1. Forum
  2. FidoNet
  3. SYNC SYSOPS

  • Letsencrypt

    From Clifra Jones@1:103/705 to all on Wed Aug 29 19:54:49 2018
    OK, i am trying to setup LetsEncrypt and the instructions seem quite simple but, I don't see a letsencrypt.ini file in the ctrl directory.


    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP

    ---
    * Synchronet * Days of Old BBS Telnet/SSH(2222)/Web daysofoldbbs.wilhartsolutions.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Tony Langdon@3:633/410 to Clifra Jones on Thu Aug 30 14:32:00 2018
    On 08-29-18 19:54, Clifra Jones wrote to all <=-

    OK, i am trying to setup LetsEncrypt and the instructions seem quite simple but, I don't see a letsencrypt.ini file in the ctrl directory.

    I haven't tried it for Synchronet yet. Not sure how you're trying to do it, but I was thinking of running Synchronet behind a nginx reverse proxy, with the reverse proxy doing the SSL. While I've converted my regular Apache hosted websites to SSL using LetsEncrypt, I haven't worked on Synchronet yet.


    ... That must be wonderful! I don't understand it at all.
    === MultiMail/Win v0.51
    --- SBBSecho 3.03-Linux
    * Origin: Freeway BBS Bendigo,Australia freeway.apana.org.au (3:633/410)
  • From Nelgin@1:103/705 to Clifra Jones on Thu Aug 30 01:00:55 2018
    Clifra wrote:
    OK, i am trying to setup LetsEncrypt and the instructions seem quite simple but, I don't see a letsencrypt.ini file in the ctrl directory.

    I didn't have to set one up, that was done automatically somehow.

    Have you tried jsexec letsyncrypt.js --new-key

    This should force a new key to be created.

    ---
    * Synchronet * End Of The Line BBS - endofthelinebbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Clifra Jones@1:103/705 to Nelgin on Thu Aug 30 07:38:26 2018
    Tried that, now I get this.
    Reading script from /sbbs/exec/letsyncrypt.js
    /sbbs/exec/letsyncrypt.js compiled in 0.00 seconds
    Getting directory.
    Calling keyChange.
    {
    "type": "urn:ietf:params:acme:error:malformed",
    "detail": "Inner JWS does not contain old key field matching current account key",
    "status": 400
    }
    !JavaScript : uncaught exception: keyChange did not return 200 /sbbs/exec/letsyncrypt.js executed in 0.59 seconds
    !Module (letsyncrypt.js) set exit_code: 1

    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP



    OK I re-ran the script with no parameters and it ran and got a certificate. The problem is it is connecting to the staging service and retreiving an invalid certificate.

    Issued by : Fake LE Intermediate X1

    I looked this up on their forum and yes, this is what is issued by the staging service. When I entered the production URL into the leysyncrypt.ini Host=https://acme-v02.api.letsencrypt.org
    Directory=/directory

    Then I get an error: Unable to connect

    This is a valid URL, https://acme-v02.api.letsencrypt.org/directory works in the browser.

    here is a post that states the new acme-v02 production endpoint https://communi ty.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578


    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP

    ---
    * Synchronet * Days of Old BBS Telnet/SSH(2222)/Web daysofoldbbs.wilhartsolutions.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Nelgin@1:103/705 to Clifra Jones on Thu Aug 30 10:29:52 2018
    Clifra wrote:
    OK I re-ran the script with no parameters and it ran and got a certificate.
    The
    problem is it is connecting to the staging service and retreiving an invalid certificate.

    Issued by : Fake LE Intermediate X1

    I looked this up on their forum and yes, this is what is issued by the
    staging
    service. When I entered the production URL into the leysyncrypt.ini Host=https://acme-v02.api.letsencrypt.org
    Directory=/directory

    Then I get an error: Unable to connect

    This is a valid URL, https://acme-v02.api.letsencrypt.org/directory works in the browser.

    here is a post that states the new acme-v02 production endpoint
    https://communi
    ty.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578

    My letsencrypt.ini looks like this

    TOSAgreed=true
    [key_id] endofthelinebbs.com=https://acme-staging-v02.api.letsencrypt.org/acme/acct/xxxx acme-v02.api.letsencrypt.org=https://acme-v02.api.letsencrypt.org/acme/acct/xxxxx
    [State]
    DomainHash=whatever
    Host=acme-v02.api.letsencrypt.org


    Obviously replacing the account number and domainhash for privacy. Seems to
    be using the staging server and it works fine, tho that was last month so
    it's not scheduled to renew for another couple of months.

    ---
    * Synchronet * End Of The Line BBS - endofthelinebbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Clifra Jones@1:103/705 to Clifra Jones on Thu Aug 30 10:31:03 2018
    OK I re-ran the script with no parameters and it ran and got a certificate. The problem is it is connecting to the staging service and retreiving an invalid certificate.

