Automatically renew SSL certificate problem...

thiagotgc

I have a lot of problems with SSL auto-renewal with nGinx.

I use URLRewrite a lot, and to update the SSL, I need to remove the settings, have the SSL updated, and then go back to the settings again.

When you have few sites, OK, but this is unfeasible when you have many!

I would like to know if there is a solution for this, or ask them to put it in the update script, so that the script momentarily moves to a ".tmp" file with the current Rewrite settings, and only after finishing the update, it returns to default. ..

It's possible?

aaPanel_Kern

thiagotgc
Hello, using URL rewrite generally does not affect updating SSL. The panel automatically updates SSL at 10 am every day, which can be seen in cron.
What is your URL rewrite?

thiagotgc

aaPanel_Kern

So something is wrong with the latest versions.

I can only update the SSL, after removing everything I have in Rewirte....

aaPanel_Kern

thiagotgc
No changes have been made to applying for SSL.

Please check domain resolution before applying, unresolved domain leads to audit failure.
The certificate is valid for 3 months, supports wildcard domain. Auto-renew by default.
If you uses CDN or redirect, you may not be able to apply and renew through file verification.
When you do not specify a SSL default site, if you use HTTPS to access a site that does not have SSL enabled, you will directly access a site that has SSL enabled

thiagotgc

aaPanel_Kern

I don't think you understand!

Everything is ok and working on my website.

The renewal works, but because of some rules I have in my Rewrite, it generates an error, and the renewal is not done.

That's why I asked to check if it's possible to disable Rewrite before renewing. That way there would be no errors.

aaPanel_Kern

thiagotgc
Hello, what is the content in your URL rewrite? Is the whole site jump configured?
Maybe using DNS authentication is more suitable for you.

thiagotgc

My URL rewrite:

  # Especifique como lidar com diretórios - especificando
	index index.php index.html /index.php$request_uri;

# Definir tamanho máximo de upload
    client_max_body_size				0;

# Regra para lidar com well-known
	location ^~ /.well-known {
	location = /.well-known/carddav		{ return 301 $scheme://$host/remote.php/dav; }
	location = /.well-known/caldav		{ return 301 $scheme://$host/remote.php/dav; }
	location ^~ /.well-known            { return 301 /index.php$uri; }
		try_files $uri $uri/ =404;
}

#	location / {
#		rewrite ^ /index.php$uri;
#    	proxy_set_header	X-Real-IP			$remote_addr;
#    	proxy_set_header	X-Forwarded-For		$proxy_add_x_forwarded_for;
#    	proxy_set_header	X-Forwarded-Proto	$scheme;
#    	proxy_set_header	X-Forwarded-Port	443;
#    	proxy_set_header	Host				$host;
#}

	location ~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|/) {
		try_files $uri $uri/ =404;
		index index.php;
}

# Regra para lidar com clientes Microsoft DAV
    location = / {
        if ( $http_user_agent ~ ^DavClnt ) {
            return 302 /remote.php/webdav/$is_args$args;
        }
    }

# Ative o gzip, mas não remova os cabeçalhos ETag
    gzip								on;
    gzip_vary							on;
    gzip_comp_level						4;
    gzip_min_length						256;
    gzip_proxied						expired no-cache no-store private no_last_modified no_etag auth;
    gzip_types							application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;

# Paginas de erro
#    error_page 403 /core/templates/403.php;
#    error_page 404 /core/templates/404.php;

# Regras emprestadas de `.htaccess` para ocultar certos caminhos de clientes
    location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)  { return 404; }
    location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console)                { return 404; }

# Certifique-se de que este bloco, que passa arquivos PHP para o processo PHP, esteja acima dos blocos
#	location ~ ^/(?:index|remote|public|cron|core/ajax/update|status|ocs/v[12]|updater/.+|ocs-provider/.+|ocm-provider/.+|core/templates/40[34])\.php(?:$|/) {
    location ~ \.php(?:$|/) {
        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
        set $path_info $fastcgi_path_info;

        try_files							$fastcgi_script_name =404;

