dakser
August 3, 2016, 6:20am
1
Hi, I’m trying to install a Let’s Encrypt certificate for the admin panel of Virtualmin, but in “Let’s Encrypt Certificate Request” in Webmin Configuration I’m receiving an error:
"Requesting a new certificate for server26.ultranetxxi.net , using the website directory /home/ultranetxxi.net/public_html …
… request failed : Failed to request certificate :
Parsing account key…https://letsencrypt.org/documents/LE-SA-v1.0.1-July-27-2015.pdf ] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf ]”,
Any help is appreciated.
h4ns3n
August 3, 2016, 6:34pm
2
I’m experiencing the same issue, with exactly the same error message. This seems to be a general webmin / letsencrypt problem.
Eric
August 3, 2016, 11:57pm
3
Howdy,
Yeah that is indeed a bug (due to the Let’s Encrypt ToS changing)… there’s a report for that here (including a temporary workaround):
https://www.virtualmin.com/node/41565
shiraz
August 11, 2016, 7:29am
5
@all : issue seems to be fixed in update 1.810
dakser
August 24, 2016, 7:11am
6
Hi Shiraz, that’s right, it’s working now. Thanks.
informative information thanks for sharing… Buy Viagra Online http://www.genericviagraus.net
Provided agreement URL error fix webmin -> Others -> File Manger /usr/share/webmin/webmin/acme_tiny.py “agreement”: “https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf ”, “agreement”: json.loads(urlopen(CA + “/directory”).read().decode(‘utf8’))[‘meta’][‘terms-of-service’],
I replaced the contents of acme_tiny.py from this https://github.com/diafygi/acme-tiny/blob/master/acme_tiny.py to make it work.
@jaldeguer … I’ve just tried your bug fix and still ran into a problem, but not the original reported issue. It seems that it is expecting a "subscriber agreement ".
Nigel.
Parsing account key…podcasts.soft-focus-imagining.com …
DNS-based validation failed : Failed to request certificate :
usage: acme_tiny.py [-h] --account-key ACCOUNT_KEY --csr CSR --acme-dir
@jaldeguer - Yes I did, but I did run this before when it was broken, could it have left “files” behind that are now interfering?
@jaldeguer : I don’t know if this will help or not, but here is the email that webmin sent me. This was from a few minutes ago. 8:14 PM 17th Nov.
reason: acme_tiny.py:106:get_crt:ValueError: Error registering: 400 {apache-web-server.twin-peaks-video.com
reported_to:https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf ] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf ]”,https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf ] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf ]”,bwq6U93UBZDR_9AeXrM26ATtEMwosnYt3GXiFMDbqsApv3KE9B1OGud76wCeECLUXouKmPRiO65DcaTLnA_YjqLKveArhUlgO7OI65OBUoLJZkP9AZ1uSF5YDLZgx70m-VNu -zfsXU2znkgtKAHYfbYBGMBAbk2XLRAjTv-uPIwhPExE9akTfLMDito2Kp9-DtoFm6AFdOA_gLJqj_aNIIa05u4uGJjJo-faM6Dh0pnzw4hpeAjTVcObkBfzPXp4N89bvWNEdk’}}https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf ] does not match current agreement URL [https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf ]”,\n “status”: 400\n}’CN=podcasts.soft-focus-imagining.com \n Subject Public Key Info:\n Public Key Algorithm: rsaEncryption\n Public-Key: (2048 bit)\n Modulus:\n 00:b3:26:45:c5:80:76:02:9e:95:a7:ff:30:37:c7:\n cd:71:3b:cf:ca:26:91:ab:b7:9f:f6:90:2b:3c:76:\n eb:6a:a3:b6:b5:6b:3f:d6:f2:ab:87:db:2c:9c:fb:\n d2:f0:66:e3:9d:eb:fb:e6:40:03:f0:9c:33:99:80:\n 04:32:30:23:20:9d:14:93:e0:3e:2d:e3:2d:6a:ef:\n 53:d6:8b:3f:0f:7f:4b:ab:8b:47:00:ca:c3:c1:b4:\n df:37:60:86:3e:55:99:d9:a2:bc:39:56:da:74:16:\n 9b:34:2a:64:d5:bc:98:d3:fd:72:8f:5a:63:db:bb:\n 64:ef:1e:c5:43:69:3b:c1:4c:99:24:cd:b6:cb:33:\n 85:83:af:f1:9f:60:c9:15:74:40:45:1e:ad:74:44:\n 57:a5:c1:a4:00:35:a1:65:f4:ae:c1:f5:c6:2b:25:\n 2c:fb:b8:45:35:15:d8:fb:de:71:8c:89:f3:07:f4:\n 41:32:35:38:55:d0:46:ff:de:04:c2:f6:26:cc:5d:\n 41:2e:43:93:87:35:11:d5:d2:78:2a:73:6f:f1:4a:\n 47:12:89:a3:ed:6c:4c:e0:73:cb:74:41:c7:00:20:\n 24:91:89:0e:27:d7:62:16:bd:ec:04:0a:f1:2a:1c:\n 9f:ff:0d:ae:46:95:0b:3c:54:21:7f:63:b1:27:18:\n 99:e9\n Exponent: 65537 (0x10001)\n Attributes:\n Requested Extensions:\n X509v3 Subject Alternative Name: \n DNS:www.podcasts.soft-focus-imagining.com\n X509v3 Basic Constraints: \n CA:FALSE\n X509v3 Key Usage: \n Digital Signature, Non Repudiation, Key Encipherment\n Signature Algorithm: