LinuxAzurAdminSys

30 aout 2019

Reste à faire :

problème avec le certifcat de mail sur h24.linux-azur.org:993 périmé le 28 aout 2019.

sudo netstat -ntlp | grep 993
tcp        0      0 0.0.0.0:993             0.0.0.0:*               LISTEN      1/init          
tcp6       0      0 :::993                  :::*                    LISTEN      1/init 

lhardy@h24:~/letsencrypt$ sudo netstat -ntp | grep 993
tcp        0      0 185.45.253.51:993       91.166.171.228:52336    ESTABLISHED 2306/imap-login 
tcp        0      0 185.45.253.51:993       91.166.171.228:52340    ESTABLISHED 2310/imap-login 
tcp        0      0 185.45.253.51:993       91.166.171.228:52346    ESTABLISHED 3154/imap-login 
tcp        0      0 185.45.253.51:993       91.166.171.228:52348    ESTABLISHED 3156/imap-login 
tcp        0      0 185.45.253.51:993       91.166.171.228:52338    ESTABLISHED 2307/imap-login 

plhardy@h24:~$ sudo ls -la /proc/2306/exe
lrwxrwxrwx 1 root root 0 août  30 09:28 /proc/2306/exe -> /usr/lib/dovecot/imap-login


configuration de dovecot

10-ssl.conf:ssl_cert = </etc/ssl/certs/dovecot.pem


plhardy@h24:/etc/dovecot$ ls -la /etc/ssl/certs/dovecot.pem
-rw-r--r-- 1 root root 1472 août 28 2017 /etc/ssl/certs/dovecot.pem

certificat autosigné Subject: C=FR, ST=PACA, L=ANTIBES, O=Linux Azur, OU=MAIL Server, CN=*.linux-azur.org/emailAddress=postmaster@linux-azur.org

openssl x509 -text -in /etc/ssl/certs/dovecot.pem
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            af:2c:c2:c0:79:a8:6b:b5
    Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=FR, ST=PACA, L=ANTIBES, O=Linux Azur, OU=MAIL Server, CN=*.linux-azur.org/emailAddress=postmaster@linux-azur.org
        Validity
            Not Before: Aug 28 20:07:39 2017 GMT
            Not After : Aug 28 20:07:39 2019 GMT
        Subject: C=FR, ST=PACA, L=ANTIBES, O=Linux Azur, OU=MAIL Server, CN=*.linux-azur.org/emailAddress=postmaster@linux-azur.org
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:ca:2f:40:65:e2:f3:12:b8:6b:29:f0:e0:06:6b:
                    31:31:8a:16:6a:36:4e:ba:b2:8f:d2:30:d9:90:28:
                    ba:e0:90:b4:86:e3:6d:41:38:98:28:83:b0:2c:48:
                    4c:07:ed:d9:df:cf:57:bf:c4:b4:26:d4:30:9f:a6:
                    d4:df:c6:48:2c:54:c6:ff:a4:1b:56:30:f5:13:2b:
                    20:1a:23:1e:cb:aa:be:27:d1:9f:60:6f:fc:79:9c:
                    6c:bf:42:41:45:32:42:4b:69:f7:66:cf:bf:03:58:
                    ee:4c:3a:8d:0a:75:7a:2b:d9:95:f9:9c:92:77:4f:
                    80:9a:3b:de:ed:3a:03:27:a5:99:94:9c:d4:90:ed:
                    50:19:61:20:3d:81:39:5d:fb:3a:3e:51:91:2f:a0:
                    11:b0:4a:1b:c8:fa:83:99:b8:af:c6:88:8c:bf:89:
                    fd:3f:bc:ed:ed:5d:98:43:cb:d9:6f:ba:d5:bb:3e:
                    f7:2f:4f:5f:66:92:5e:98:63:22:13:4c:5a:15:f0:
                    f2:df:58:f0:64:5b:ee:04:16:5e:25:5f:28:af:e8:
                    0d:b2:32:62:59:f7:a7:28:9b:de:00:6c:13:5f:7e:
                    38:83:c8:7d:00:53:6a:1b:5c:3b:a2:e8:b1:36:fb:
                    34:40:bb:4c:aa:b2:b2:7a:9f:21:49:e3:bd:ee:c1:
                    d4:e3
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                A1:38:9C:2F:4F:78:3C:94:58:A4:C0:D1:9F:04:02:FD:15:7D:07:D9
            X509v3 Authority Key Identifier: 
                keyid:A1:38:9C:2F:4F:78:3C:94:58:A4:C0:D1:9F:04:02:FD:15:7D:07:D9

