which way should I use in this case for issue certificate?

alexlii1971

Hello,

I registered a domain on Aliyun (in China), and I added the domain to the server on Digitalocean.
I checked this tutorial: https://github.com/Neilpang/acme.sh/wiki/dnsapi:
The domain is already working well without SSL, so, I am trying to issue SSL certificate on the server, which way should I use please?

11. Use Aliyun domain API to automatically issue cert

First you need to login to your Aliyun account to get your API key. https://ak-console.aliyun.com/#/accesskey

export Ali_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
export Ali_Secret="jlsdflanljkljlfdsaklkjflsa"
Ok, let's issue a cert now:

acme.sh --issue --dns dns_ali -d example.com -d www.example.com
The Ali_Key and Ali_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.

20. Use DigitalOcean API (native)

You need to obtain a read and write capable API key from your DigitalOcean account. See: https://www.digitalocean.com/help/api/

export DO_API_KEY="75310dc4ca779ac39a19f6355db573b49ce92ae126553ebd61ac3a3ae34834cc"
Ok, let's issue a cert now:

acme.sh --issue --dns dns_dgon -d example.com -d www.example.com

portofacil

If DNS is correctly configured you don't need any API method, just wo site update yourdomain.com --le.

alexlii1971

Hello portofacil

portofacil If DNS is correctly configured

Would you please let me know where should I do the DNS configuration please? any online tutorial please?

Actually, I tried the first one:

11. Use Aliyun domain API to automatically issue cert

First you need to login to your Aliyun account to get your API key. https://ak-console.aliyun.com/#/accesskey

export Ali_Key="sdfsdfsdfljlbjkljlkjsdfoiwje"
export Ali_Secret="jlsdflanljkljlfdsaklkjflsa"
Ok, let's issue a cert now:

acme.sh --issue --dns dns_ali -d example.com -d www.example.com
The Ali_Key and Ali_Secret will be saved in ~/.acme.sh/account.conf and will be reused when needed.

and I found it is successfully issued the certificate, but after that, the site will be not accessible, I restarted the server and did "wo clean --all", but still not work...what did I missed please?

http://prntscr.com/qebdvx

Thanks for in advance.

alexlii1971

Hello portofacil

Here is what I tried, any suggestion please?



root@ubuntu-s-1vcpu-2gb-sfo2-01:~# wo site update mysite.com --le
Certificate type : domain
You already have an existing certificate for the domain requested.
(ref: /etc/letsencrypt/renewal/mysite.com_ecc/inlady.net.conf)
Please select an option from below?
        1: Reinstall existing certificate
        2: Issue a new certificate to replace the current one (limit ~5 per 7 days)

Type the appropriate number [1-2] or any other key to cancel: 1
Issuing new SSL cert with acme.sh
Testing Nginx configuration     [OK]
Reloading Nginx                 [OK]
Congratulations! Successfully Configured SSL on https://mysite.com
File Not Found: /etc/letsencrypt/live/mysite.com/cert.pem
Check the WordOps log for more details `tail /var/log/wo/wordops.log` and please try again...

and I tried:


root@ubuntu-s-1vcpu-2gb-sfo2-01:~# tail /var/log/wo/wordops.log
Command Error: 
2019-12-22 16:05:35,971 (INFO) wo : Testing Nginx configuration 
2019-12-22 16:05:36,169 (INFO) wo : Testing Nginx configuration 
2019-12-22 16:05:36,170 (INFO) wo : Reloading Nginx
2019-12-22 16:05:36,213 (INFO) wo : Reloading Nginx
2019-12-22 16:05:36,214 (INFO) wo : Congratulations! Successfully Configured SSL on https://mysite.com
2019-12-22 16:05:36,214 (DEBUG) wo.core.logging : cert not found for inlady.net
2019-12-22 16:05:36,214 (DEBUG) wo.core.logging : trying with net
2019-12-22 16:05:36,214 (ERROR) wo : File Not Found: /etc/letsencrypt/live/mysite.com/cert.pem
2019-12-22 16:05:36,215 (ERROR) wo : Check the WordOps log for more details `tail /var/log/wo/wordops.log` and please try again...
root@ubuntu-s-1vcpu-2gb-sfo2-01:~#

alexlii1971

portofacil Thanks...

yes, I added:

ns1.digitalocean.com.
ns3.digitalocean.com.
ns2.digitalocean.com.

On my domain NS record

and then I tried

wo site update yourdomain.com --le

It works, and I can access the site with SSL.

and I delete the site, and I tried this command line:

wo site create youdoamin.com --wpsubdomain --wpredis --letsencrypt=wildcard

It will show the following:


Running pre-update checks       [OK]
Setting up NGINX configuration  [Done]
Setting up webroot              [Done]
Downloading WordPress           [Done]
Setting up database             [Done]
Configuring WordPress           [OK]
Installing WordPress            [OK]
Installing plugin nginx-helper  [OK]
Setting plugin nginx-helper     [OK]
Installing plugin redis-cache   [OK]
Testing Nginx configuration     [OK]
Reloading Nginx                 [OK]
WordPress admin user : admin
WordPress admin password : asdfasdfjlkjlkjljlkj
Configure redis-cache:  http://mysite/wp-admin/network/settings.php?page=redis-cache
Object Cache:           Enable
Successfully created site http://mysite.net
Certificate type : wildcard
You already have an existing certificate for the domain requested.
(ref: /etc/letsencrypt/renewal/mysite.com_ecc/mysite.com.conf)
Please select an option from below?
        1: Reinstall existing certificate
        2: Issue a new certificate to replace the current one (limit ~5 per 7 days)

Type the appropriate number [1-2] or any other key to cancel: 2
Issuing new SSL cert with acme.sh
Deploying SSL cert              [OK]

It looks work, but I can not access the site, it will on frontend browser

This site can’t be reached mysite.com took too long to respond.
Try:
Checking the connection
Checking the proxy and the firewall
ERR_TIMED_OUT

http://prntscr.com/qeh110

and I used update command line:

wo site update mysite -le

yes, I can access the site, and create a subsite, but the SSL certificate seems not a wildcard type, and I can access backend of the subsite, but the frontend page of the subsite will show: the nginx page.

go back domain management page, and delete

*.mydomain.com

It will not accessible for both backend and frontend.

So, add *.mydomain.com on domain management page, all of subsite are accessible for backend, but the frontend page will still be nginx page.

and manually change the subsite domain to be https://test.mysite.com, and the frontend will be accessible with security warning.

Then use "wo site update test.mydomain.com -le", it shows:

Site test.mydomain.com does not exist.

CONCLUSION:

1.Set NS to be ns1.digitalocean.com.
2.These three command line will all work:

wo site create mysite.com --wpsubdomain --wpredis --letsencrypt=wildcard --dns=dns_dgon
wo site create mysite.com --wpsubdomain --wpredis --letsencrypt=wildcard
wo site update mysite.com -le

but the site will will only be accessible at frontend when the last one "wo site update mysite.com -le" is used.

alexlii1971

Fixed, it works now.

The issue is from DNS setting.