Lets Encrypt: Web-based validation failed : mkdir failed : mkdir: cannot create directory '/home/example.net': Permission denied

Virtualmin
1
SYSTEM INFORMATION
OS type and version Almalinux 8.10
Webmin version 2.202
Virtualmin version 7.20.2

Whenever I try to renew my SSL certs, I get this error just before the log output :

Requesting a certificate for example.net, www.example.net, mail.example.net, wap.example.net from Let's Encrypt ..
.. request failed : Web-based validation failed : mkdir failed : mkdir: cannot create directory '/home/example.net': Permission denied

Of course that /home/example.net/ exists because thatā€™s the Virtual Server for which Iā€™m trying to create the certificates for. I wonder why the process would need to create a dir that already exists?

Now, Iā€™m not posting the letsencrypt.log file because it has no mention of that error. The log file only complains about No TXT record found at _acme-challenge.wap.example.net, which I believe can be solved by creating a (TXT?) record _acme-challenge for the domain in Cloudflare, who knows with which value.

Also: It seems there are 2 validation methods, HTTPS and DNS. The Letā€™s Encrypt panel in Virtualmin should display a very clear message explaining what are the requirements for each method. I was never told to create any _acme-challenge record anywhere (nor its value), yet it seems that should be the first step of the process.

Any help with the mkdir failed error and the TXT record value will be greatly appreciated, I want to have both validation methods properly setup, thanks.

2

Are you using Virtualmin to create your Certificates - if so the process is pretty much automatic. If not then I note that your version of Virtualmin is not up-to-date (7.30.4)

I have never had to add TXT records. certainly not for LE

3

I donā€™t see any such records in my domain.

root@main:/var/lib/bind# grep -i txt * |grep chall
root@main:/var/lib/bind#

Butā€¦

Could this be a Cloudflare issue? I donā€™t use them. I tried a long time ago, it broke mail so that was the end of that for me.

1 Like
4

There are only two methods of validation if Virtualmin believes it is managing DNS. Stop lying to Virtualmin, and you wonā€™t see confusing errors. If Virtualmin is not managing DNS, disable that Feature in Features and Plugins (or for just this domain, if other domains are being managed by Virtualmin). You canā€™t make the TXT record manually using Virtualmin, DNS validation canā€™t work with Virtualmin if Virtualmin is not managing DNS for your zone.

Generally, fixing web validation is the right thing.

1 Like
5

Thanks, but when trying to disable DNS for domain in Features & Plugins, this error is thrown:

Failed to save enabled features : The feature DNS for domain cannot be disabled, as it is used by the following virtual servers: (all my domains listed here)

Anyway, I updated all packages + Virtualmin to 7.30.4, restarted the VPS, and the web-based validation is still failing on all my virtual servers with the same error:

Web-based validation failed : mkdir failed : mkdir: cannot create directory '/home/argim.net': Permission denied

Which step of the process is trying to create a directory that already exists and why?

6

Yeah, youā€™ll have to disable it on all of those domains before you can turn it off system-wide.

7

And, I have no idea how youā€™d get this error. Iā€™ve never seen it, and I donā€™t think Iā€™ve ever seen anyone else report it.

Is that really all you see? Thereā€™s nothing else when you try to get a cert?

8

DNS method:

Iā€™ve disabled DNS for domain in all my virtual servers, but I still get this error when trying to disable it globally on System Settings > Features and Plugins: Failed to save enabled features : The feature DNS for domain cannot be disabled, as it is used by the following virtual servers : wap.argim.net
And in such domain there is no option to disable DNS:

image
image620Ɨ376 11.7 KB

Web method:

Here you can see a full screenshot of the process output. That was from the earlier virtualmin version, but the errors are exactly the same in the latest version too.

9

The DNS feature should be disable on ā€œEdit Virtual Serverā€ page.

1 Like
10

Disassociate is not the same as disable.

11

You are right, and it canā€™t be disabled there because:

Failed to modify server : DNS cannot be disabled while sub-domains still have it enabled

12

Would you mind explaining how to disassociate the DNS from that particular domain?

13

You need to disable it. First for the subdomain-named virtual servers or sub-servers, and then for the parent.

I have not suggested disassociating it, that is not the same as disabling. You need to disable DNS for all domains, if youā€™re going to disable it in Features and Plugins.