            X509v3 Basic Constraints: 
                CA:TRUE
    Signature Algorithm: sha256WithRSAEncryption
         2e:a5:12:85:4e:af:cc:c9:df:67:9a:07:28:27:34:be:de:4b:
         b3:50:90:81:e5:c9:f5:98:a3:73:03:62:1d:4a:fd:46:61:83:
         a4:60:a9:12:9b:f7:11:da:ee:32:44:d2:46:f3:10:23:d8:08:
         ef:55:06:18:0a:b5:05:ea:f7:d7:62:aa:e4:61:3d:f4:cf:fb:
         92:df:38:97:f6:12:4e:82:2c:fd:b2:59:89:d6:cf:a5:55:bc:
         51:cf:ed:43:24:21:e1:04:3a:b0:c3:0a:6c:08:ed:20:70:21:
         b3:15:ce:ec:29:ba:87:01:e2:d1:c5:72:6d:89:c2:db:46:d8:
         a2:89:71:aa:ae:51:f2:84:ed:29:4e:d8:91:1c:d5:f7:30:70:
         c3:55:3f:79:21:90:e9:b1:e7:67:e6:f1:3c:64:11:89:a8:cf:
         05:08:64:58:1b:a6:ea:96:0c:76:17:bd:12:0c:d8:9a:ad:17:
         38:e2:5c:ed:08:cf:60:51:af:38:a1:84:dd:d1:3f:36:64:23:
         95:da:42:c3:db:75:7d:a4:ba:49:ff:cc:5f:8d:93:fc:ee:87:
         b7:6f:67:9c:cf:9c:6e:f6:b2:43:59:47:13:e9:b4:a1:0b:ca:
         c2:22:d8:a2:89:f0:1e:5f:3d:82:bf:04:c0:93:d6:b1:39:89:
         67:d5:9a:82
-----BEGIN CERTIFICATE-----
MIIEETCCAvmgAwIBAgIJAK8swsB5qGu1MA0GCSqGSIb3DQEBCwUAMIGeMQswCQYD
VQQGEwJGUjENMAsGA1UECAwEUEFDQTEQMA4GA1UEBwwHQU5USUJFUzETMBEGA1UE
CgwKTGludXggQXp1cjEUMBIGA1UECwwLTUFJTCBTZXJ2ZXIxGTAXBgNVBAMMECou
bGludXgtYXp1ci5vcmcxKDAmBgkqhkiG9w0BCQEWGXBvc3RtYXN0ZXJAbGludXgt
YXp1ci5vcmcwHhcNMTcwODI4MjAwNzM5WhcNMTkwODI4MjAwNzM5WjCBnjELMAkG
A1UEBhMCRlIxDTALBgNVBAgMBFBBQ0ExEDAOBgNVBAcMB0FOVElCRVMxEzARBgNV
BAoMCkxpbnV4IEF6dXIxFDASBgNVBAsMC01BSUwgU2VydmVyMRkwFwYDVQQDDBAq
LmxpbnV4LWF6dXIub3JnMSgwJgYJKoZIhvcNAQkBFhlwb3N0bWFzdGVyQGxpbnV4
LWF6dXIub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyi9AZeLz
ErhrKfDgBmsxMYoWajZOurKP0jDZkCi64JC0huNtQTiYKIOwLEhMB+3Z389Xv8S0
JtQwn6bU38ZILFTG/6QbVjD1EysgGiMey6q+J9GfYG/8eZxsv0JBRTJCS2n3Zs+/
A1juTDqNCnV6K9mV+ZySd0+Amjve7ToDJ6WZlJzUkO1QGWEgPYE5Xfs6PlGRL6AR
sEobyPqDmbivxoiMv4n9P7zt7V2YQ8vZb7rVuz73L09fZpJemGMiE0xaFfDy31jw
ZFvuBBZeJV8or+gNsjJiWfenKJveAGwTX344g8h9AFNqG1w7ouixNvs0QLtMqrKy
ep8hSeO97sHU4wIDAQABo1AwTjAdBgNVHQ4EFgQUoTicL094PJRYpMDRnwQC/RV9
B9kwHwYDVR0jBBgwFoAUoTicL094PJRYpMDRnwQC/RV9B9kwDAYDVR0TBAUwAwEB
/zANBgkqhkiG9w0BAQsFAAOCAQEALqUShU6vzMnfZ5oHKCc0vt5Ls1CQgeXJ9Zij
cwNiHUr9RmGDpGCpEpv3EdruMkTSRvMQI9gI71UGGAq1Ber312Kq5GE99M/7kt84
l/YSToIs/bJZidbPpVW8Uc/tQyQh4QQ6sMMKbAjtIHAhsxXO7Cm6hwHi0cVybYnC
20bYoolxqq5R8oTtKU7YkRzV9zBww1U/eSGQ6bHnZ+bxPGQRiajPBQhkWBum6pYM
dhe9EgzYmq0XOOJc7QjPYFGvOKGE3dE/NmQjldpCw9t1faS6Sf/MX42T/O6Ht29n
nM+cbvayQ1lHE+m0oQvKwiLYoonwHl89gr8EwJPWsTmJZ9Wagg==
-----END CERTIFICATE-----


