Error:
The output of the nginx_1 container after switching from LetsEncrypt staging to production shows a repeating comparison error testing LOG_LEVEL. The message doesn't appear if using staging is set. The production certificate fails to be issued with validation folder failure, where the verification string is not generated for LE to validate.
..
/config/acme.sh/acme.sh: line 374: [: info: integer expression expected
/config/acme.sh/acme.sh: line 340: [: info: integer expression expected
..
Resolve the Integer Expression Message
Note:
- The LOG_LEVEL=info in .env and custom.env is used for the STProxy (proxy_1).
- The LOG_LEVEL for acme.sh is enabled in the file /home/myadminid/st1204/sametime-config/web/acme.sh/accounts.conf
- After the first startup run and the sametime-config folders are all populated, we can enable the logging before switching to production.
1. Shut down Domino services so the accounts.conf file is not being written to occasionally:
$ cd /home/myadminid/st1204/
$ sudo podman-compose down -t15
<wait>
2. Enable the acme.sh logging level:
Note:
- Remove the comments in front of the LOG_FILE and LOG_LEVEL lines.
$ vi /home/myadminid/st1204/sametime-config/web/acme.sh/accounts.conf
LOG_FILE="/config/acme.sh/acme.sh.log"
LOG_LEVEL=2
...
3. Enable LetsEncrypt production:
Note:
- Add a comment to the LetsEncrypt staging entry.
$ vi /home/myadminid/st1204/custom.env
...
#LETSENCRYPT_USE_STAGING=1
...
4. Start back up Sametime:
$ cd /home/myadminid/st1204/
$ sudo podman-compose up -d
<wait, confirm exit codes are 0>
Note:
- The nginx_1 container will still have 0 but have a lines a few above say that tasks edited without 0.
- Verify in web browser.
web browser --> sametime.mindwatering.net
Actions:
- If the login page displays and running on the production certificate, complete.
- If the page is not displaying, then look at the nginx_logs and see if the validation step failed in the issue or if over the limit of production tries.
$ cd /home/myadminid/st1204/
$ sudo podman-compose logs nginx
<view reason(s)>
- If the page loads but the staging certificate is still there, we've had this issue before. LE seems to be waiting to be closer to the expiration date. Shutdown again, clear the certs and try again.
- - Shutdown:
$ cd /home/myadminid/st1204/
$ sudo podman-compose down -t15
-- Remove the old certificates:
$ cd /home/myadminid/st1204/sametime-config/web/acme.sh/
$ rm -rf sametime.mindwatering.net_ecc
$ cd /home/myadminid/st1204/sametime-config/web/acme-certs/
$ rm -rf sametime.mindwatering.net
-- Start-up:
$ cd /home/myadminid/st1204/
$ sudo podman-compose up -d
---
Troubleshooting:
/home/sysadmin/st1204$ sudo podman exec -it st1204_nginx_1 /bin/sh
or
/home/sysadmin/st1204$ sudo podman exec -it st1204_nginx_1 /bin/bash
$ whoami
<sametime>
...
---
Acme Tips:
Notes:
- Acme.sh certificate management commands similar to the Certbot ones
- The folder w/in the nginx_1 container is /config/acme.sh/
- The nginx_1 container supports both sh and bash, but the default shell, sh, cannot run acme.sh (permissions issue), use bash
- - Meaning we have to use the longer syntax of: podman exec -it nginx_1 /bin/bash -c 'command string to run'
To list:
$ cd /home/myadminid/st1204/
/home/sysadmin/st1204$ sudo podman exec -it st1204_nginx_1 /bin/bash -c '/config/acme.sh/acme.sh --list'
<view list of certificates, if none list, none have been created>
- To remove:
$ cd /home/myadminid/st1204/
/home/sysadmin/st1204$ sudo podman exec -it st1204_nginx_1 /bin/bash -c '/config/acme.sh/acme.sh --remove -d <domainname>'
and
/home/sysadmin/st1204$ sudo podman exec -it st1204_nginx_1 /bin/bash -c '/config/acme.sh/acme.sh --list
<confirm domain certificate removed/deleted>
- To manually issue (Sametime running in Standalone w/HTTP-01 Challenge):
WARNING: Ensure you overwritten the default config or it will use wrong folders (e.g. /home/sametime/.acme.sh/ instead of /config/acme.sh/)
$ cd /home/myadminid/st1204/
/home/sysadmin/st1204$ sudo podman exec -it st1204_nginx_1 /bin/bash -c '/config/acme.sh/acme.sh --issue -d sametime.mindwatering.net --standalone --home /config/acme.sh --config-home /config/acme.sh'
- To check if the cron entry was created:
$ cd /home/myadminid/st1204/
$ podman exec -it st1204_nginx_1 crontab -l | grep acme.sh
<view output>
e.g.
18 10 * * * "/config/acme.sh"/acme.sh --cron --home "/config/acme.sh" > /dev/null
- To renew all:
$ cd /home/myadminid/st1204/
/home/sysadmin/st1204$ sudo podman exec -it st1204_nginx_1 /bin/bash -c '/config/acme.sh/acme.sh --renew-all --home /config/acme.sh --config-home /config/acme.sh'
- To renew one before expiration threshold:
$ cd /home/myadminid/st1204/
/home/sysadmin/st1204$ sudo podman exec -it st1204_nginx_1 /bin/bash -c '/config/acme.sh/acme.sh --renew -d sametime.mindwatering.net --force --home /config/acme.sh --config-home /config/acme.sh'
- To view certificate info/details:
$ cd /home/myadminid/st1204/
/home/sysadmin/st1204$ sudo podman exec -it st1204_nginx_1 /bin/bash -c '/config/acme.sh/acme.sh --info -d sametime.mindwatering.net --home /config/acme.sh --config-home /config/acme.sh'
previous page
|