nextcloud / nextcloud/nextcloudpi

letsencrypt - second certificate not issued

Open
#1,809 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

has-updates
Dominant language
Shell
Stars
2.9k
Forks
318
PR merge metrics
No merged PRs in 30d

Description

Trying to eissue an additional certificate for my www.my.dom domain it does nothing, more than geting the cert for nextcloud.my.dom

System information

NextcloudPi diagnostics

NextcloudPi version  v1.52.4
NextcloudPi image    NextCloudPi_RaspberryPi_v1.52.2.img
OS                   Debian GNU/Linux 11. 5.15.61-v8+ (aarch64)
automount            yes
USB devices          sda
datadir              /media/myCloudDrive/ncdata
data in SD           no
data filesystem      btrfs
data disk usage      1,4T/1,9T
rootfs usage         6,0G/29G
swapfile             /var/swap
dbdir                /media/USBdrive/ncdatabase
Nextcloud check      ok
Nextcloud version    26.0.3.2
HTTPD service        up
PHP service          up
MariaDB service      up
Redis service        up
HPB service          up
Postfix service      up
Internet check       ok
Public IPv4          ***REMOVED SENSITIVE VALUE***
Public IPv6          ***REMOVED SENSITIVE VALUE***
Port 80              open
Port 443             open
IP                   ***REMOVED SENSITIVE VALUE***
Gateway              ***REMOVED SENSITIVE VALUE***
Interface            eth0
Certificates         ***REMOVED SENSITIVE VALUE***
NAT loopback         yes
Uptime               2days

Nextcloud configuration

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": {
            "0": "localhost",
            "5": "nextcloudpi.local",
            "1": "10.0.0.4",
            "2": "nextcloud.my.dom",
            "7": "nextcloudpi",
            "8": "nextcloudpi.lan",
            "11": "nextcloud.my.dom",
            "4": "nextcloud.my.dom",
            "12": "nextcloud.my.dom",
            "20": "10.0.0.1",
            "3": "nextcloud.my.dom",
            "22": "nextcloud.my.dom",
            "14": "nextcloudpi",
            "": "nextcloud.my.dom"
        },
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "tempdirectory": "\/media\/myCloudDrive\/ncdata\/tmp",
        "overwrite.cli.url": "https:\/\/nextcloud.my.dom\/",
        "dbtype": "mysql",
        "version": "26.0.3.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "appstoreenabled": true,
        "mail_smtpmode": "smtp",
        "mail_smtpauthtype": "LOGIN",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "maintenance": false,
        "logfile": "\/media\/myCloudDrive\/ncdata\/nextcloud.log",
        "loglevel": "2",
        "log_type": "file",
        "theme": "",
        "updater.release.channel": "stable",
        "htaccess.RewriteBase": "\/",
        "jpeg_quality": "60",
        "data-fingerprint": "***REMOVED SENSITIVE VALUE***",
        "default_locale": "REMOVED",
        "default_phone_region": "REMOVED",
        "app_install_overwrite": [
            "apporder",
            "impersonate",
            "defaultlinkopen",
            "initialcheck",
            "occweb",
            "files_texteditor",
            "dashboard",
            "radio",
            "files_external_onedrive",
            "social",
            "printer",
            "admin_notifications",
            "previewgenerator",
            "weather",
            "files_trackdownloads",
            "folderplayer",
            "keeporsweep",
            "files_external_dropbox",
            "files_markdown",
            "sharingpath",
            "cms_pico",
            "ransomware_protection",
            "dicomviewer",
            "duplicatefinder"
        ],
        "mail_sendmailmode": "smtp",
        "mail_smtpsecure": "tls",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***"
    }
}

NCP Log
[ letsencrypt ] (Sat Aug 5 09:08:32 BST 2023)
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Renewing an existing certificate for nextcloud.my.dom and www.my.dom
Running deploy-hook command: /etc/letsencrypt/renewal-hooks/deploy/ncp
Error output from deploy-hook command ncp:
ERROR 1045 (28000): Access denied for user 'root'@'localhost' (using password: YES)
admin user not found

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/nextcloud.my.dom/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/nextcloud.my.dom/privkey.pem
Your certificate will expire on 2023-11-03. To obtain a new or
tweaked version of this certificate in the future, simply run
certbot again. To non-interactively renew *all* of your
certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

Installing template 'nextcloud.conf.sh'...
INFO: Letsencrypt domain is nextcloud.my.dom
INFO: Metrics enabled: no
Apache self check:
Syntax OK
System config value trusted_domains => 11 set to string nextcloud.my.dom
System config value trusted_domains => 3 set to string nextcloud.my.dom
System config value overwrite.cli.url set to string https://nextcloud.my.dom/
System config value trusted_proxies => 11 set to string 127.0.0.1
System config value trusted_proxies => 12 set to string ::1
System config value trusted_proxies => 13 set to string nextcloud.my.dom
System config value trusted_proxies => 14 set to string 10.0.0.4
Setup notify_push (attempt 1/5)
✓ redis is configured
✓ push server is receiving redis messages
✓ push server can load mount info from database
✓ push server can connect to the Nextcloud server
✓ push server is a trusted proxy
✓ push server is running the same version as the app
configuration saved

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with /var/log/letsencrypt/letsencrypt.log and the deploy hook at /etc/letsencrypt/renewal-hooks/deploy/ncp, focusing on the certificate renewal output and the MariaDB access-denied error. Reproduce the issue with certbot renewal and trace whether the requested www.my.dom certificate is created and deployed successfully; done means both domains have the expected certificate without a failing hook.

Written by the indexing model from the issue text.

Assessment

Tech stack
apache, debian, mariadb, shell
Domain
devops, infrastructure, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.