sha256WithRSAEncryption\n 0f:2d:32:d8:ca:1d:fc:35:40:87:5b:71:fa:d1:21:4e:83:ef:\n d8:0a:5a:3c:a1:fd:29:41:3f:49:cd:72:b2:8b:b1:c6:13:4c:\n 66:1c:cb:c1:f2:53:35:5a:04:3d:07:90:5b:9d:50:a5:34:df:\n 58:ed:d7:78:a4:ad:db:e5:c9:a3:54:3b:3e:02:52:0a:d1:4f:\n 80:e5:ae:43:a2:6e:56:1a:f6:5e:d6:e1:a1:e8:ec:cc:eb:20:\n 26:41:28:d7:1e:1e:3e:c2:92:bd:94:87:14:b0:ea:49:06:6a:\n e1:03:ec:70:5d:2d:da:91:3d:5a:d4:2a:96:fa:23:81:01:4e:\n 0b:43:03:ce:7b:c0:dc:a6:cb:7d:ed:43:4d:86:6a:3f:7f:71:\n 5c:97:3e:54:af:2c:af:07:bf:d6:49:e6:f1:87:b9:44:b3:fe:\n 7c:b0:af:46:76:27:a2:ae:b3:9c:35:fc:3e:0b:7d:67:1c:f4:\n 35:cc:60:de:a5:b9:4a:57:af:6f:f5:cd:d8:59:1f:65:4a:6b:\n a9:6a:d8:8f:7b:78:dd:8c:eb:28:50:22:6c:07:0f:ca:e2:ae:\n 62:99:4a:d8:d0:6e:2b:cd:ef:52:fc:ce:c4:5f:84:51:e1:e0:\n 89:e4:49:c8:c0:dc:49:a0:43:ae:d0:ef:98:e1:58:a2:7c:7b:\n 97:cc:4c:a1\n’https://acme-v01.api.letsencrypt.org ’www.podcasts.soft-focus-imagining.com ’, u’podcasts.soft-focus-imagining.com ’])send_signed_request at 0x293f7d0>bwq6U93UBZDR_9AeXrM26ATtEMwosnYt3GXiFMDbqsApv3KE9B1OGud76wCeECLUXouKmPRiO65DcaTLnA_YjqLKveArhUlgO7OI65OBUoLJZkP9AZ1uSF5YDLZgx70m-VNu -zfsXU2znkgtKAHYfbYBGMBAbk2XLRAjTv-uPIwhPExE9akTfLMDito2Kp9-DtoFm6AFdOA_gLJqj_aNIIa05u4uGJjJo-faM6Dh0pnzw4hpeAjTVcObkBfzPXp4N89bvWNEdk”}’twin-peaks-video.com twin-peaks-video.com:10000 =/bin/python2.7/ ;q=0.8https://www.centos.org/ ”https://bugs.centos.org/ ”
Any one have any ideas as to why I’m still running into an issue?
I’d really like to get this working across my web sites
It took some finding but I know have everything working all OK. It was a created file (from my first attempt) that caused the second issue.
etc/webmin/webmin/letsencrypt.pem
This now lead me to Lets Encrypt having issues writing the confirmation file in .well-known
This was being blocked by mod-security - once mod-security was “off” every site worked with no hiccups.
But hopefully someone can answer this. Will mod_security stop the “Update renewal” from working?
Many Thanks - Nigel
Hello Guys,
I ran into the same problem and here is my solution:
Go to Webmin ->Others->File Manager and browse to /usr/libexec/webmin/webmin/
Edit the acme_tiny.py file
Go to line: 99 and replace the current “https://letsencrypt.org/documents/LE-SA-v1.1.1-August-1-2016.pdf ” with “https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf ” and save the file.
Go to Virtualmin ->Server Configuration->Manage SSL Certificate and select Let’s Encrypt tab and click on Request Certificate.
The above steps worked for me. I think the acme_tiny.py needed to be updated with the new “LET’S ENCRYPT SUBSCRIBER AGREEMENT”.
Yup, that helped me out too, liveandlearn! Thanks for the tip
You’ve saved my evening. Thank you very much!
pragma
December 15, 2017, 9:38pm
19
SOLUTION:
Parsing account key...
Parsing CSR...
Registering account...
Already registered!
Signing certificate...
Traceback (most recent call last):
File "acme_tiny.py", line 198, in
main(sys.argv[1:])
File "acme_tiny.py", line 194, in main
signed_crt = get_crt(args.account_key, args.csr, args.acme_dir, log=LOGGER, CA=args.ca)
File "acme_tiny.py", line 161, in get_crt
raise ValueError("Error signing certificate: {0} {1}".format(code, result))
ValueError: Error signing certificate: 403 {
"type": "urn:acme:error:unauthorized",
"detail": "Error creating new cert :: Authorizations for these names not found or expired: temboz.com",
"status": 403
}
The problem is in line 72 where extracts the CN from the certificate using the regex:
# nano /usr/share/webmin/webmin/acme_tiny.py and search "common_name" line
common_name = re.search(r"Subject:.*? CN=([^\s,;/]+)", out.decode('utf8'))
Unfortunately OpenSSL changed the format of openssl req -text -noout in 1.1.0 to add extraneous spaces around the = in CN=:
The fix is to change line 72 to:
nano /usr/share/webmin/webmin/acme_tiny.py and search “common_name” line
common_name = re.search(r"Subject:.*? CN ?= ?([^\s,;/]+)", out.decode('utf8'))
Note: Please make sure to keep line intend before common_name when you copy and past above fix.
This also applies to Virtualmin in /usr/share/webmin/virtual-server/feature-ssl.pl line 1345
if ($ex) {
return "<tt>".&html_escape($out)."</tt>";
}
elsif ($out !~ /subject\s*=\s*.*(CN|O)=/) {
return $text{'cert_esubject'};
}
else {
return undef;
}
}
