SOLVED [UPS-57] SSL Pending Queue Error - cannot open file

[monkeyblue]

Hi,

We have a couple of domains out of 100 which are generating an email error every few minutes, from what I can tell the AutoSSL is enabled for this sites and the file exists which it reports is not, ownership of the file is root:root

/usr/local/cpanel/bin/process_ssl_pending_queue encountered an error: The system retrieved the <abbr title="Secure Sockets Layer">SSL</abbr> certificate for “clientdomain.com”, but failed to install it because of an error: Cannot open “/usr/local/cpanel/etc/x509_ev_issuers.json”: No such file or directory at /usr/local/cpanel/Cpanel/JSON.pm line 248. Cpanel::JSON::_LoadFile("/usr/local/cpanel/etc/x509_ev_issuers.json", 0, 0, undef, 0) called at /usr/local/cpanel/Cpanel/JSON.pm line 203 Cpanel::JSON::LoadFile("/usr/local/cpanel/etc/x509_ev_issuers.json") called at /usr/local/cpanel/Cpanel/SSL/Utils.pm line 697 Cpanel::SSL::Utils::_parse_x509_extensions(ARRAY(0x1c99870)) called at /usr/local/cpanel/Cpanel/SSL/Utils.pm line 878 Cpanel::SSL::Utils::_parse_x509_base64("MIIFFTCCA/2gAwIBAgIQD4i/bfo3u4IatCZqYL12PzANBgkqhkiG9w0BAQsFA"...) called at /usr/local/cpanel/Cpanel/SSL/Utils.pm line 231 Cpanel::SSL::Utils::parse_certificate_text("-----BEGIN CERTIFICATE-----\x{a}MIIFFTCCA/2gAwIBAgIQD4i/bfo3u4Iat"...) called at /usr/local/cpanel/Cpanel/API/SSL.pm line 1233 Cpanel::API::SSL::install_ssl(Cpanel::Args=HASH(0x18f54d0), Cpanel::Result=HASH(0x130e378)) called at /usr/local/cpanel/Cpanel/API.pm line 299 Cpanel::API::__ANON__() called at /usr/local/cpanel/Cpanel/API.pm line 370 eval {...} called at /usr/local/cpanel/Cpanel/API.pm line 370 Cpanel::API::_eval_guard(Cpanel::Result=HASH(0x130e378), CODE(0x18f5968)) called at /usr/local/cpanel/Cpanel/API.pm line 299 Cpanel::API::_run_module_function(Cpanel::Args=HASH(0x18f54d0), Cpanel::Result=HASH(0x130e378), "SSL", "install_ssl") called at /usr/local/cpanel/Cpanel/API.pm line 161 Cpanel::API::execute("SSL", "install_ssl", HASH(0x18f54b8)) called at /usr/local/cpanel/Cpanel/SSL/PendingQueue/Run.pm line 144 Cpanel::SSL::PendingQueue::Run::_install_cert(Cpanel::SSL::PendingQueue::Item=HASH(0x1343490), "-----BEGIN CERTIFICATE-----\x{a}MIIFFTCCA/2gAwIBAgIQD4i/bfo3u4Iat"..., ARRAY(0x13a2848)) called at /usr/local/cpanel/Cpanel/SSL/PendingQueue/Run.pm line 83 Cpanel::SSL::PendingQueue::Run::__ANON__() called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/Try/Tiny.pm line 99 eval {...} called at /usr/local/cpanel/3rdparty/perl/526/lib64/perl5/cpanel_lib/Try/Tiny.pm line 90 Try::Tiny::try(CODE(0x12f1ce8), Try::Tiny::Catch=REF(0xec89e8)) called at /usr/local/cpanel/Cpanel/SSL/PendingQueue/Run.pm line 121 Cpanel::SSL::PendingQueue::Run::process() called at bin/process_ssl_pending_queue.pl line 26 bin::process_ssl_pending_queue::script() called at bin/process_ssl_pending_queue.pl line 23 . The system will attempt to fetch the certificate and to install it again. at /usr/local/cpanel/Cpanel/SSL/PendingQueue/Run.pm line 157.

Has anyone seen this error before or know how to solve it, we have received around 1,000 emails since the early hours this morning.

Thanks, Aaron

 

[cPanelLauren]

Hi @monkeyblue

Are you running CloudLinux with CageFS? The instances I've seen this were due to /usr/local/cpanel/etc/ not being included in CageFS. We opened UPS-57 which resulted in CloudLinux opening a case (CAG-844 is their ID) to address this.

The workaround should be as follows:

You can correct this by adding the string '!/usr/local/cpanel/etc' to /etc/cagefs/cagefs.mp and running:

cagefsctl --remount-all

Also process_ssl_pending_queue is actually associated with paid certificates not AutoSSL's free certificates.

I'll update here when I have more information on the status of the case

 

[cPanelMichael]

Hello,

To follow-up, CloudLinux fixed this issue via the following case:

CAG-844: investigated and added /usr/local/cpanel/etc into CageFS;

The change log was published as part of the link below:

LVE Manager, CageFS, LVE-utils, and Alt-Python27-cllib updated

Thank you.