    Issued by : Fake LE Intermediate X1

    I looked this up on their forum and yes, this is what is issued by the staging service. When I entered the production URL into the leysyncrypt.ini Host=https://acme-v02.api.letsencrypt.org
    Directory=/directory

    Then I get an error: Unable to connect

    This is a valid URL, https://acme-v02.api.letsencrypt.org/directory works in the browser.

    here is a post that states the new acme-v02 production endpoint https://communi ty.letsencrypt.org/t/acme-v2-production-environment-wildcards/55578

    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP



    Never mind. I'm an idiot.

    You do not put https:// in the Host entry nt he letsyncrypt.ini file!


    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP

    ---
    * Synchronet * Days of Old BBS Telnet/SSH(2222)/Web daysofoldbbs.wilhartsolutions.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Clifra Jones@1:103/705 to Clifra Jones on Thu Aug 30 10:46:53 2018
    Never mind. I'm an idiot.

    You do not put https:// in the Host entry in the letsyncrypt.ini file!

    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP



    Yes I am an idiot for the above but now that it suns with the correct host and appears to successfully download the ceertificate it still shows the staging certificate when browsing the the BBS web site.

    Common Name (CN).daysofoldbbs.wilhartsolutions.com
    Organization (O).<Not Part Of Certificate>
    Organizational Unit (OU).<Not Part Of Certificate>
    Common Name (CN).Fake LE Intermediate X1
    Organization (O).<Not Part Of Certificate>
    Organizational Unit (OU).<Not Part Of Certificate>
    Issued On.Wednesday, August 29, 2018 at 8:02:50 PM
    Expires On.Tuesday, November 27, 2018 at 7:02:50 PM

    Not sure if these times are US east but last time I ran teh script was 10:45. Is there anyway to remove all certificates? I tried --revoke and --force

    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP

    ---
    * Synchronet * Days of Old BBS Telnet/SSH(2222)/Web daysofoldbbs.wilhartsolutions.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Clifra Jones@1:103/705 to Clifra Jones on Thu Aug 30 11:08:59 2018
    Yes I am an idiot for the above but now that it suns with the correct host and appears to successfully download the ceertificate it still shows the staging certificate when browsing the the BBS web site.

    Common Name (CN).daysofoldbbs.wilhartsolutions.com
    Organization (O).<Not Part Of Certificate>
    Organizational Unit (OU).<Not Part Of Certificate>
    Common Name (CN).Fake LE Intermediate X1
    Organization (O).<Not Part Of Certificate>
    Organizational Unit (OU).<Not Part Of Certificate>
    Issued On.Wednesday, August 29, 2018 at 8:02:50 PM
    Expires On.Tuesday, November 27, 2018 at 7:02:50 PM

    Not sure if these times are US east but last time I ran teh script was 10:45. Is there anyway to remove all certificates? I tried --revoke and --force

    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP



    I got it. I found the ssl.cert in the ctrl directtory, deleted it re-ran the letsyncrypt.js script and that fixed it.

    For anyones future reference.

    letsyncript.ini
    Host=acme-v02.api.letsencrypt.org
    Directory=/directory
    TOSAggreed=true
    [Domain]
    yourdomain=yourwebroot

    Domain may or not be required, I don't know.

    Sorry for all the posts. I was pulling my hair out on this.

    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP

    ---
    * Synchronet * Days of Old BBS Telnet/SSH(2222)/Web daysofoldbbs.wilhartsolutions.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Draco@1:103/705 to Clifra Jones on Sun Sep 2 00:12:22 2018
    Yes I am an idiot for the above but now that it suns with the correct
    host
    and appears to successfully download the ceertificate it still shows the staging certificate when browsing the the BBS web site.

    Common Name (CN).daysofoldbbs.wilhartsolutions.com
    Organization (O).<Not Part Of Certificate>
    Organizational Unit (OU).<Not Part Of Certificate>
    Common Name (CN).Fake LE Intermediate X1
    Organization (O).<Not Part Of Certificate>
    Organizational Unit (OU).<Not Part Of Certificate>
    Issued On.Wednesday, August 29, 2018 at 8:02:50 PM
    Expires On.Tuesday, November 27, 2018 at 7:02:50 PM

    Not sure if these times are US east but last time I ran teh script was 10:45. Is there anyway to remove all certificates? I tried --revoke and --force

    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP



    I got it. I found the ssl.cert in the ctrl directtory, deleted it re-ran
    the
    letsyncrypt.js script and that fixed it.

