Hi, I'm trying to install a Let's Encrypt certificate for the admin panel of Virtualmin, but in "Let's Encrypt Certificate Request" in Webmin Configuration I'm receiving an error:
"Requesting a new certificate for server26.ultranetxxi.net, using the website directory /home/ultranetxxi.net/public_html ..
.. request failed : Failed to request certificate :
Parsing account key... Parsing CSR... Registering account... Traceback (most recent call last): File "/usr/share/webmin/webmin/acme_tiny.py", line 203, in main(sys.argv[1:]) File "/usr/share/webmin/webmin/acme_tiny.py", line 199, in main signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca) File "/usr/share/webmin/webmin/acme_tiny.py", line 97, in get_crt raise ValueError("Error registering: {0} {1}".format(code, result)) ValueError: Error registering: 400 { "type": "urn:acme:error:malformed", "detail": "Provided agreement URL [https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf]", "status": 400 }"
Any help is appreciated.
I'm experiencing the same issue, with exactly the same error message. This seems to be a general webmin / letsencrypt problem.
Signature: Implement powerful CRM solutions using: Agile CRM: Advanced Marketing Automation (Note: This is an affiliate link)
Howdy,
Yeah that is indeed a bug (due to the Let's Encrypt ToS changing)... there's a report for that here (including a temporary workaround):
https://www.virtualmin.com/node/41565
https://www.virtualmin.com/node/41644:
sed -i s#'https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf'#'https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf'# /usr/share/webmin/webmin/acme_tiny.py
@all: issue seems to be fixed in update 1.810
Hi Shiraz, that's right, it's working now. Thanks.
informative information thanks for sharing... Buy Viagra Online http://www.genericviagraus.net
Provided agreement URL error fix
Go to webmin -> Others -> File Manger
edit File -> /usr/share/webmin/webmin/acme_tiny.py
line 99 replace -> "agreement": "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf",
with -> "agreement": json.loads(urlopen(CA + "/directory").read().decode('utf8'))['meta']['terms-of-service'],
hope this helpful
Work hard in silence let success be your noise
I replaced the contents of acme_tiny.py from this https://github.com/diafygi/acme-tiny/blob/master/acme_tiny.py to make it work.
@jaldeguer .... I've just tried your bug fix and still ran into a problem, but not the original reported issue. It seems that it is expecting a "subscriber agreement ".
Nigel.
Parsing account key... Parsing CSR... Registering account... Already registered! Verifying podcasts.soft-focus-imagining.com... Traceback (most recent call last): File "/usr/libexec/webmin/webmin/acme_tiny.py", line 196, in main(sys.argv[1:]) File "/usr/libexec/webmin/webmin/acme_tiny.py", line 192, in main signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca) File "/usr/libexec/webmin/webmin/acme_tiny.py", line 104, in get_crt raise ValueError("Error requesting challenges: {0} {1}".format(code, result)) ValueError: Error requesting challenges: 403 { "type": "urn:acme:error:unauthorized", "detail": "Must agree to subscriber agreement before any further actions", "status": 403 }
DNS-based validation failed : Failed to request certificate :
usage: acme_tiny.py [-h] --account-key ACCOUNT_KEY --csr CSR --acme-dir ACME_DIR [--quiet] [--ca CA] acme_tiny.py: error: argument --acme-dir is required
@NigelAves Did you replace the entire contents of acme_tiny.py with this ? https://github.com/diafygi/acme-tiny/blob/master/acme_tiny.py
@jaldeguer - Yes I did, but I did run this before when it was broken, could it have left "files" behind that are now interfering?
