Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SSH deploy hook doesn't account for _ecc directory names #4552

Open
noraab opened this issue Mar 13, 2023 · 2 comments
Open

SSH deploy hook doesn't account for _ecc directory names #4552

noraab opened this issue Mar 13, 2023 · 2 comments

Comments

@noraab
Copy link

noraab commented Mar 13, 2023

Steps to reproduce

Issue a certificate (using the new default ecc #2350 ) which issues the certificates into a directory with _ecc-suffix,
Run SSH deploy hook like this:
~/.acme.sh/acme.sh --deploy -d "*.example.com" --deploy-hook ssh --debug 2

For newly issued certificates, the deploy hook fails, because it uses the directory without the _ecc-suffix. See DOMAIN_PATH below.
If you already had a certificate issued before ecc became the default, the deploy hook doesn't fail but keeps deploying the old certificates that aren't valid anymore.

Debug log

https://github.com/acmesh-official/acme.sh
v3.0.6
[Mon Mar 13 17:46:58 CET 2023] Running cmd: deploy
[Mon Mar 13 17:46:58 CET 2023] Using config home:/root/.acme.sh
[Mon Mar 13 17:46:58 CET 2023] default_acme_server='https://acme-v02.api.letsencrypt.org/directory'
[Mon Mar 13 17:46:58 CET 2023] ACME_DIRECTORY='https://acme-v02.api.letsencrypt.org/directory'
[Mon Mar 13 17:46:58 CET 2023] _ACME_SERVER_HOST='acme-v02.api.letsencrypt.org'
[Mon Mar 13 17:46:58 CET 2023] _ACME_SERVER_PATH='directory'
[Mon Mar 13 17:46:58 CET 2023] DOMAIN_PATH='/root/.acme.sh/*.example.com'
[Mon Mar 13 17:46:58 CET 2023] _deployApi='/root/.acme.sh/deploy/ssh.sh'
[Mon Mar 13 17:46:58 CET 2023] _cdomain='*.example.com'
[Mon Mar 13 17:46:58 CET 2023] _ckey='/root/.acme.sh/*.example.com/*.example.com.key'
[Mon Mar 13 17:46:58 CET 2023] _ccert='/root/.acme.sh/*.example.com/*.example.com.cer'
[Mon Mar 13 17:46:58 CET 2023] _cca='/root/.acme.sh/*.example.com/ca.cer'
[Mon Mar 13 17:46:58 CET 2023] _cfullchain='/root/.acme.sh/*.example.com/fullchain.cer'

As a workaround, adding --keylength 2048 when issuing the certificate helps.
See #4480 and #4416

@github-actions
Copy link

Please upgrade to the latest code and try again first. Maybe it's already fixed. acme.sh --upgrade If it's still not working, please provide the log with --debug 2, otherwise, nobody can help you.

@HADB
Copy link

HADB commented May 1, 2023

Same here with latest docker image: #4621

daniellockyer added a commit to TryGhost/Ghost-CLI that referenced this issue Jul 3, 2023
refs acmesh-official/acme.sh#4552

- there was a change in the acme.sh script which changed the default
  certificate type
- unfortunately this has led to breaking the SSL creation process
  because the wrong path is used
- from the referenced issue, this is a workaround that fixes the problem
  for now
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants