

[hostmycode]

The issue exists when you use client domain name as smtp server not the hostname of your server

Facing the same problem here.


The security certificate for this server is invalid or expired. Therefore, connection to this server is not secure. Do you wish to continue anyway?

 

[mtindor]

The issue exists when you use client domain name as smtp server not the hostname of your server

And I'm saying that I and my clients aren't having any issues using mail.clientdomain1.com, mail.clientdomain2.com or primary.host.name . Exim has all the matching cert info to allow them to connect without any warnings.

 

[mtindor]

Facing the same problem here.


The security certificate for this server is invalid or expired. Therefore, connection to this server is not secure. Do you wish to continue anyway?

Did you read through this whole thread?

 

[cPRex]

There are still some clients experiencing SNI issues. Some aren't. It seems to depend on ratelimiting and exactly how/when/what certs were issued.

We're working on some further tweaks that I'll post about soon.

 

[ciao70]

Hello,

New certs failed with "A rate limit prevents DCV"

I've been using Lets Encrypt certs on this server for years. This morning when the certs were renewed, one of the domains failed to install the new cert with this message Analyzing “tinyislekauai.com”’s DCV results … 9:15:05 AM Trying 1 wildcard domain (*.tinyislekauai.com) to maximize...

community.letsencrypt.org

 

[cPRex]

Update - if users are still experiencing issues with Exim, could those users please open a ticket so we can do some more investigation?

 

[Misiek]

@cPRex Id #94368789 already did 6 hours ago

 

[monarobase]

Seems it was a permission issue on some certs for us fixed with :

find /var/cpanel/ssl/domain_tls/* -type d -not -perm 755 -exec chmod -v 755 {} \;

 

[TFyre]

Seems it was a permission issue on some certs for us fixed with :

find /var/cpanel/ssl/domain_tls/* -type d -not -perm 755 -exec chmod -v 755 {} \;

YES YES YES!!

Thanks, confirmed fixed!!

 

[Misiek]

Seems it was a permission issue on some certs for us fixed with :

find /var/cpanel/ssl/domain_tls/* -type d -not -perm 755 -exec chmod -v 755 {} \;

Yes!!! That did it ! Run permission change and it solved the problem!

 

[cPRex]

While the permissions command does work in some specific situations, I would excercise caution in copy/pasting commands. Specifically, that command could potentially change the permissions of the pending_delete directory, which is not ideal. Something like this would be more effective:

find /var/cpanel/ssl/domain_tls/ -mindepth 1 -maxdepth 1 -name .pending_delete -prune -o  -type d -not -perm 755 -exec chmod -v 755 {} \;

but it's important to note we're still researching all these implications on our side before we provide an official update.

 

[TFyre]

While the permissions command does work in some specific situations, I would excercise caution in copy/pasting commands. Specifically, that command is also changing the permissions of the pending_delete directory, which is not ideal. Something like this would be more effective:

find /var/cpanel/ssl/domain_tls/ -mindepth 1 -maxdepth 1 -name .pending_delete -prune -o  -type d -not -perm 755 -exec chmod -v 755 {} \;

but it's important to note we're still researching all these implications on our side before we provide an official update.

PLEASE tell me you werent sitting on this fix and holding it back the entire day!!!

Changing the permissions back is as easy as find /var/cpanel/ssl/domain_tls/* -type d -not -perm 644 -exec chmod -v 644 {} \;

I looked at the permissions before, change it to 755, ran openssl check, works... changed back to 644, ran openssl, broken... change to 755 again.... AND SUCCESSS!!!

 

[cPRex]

@TFyre - of course not - I'm posting information that is verified as soon as I get it. @monarobase submitted a ticket and was provided that command by our team recently.

 

[cPRex]

Update - our team is pushing out two updates soon. One is a new version of the Let's Encrypt plugin for WHM. The second is a slightly updated autofixer.

We're still investigating the root cause of the permission problems that some users have experienced, and I'll be sure to post more about that as soon as I have details.

 

[cPRex]

The new Let's Encrypt plugin has been released. The updated version is cpanel-letsencrypt-v2-1.02-1.2.1.cpanel.noarch.rpm

 

[cPRex]

The second autofixer has cleared our QA team and will be released shortly as well.