@jaldeguer : I don't know if this will help or not, but here is the email that webmin sent me. This was from a few minutes ago. 8:14 PM 17th Nov.
reason: acme_tiny.py:106:get_crt:ValueError: Error registering: 400 { cmdline: /bin/python2.7 /usr/libexec/webmin/webmin/acme_tiny.py --account-key /etc/webmin/webmin/letsencrypt.pem --csr /tmp/.webmin/16184_25847_3_letsencrypt.cgi --acme-dir /home/podcasts/public_html/.well-known/acme-challenge executable: /usr/libexec/webmin/webmin/acme_tiny.py package: webmin-1.860-1 component: webmin pid: 25871 hostname: apache-web-server.twin-peaks-video.com count: 6 abrt_version: 2.1.11 analyzer: Python architecture: x86_64 duphash: eea2832f10a33b034751c429cc2e91f691fad601 event_log:
kernel: 3.10.0-693.5.2.el7.x86_64 last_occurrence: 1510974754 os_release: CentOS Linux release 7.4.1708 (Core) pkg_arch: noarch pkg_epoch: 0 pkg_fingerprint: D97A 3AE9 11F6 3C51 pkg_name: webmin pkg_release: 1 pkg_vendor: Jamie Cameron pkg_version: 1.860 runlevel: N 5 time: Wed 15 Nov 2017 05:50:51 AM MST type: Python uid: 0 ureports_counter: 6 username: root uuid: eea2832f10a33b034751c429cc2e91f691fad601
Any one have any ideas as to why I'm still running into an issue?
I'd really like to get this working across my web sites :)
It took some finding but I know have everything working all OK. It was a created file (from my first attempt) that caused the second issue.
etc/webmin/webmin/letsencrypt.pem
This now lead me to Lets Encrypt having issues writing the confirmation file in .well-known
This was being blocked by mod-security - once mod-security was "off" every site worked with no hiccups.
But hopefully someone can answer this. Will mod_security stop the "Update renewal" from working?
Many Thanks - Nigel
Hello Guys,
I ran into the same problem and here is my solution: 1) Go to Webmin ->Others->File Manager and browse to /usr/libexec/webmin/webmin/ 2) Edit the acme_tiny.py file 3) Go to line: 99 and replace the current "https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf" with "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf" and save the file. 4) Go to Virtualmin ->Server Configuration->Manage SSL Certificate and select Let's Encrypt tab and click on Request Certificate. 5) The above steps worked for me. I think the acme_tiny.py needed to be updated with the new "LET’S ENCRYPT SUBSCRIBER AGREEMENT". Good luck and let me know if it worked for you.
You've saved my evening. Thank you very much! :)
Yup, that helped me out too, liveandlearn! Thanks for the tip :)
SOLUTION:
Issuing new Let's Encrypt certificates (or renewing ones past the reauthorization window) fails when running OpenSSL 1.1.0. you can get the error:
Parsing account key...Parsing CSR...
Registering account...
Already registered!
Signing certificate...
Traceback (most recent call last):
File "acme_tiny.py", line 198, in <module>
main(sys.argv[1:])
File "acme_tiny.py", line 194, in main
signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca)
File "acme_tiny.py", line 161, in get_crt
raise ValueError("Error signing certificate: {0} {1}".format(code, result))
ValueError: Error signing certificate: 403 {
"type": "urn:acme:error:unauthorized",
"detail": "Error creating new cert :: Authorizations for these names not found or expired: temboz.com",
"status": 403
}
The problem is in line 72 where extracts the CN from the certificate using the regex:
# nano /usr/share/webmin/webmin/acme_tiny.py and search "common_name" linecommon_name = re.search(r"Subject:.*? CN=([^\s,;/]+)", out.decode('utf8'))
Unfortunately OpenSSL changed the format of openssl req -text -noout in 1.1.0 to add extraneous spaces around the = in CN=:
The fix is to change line 72 to:
# nano /usr/share/webmin/webmin/acme_tiny.py and search "common_name" linecommon_name = re.search(r"Subject:.*? CN ?= ?([^\s,;/]+)", out.decode('utf8'))
Note: Please make sure to keep line intend before common_name when you copy and past above fix.
This also applies to Virtualmin in
/usr/share/webmin/virtual-server/feature-ssl.plline 1345