utilisation de ce tuto : https://aoeex.com/phile/postfix-dovecot-and-lets-encrypt-certificates/

arrêt de apache2 pour pouvoir faire la certification en local.

reboot ( uptime de 417 jours )

renouvellement des certificats

cd /home/plhardy
cd letsencrypt
git pull
./certbot-auto renew


résultat :

The following certs could not be renewed:
  /etc/letsencrypt/live/stats.linux-azur.org/fullchain.pem (failure)
  /etc/letsencrypt/live/webmail.linux-azur.org/fullchain.pem (failure)
  /etc/letsencrypt/live/wiki.linux-azur.org/fullchain.pem (failure)



The following certs were successfully renewed:
  /etc/letsencrypt/live/blog.linux-azur.org/fullchain.pem (success)
  /etc/letsencrypt/live/jm2l.linux-azur.org/fullchain.pem (success)
  /etc/letsencrypt/live/lists.linux-azur.org/fullchain.pem (success)

The following certs could not be renewed:
  /etc/letsencrypt/live/stats.linux-azur.org/fullchain.pem (failure)
  /etc/letsencrypt/live/webmail.linux-azur.org/fullchain.pem (failure)
  /etc/letsencrypt/live/wiki.linux-azur.org/fullchain.pem (failure)

Additionally, the following renewal configurations were invalid: 
  /etc/letsencrypt/renewal/prototype.linux-azur.org.conf (parsefail)
  /etc/letsencrypt/renewal/www.linux-azur.org.conf (parsefail)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
3 renew failure(s), 2 parse failure(s)


sites renouvelés et vérifié depuis mon client à la maison :

https://www.linux-azur.org/
https://secure.linux-azur.org/webmail/
https://wiki.linux-azur.org

A FAIRE : nettoyage des configurations letsencrypt inutilisées.

Juillet 2019

etherpad ne semble pas avoir été configuré en https , en tout cas je n\'ai pas trouvé le certificat qui validerait pad.linux-azur.org.
voir etherpad


Certificat qui périme

les sites à vérifier

https://linux-azur.org
https://www.linux-azur.org
https://blog.linux-azur.org
https://webmail.linux-azur.org
https://secure.linux-azur.org/webmail/

ATTENTION nous sommes plusieurs ( philippe & fx ) à mettre cela à jour cela a entrainé des incohérences.