    For anyones future reference.

    letsyncript.ini
    Host=acme-v02.api.letsencrypt.org
    Directory=/directory
    TOSAggreed=true
    [Domain]
    yourdomain=yourwebroot

    Domain may or not be required, I don't know.

    Sorry for all the posts. I was pulling my hair out on this.


    I have this format in my ini file, and keep getting an error...

    Calling newOrder.
    {
    "type": "urn:ietf:params:acme:error:malformed",
    "detail": "JWS verification error",
    "status": 400
    }
    !JavaScript : uncaught exception: newOrder responded with 400 not 201

    I have no idea how to fix it. I have tried renaming the key, running with both --new-key and --force, revoke crashes out hard. No clue how to fix this...

    --Draco--

    ---
    * Synchronet * Loki's Den BBS - http://lokisdenbbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From echicken@1:103/705 to Draco on Sun Sep 2 10:13:18 2018
    Re: Re: Letsencrypt
    By: Draco to Clifra Jones on Sun Sep 02 2018 00:12:22

    [Domain]
    yourdomain=yourwebroot

    Domain may or not be required, I don't know.

    I have this format in my ini file, and keep getting an error...

    !JavaScript : uncaught exception: newOrder responded with 400 not 201

    letsencrypt.js tries to load a section called [Domains] from the ini file, not [Domain]. If your section is called [Domain], this could be the problem (some necessary parameters are missing).

    ---
    echicken
    electronic chicken bbs - bbs.electronicchicken.com - 416-273-7230
    * Synchronet * electronic chicken bbs - bbs.electronicchicken.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Draco@1:103/705 to echicken on Sun Sep 2 12:29:38 2018
    Re: Re: Letsencrypt
    By: Draco to Clifra Jones on Sun Sep 02 2018 00:12:22

    [Domain]
    yourdomain=yourwebroot

    Domain may or not be required, I don't know.

    I have this format in my ini file, and keep getting an error...

    !JavaScript : uncaught exception: newOrder responded with 400 not 201

    letsencrypt.js tries to load a section called [Domains] from the ini file, not [Domain]. If your section is called [Domain], this could be the
    problem
    (some necessary parameters are missing).


    I did forget the "s" so it's now Domains. Now I'm getting:

    Calling keyChange.
    {
    "type": "urn:ietf:params:acme:error:malformed",
    "detail": "JWS verification error",
    "status": 400
    }
    !JavaScript : uncaught exception: keyChange did not return 200

    I'm just curious though. Why I can't use Certbot to grab a key and import it? This seems like it's reinventing the wheel.

    Thank you for your help.

    --Draco--

    ---
    * Synchronet * Loki's Den BBS - http://lokisdenbbs.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From echicken@1:103/705 to Draco on Sun Sep 2 19:32:31 2018
    Re: Re: Letsencrypt
    By: Draco to echicken on Sun Sep 02 2018 12:29:38

    I'm just curious though. Why I can't use Certbot to grab a key and import it? This seems like it's reinventing the wheel.

    Beats me; I have never used this script. (I do my Let's Encrypt stuff entirely outside of Synchronet.) Maybe this was done just for the sake of having something automagical and built in. Sysops are not always the most technically proficient bunch and sometimes less setup / fewer external dependencies are better. This might also be easier to migrate along with your BBS to a new server. (Shrug.)

    ---
    echicken
    electronic chicken bbs - bbs.electronicchicken.com - 416-273-7230
    * Synchronet * electronic chicken bbs - bbs.electronicchicken.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)
  • From Clifra Jones@1:103/705 to Draco on Tue Sep 4 15:19:34 2018
    problem

    I did forget the "s" so it's now Domains. Now I'm getting:

    Calling keyChange.
    {
    "type": "urn:ietf:params:acme:error:malformed",
    "detail": "JWS verification error",
    "status": 400
    }
    !JavaScript : uncaught exception: keyChange did not return 200

    I'm just curious though. Why I can't use Certbot to grab a key and import it? This seems like it's reinventing the wheel.

    Thank you for your help.

    --Draco--

    ---
    N++ Synchronet N++ Loki's Den BBS - http://lokisdenbbs.com



    Are you using the --newlkey parameter? I could never get --new-key to work. If just running the script with no parameters does not work and trying --force does not work then you could try what I did. delete the ssl.cert from the ctrl directory and remove the key information from the ini file if it is there now.

    Clifra Jones
    Sysop, Days of Old BBS
    Hostname: daysofoldbbs.wilhartsolutions.com
    Protocols: Telnet, SSH (2222), HTTP

    ---
    * Synchronet * Days of Old BBS Telnet/SSH(2222)/Web daysofoldbbs.wilhartsolutions.com
    * Origin: Vertrauen - [vert/cvs/bbs].synchro.net (1:103/705)