From: "Steven Levine" <ecs-isp@2rosenthals.com>
Message-ID: <675925f1.6.mr2ice.fgrirsq@earthlink.net>
Date: Tue, 10 Dec 2024 21:41:05 -0800
To: "eCS ISP Mailing List" <ecs-isp@2rosenthals.com>
In-Reply-To: <list-11332415@2rosenthals.com>
Subject: Re: [eCS-ISP] Getting started with Let's Encrypt

In <list-11332415@2rosenthals.com>, on 12/10/24
   at 10:54 AM, "Peter Moylan" <ecs-isp@2rosenthals.com> said:

Hi Peter,

>Well, I can report partial success. It turns out that uacme wants a 
>number of DLLs that existed on my desktop computer but not on my server. 
>After copying those over, the "uacme -v new" worked, except for an error 
>message at the end.

That should not have occured.  What was the error message?

>> uacme -v -h uacme-hook.cmd issue www.pmoylan.org pmoylan.org ...

This looks fine to me.

>Here's the result of that "issue" operation:

>[D:\APPS\UACME]uacme -v -h uacme-hook.cmd issue pmoylan.org 
>www.pmoylan.org mail.pmoylan.org
>uacme: version 1.2.4 starting on Tue, 10 Dec 2024 10:06:27
>uacme: loading key from /@unixroot/etc/ssl/uacme/private/key.pem uacme:
>loading key from /@unixroot/etc/ssl/uacme/private/pmoylan.org/key.pem
>uacme: checking existence and expiration of 
>/@unixroot/etc/ssl/uacme/pmoylan.org
>/cert.pem
>uacme: /@unixroot/etc/ssl/uacme/pmoylan.org/cert.pem does not exist

So far, so good.  Since this is first time you are issuing this
certificate, it should not exist.

>uacme: fetching directory at
>https://acme-v02.api.letsencrypt.org/directory A non-recoverable error
>occurred.  The process ended.
>It looks as if the crash happened at the point of fetching something 
>from the letsencrypt.org web site.

Did uacme really crash or are you just calling the reported failure a
crash?  If uacme really did crash, you should have a popuplog entry or an
exceptq report.

>I've checked with Firefox that that 
>URL gives an apparently valid file.

https://acme-v02.api.letsencrypt.org/directory defines the capabilities
supported by the Let's Encrypt server and maps the capabilities to URLs. 
The page is in json format, which is pretty widely used these days.

>I now have two key.pem files (and they look OK) but no certificate.

You did not mention the file locations, but the key.pem in uacme\private
is your account's private key.  The other key.pem which probably in the
uacme\www.pmoylan.org\private directory is the private key uacme generated
to be used with your to be created certificate.


>The 
>only challenge in the .well-known\acme-challenge directory of my web 
>site is a couple of files left over from a test of two days ago (so I've 
>deleted those), so the process  has not proceeded to the point of 
>issuing the challenge.

Agreed.  The console output indicates this.

>I don't think that uacme-hook.cmd has yet been invoked, but maybe I 
>should insert some tracing code into that script to see whether it
>started.

Why bother if it's not getting run.  IAC, there's already plenty of
tracing code in the hook.  When the hook does get run, it's hard to miss
the console output, which also gets written to the log file.

How many times did you retry the issue request.  The Let's Encrypt site
can get busy.  This is why the uacme-renew script has retry logic.

Just to be sure, I recommend using yum or rpm to ensure that your set of
netlabs supplied DLLs is up to date and consistent.

Steven

-- 
----------------------------------------------------------------------
"Steven Levine" <steve53@earthlink.net>  Warp/DIY/BlueLion etc.
www.scoug.com www.arcanoae.com www.warpcave.com
----------------------------------------------------------------------