Renouvelé jusqu\"au 28 septembre 2019

X509v3 Subject Alternative Name: 
                DNS:blog.linux-azur.org, DNS:compta.linux-azur.org, DNS:git.linux-azur.org, DNS:jm2l.linux-azur.org, DNS:linux-a
zur.org, DNS:lists.linux-azur.org, DNS:secure.linux-azur.org, DNS:stats.linux-azur.org, DNS:webmail.linux-azur.org, DNS:wiki.lin
ux-azur.org, DNS:www.linux-azur.org


philippe :
réaligné les informations pour êtres dans /etc/letsencrypt/live/blog.linux-azur.org et non dans /etc/letsencrypt/live/blog.linux-azur.org-0002

diff blog.linux-azur.org.conf blog.linux-azur.org.conf~
2,5c2,5
< cert = /etc/letsencrypt/live/blog.linux-azur.org/cert.pem
< privkey = /etc/letsencrypt/live/blog.linux-azur.org/privkey.pem
< chain = /etc/letsencrypt/live/blog.linux-azur.org/chain.pem
< fullchain = /etc/letsencrypt/live/blog.linux-azur.org/fullchain.pem
---
> cert = /etc/letsencrypt/live/blog.linux-azur.org-0002/cert.pem
> privkey = /etc/letsencrypt/live/blog.linux-azur.org-0002/privkey.pem
> chain = /etc/letsencrypt/live/blog.linux-azur.org-0002/chain.pem
> fullchain = /etc/letsencrypt/live/blog.linux-azur.org-0002/fullchain.pem



Renouvelé jusqu\'au 18 septembre 2019

Ceci veut dire qu\'il faudra le renouveller fin aout.

Les certificats letsencrypt ont une durée de validité de 3 mois, il est conseillé de les renouveller un mois à l\'avance, donc tous les deux mois il faut s\'assurer de bien faire le travail.

En pratique PhilippeLhardy s\'en occupe en ssh en utilisant letsencrypt certbot-auto

nom principal blog.linux-azur.org
nom secondaires ( X509v3 Subject Alternative Name )
blog.linux-azur.org compta.linux-azur.org git.linux-azur.org jm2l.linux-azur.org linux-azur.org lists.linux-azur.org secure.linux-azur.org stats.linux-azur.org webmail.linux-azur.org wiki.linux-azur.org www.linux-azur.org

blank to select all options shown (Enter \'c\' to cancel): 4,5,6,7,8,13,14,15,16,17

Si on oubli un mail de letsencrypt nous le rappelle :

Hello,

Your certificate (or certificates) for the names listed below will expire in 20 days (on 10 Jul 19 10:36 +0000). Please make sure to renew your certificate before then, or visitors to your website will encounter errors.

We recommend renewing certificates automatically when they have a third of their
total lifetime left. For Let\'s Encrypt\'s current 90-day certificates, that means
renewing 30 days before expiration. See
https://letsencrypt.org/docs/integration-guide/ for details.

blog.linux-azur.org
compta.linux-azur.org
git.linux-azur.org
jm2l.linux-azur.org
linux-azur.org
lists.linux-azur.org
secure.linux-azur.org
stats.linux-azur.org
webmail.linux-azur.org
wiki.linux-azur.org
www.linux-azur.org

For any questions or support, please visit https://community.letsencrypt.org/. Unfortunately, we can\'t provide support by email.

For details about when we send these emails, please visit https://letsencrypt.org/docs/expiration-emails/. In particular, note that this reminder email is still sent if you\'ve obtained a slightly different certificate by adding or removing names. If you\'ve replaced this certificate with a newer one that covers more or fewer names than the list above, you may be able to ignore this message.

If you are receiving this email in error, unsubscribe at http://mandrillapp.com/track/unsub.php?u=30850198&id=f117ae2d86b6498dae984035e1518f02.xv1f%2FR%2FvJfm%2FQBJppCrM7eUOmY8%3D&r=https%3A%2F%2Fmandrillapp.com%2Funsub%3Fmd_email%3Dadmin%2540linux-azur.org

You may need to update your client to the latest version in case it is still using the deprecated TLS-SNI-01 validation method. https://community.letsencrypt.org/t/february-13-2019-end-of-life-for-all-tls-sni-01-validation-support/74209

Step-by-step instructions for updating Certbot are here: https://community.letsencrypt.org/t/how-to-stop-using-tls-sni-01-with-certbot/83210

Regards,
The Let\'s Encrypt Team