        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME		$document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO				$path_info;
        fastcgi_param HTTPS					on;

        fastcgi_param modHeadersAvailable		true;  # Evite enviar os cabeçalhos de segurança duas vezes
        fastcgi_param front_controller_active	true;  # Habilitar urls bonitos
#        fastcgi_pass							php-handler;

        fastcgi_intercept_errors			on;
        fastcgi_request_buffering			off;
		
		fastcgi_max_temp_file_size 			0;
}

# Location das paginas    
	location ~ \.(?:css|js|svg|gif|png|jpg|ico|wasm|tflite|map)$ {
		try_files $uri /index.php$request_uri;
	expires								6M;         # Política de controle de cache emprestada de `.htaccess`
	access_log							off; 	    # Opcional: não registre o acesso aos ativos
	fastcgi_buffers 64					4K;
	fastcgi_ignore_headers				X-Accel-Buffering;
	fastcgi_hide_header					X-Powered-By;

}
	location ~ \.woff2?$ {
		try_files $uri /index.php$request_uri;
	expires								7d;         # Política de controle de cache emprestada de `.htaccess`
	access_log							off; 	    # Opcional: não registre o acesso aos ativos
}

    location /remote {
        return 301 /remote.php$request_uri;
}

    location / {
        try_files $uri $uri/ /index.php$request_uri;
}

# Location das paginas  para cache
	location ~ \.(?:css|js)$ {
		try_files	$uri /index.php$uri$is_args$args;
		add_header	Cache-Control	"max-age=15778463" always;
}

	location ~ \.(?:svg|gif|png|html|ttf|woff|ico|jpg|jpeg|map|json)$ {
		try_files	$uri /index.php$uri$is_args$args;
		add_header	Cache-Control	"public, max-age=7200" always;
}

aaPanel_Kern

thiagotgc
Hi, this is already obvious: location ^~ /.well-known { return 301 /index.php$uri; }
When accessing .well-known, it is directly rewritten to index.php and cannot be verified.

thiagotgc

aaPanel_Kern

Correct! Even removing only this line, the SSL is not generated, prrciso practically remove it!

But I need the rules on many servers.

I believe I'm not the only one!

Don't you think it's convenient to temporarily disable rewirte when generating ssl?

aaPanel_Kern

thiagotgc
Hello, do not consider disabling rewirte when applying. We don't know how the user will set it up, the user environment is very complex. Not necessarily set in URL rewrite.
Like this, should use DNS authentication

thiagotgc

aaPanel_Kern

I still think that when generating SSL, delete the Rewrite settings, and after generating the New SSL, return the Rewrite settings...

That way, NOTHING will prevent the SSL update

hklcf

SSL always expire becouse aapanel don't auto update the cert...

aaPanel_Kern

hklcf
Using the panel Let's Encrypt certificate will automatically renew the SSL. Please go to the Cron interface to check the log of the task "Renew Let's Encrypt Certificate".
If you uses CDN or redirect, you may not be able to apply and renew through file verification.

hklcf

aaPanel_Kern cron job log always say "this certificate will not be renewed due to failure to renew 5 times in a row", but can gen new cert when i disable the ssl and re-enable ssl.

aaPanel_Kern

hklcf
Look up the previous log is there any other log?

hklcf

aaPanel_Kern

|-A total of 1 certificates need to be renewed
|-Renew the visa certificate and start checking the environment
[]
|-Renewing certificate number of 1，domain: ['xxx.com']..
|-Creating order..
|-'replay-nonce'

|-The domain name skipped this time: ['xxx.com'], because the last renewal failed, you still need to wait 24 hours and try again

|-The domain name skipped this time: ['xxx.com'], because the last renewal failed, you still need to wait 0 hours and try again

|-Skip the domain name this time: ['xxx.com'], this certificate will not be renewed due to failure to renew 5 times in a row, (The number of errors will be reset after manual renewal and success)

hklcf

it seem aapanel will copy the cert to "other cert" so can't auto update the cert when expire

aaPanel_Kern

hklcf
It is normal to use "Let's Encrypt" in the "Other Certificates" interface. After "Disable SSL", "Currently not deployed" will appear in the "Other Certificates" interface.

aaPanel_Kern

hklcf
This is limitation of Let's Encrypt that we can't handle either. Only pay attention to observe its errors, if there are errors, they must be solved first

aaPanel_Kern

thiagotgc
Hello, thank you for your suggestion, we will not consider this for now.
If Rewrite is set, SSL cannot be generated. Please use DNS to verify.