Recently upgraded my CyberPanel to version 2.3.2 and found that my accounts’ SSL renewal starts to fail. I checked the logs and found that there is a process that checks the acme-challenge folder for a static file before able to renew the SSL. Before this, it was randomly generated files for verification purpose.
This is how the logs look like when the renewal failed. (domain name redacted with example-domain.test to generalise this tutorial)
[06.30.2022_01-49-14] Status Code: Unkown for: http://www.example-domain.test/.well-known/acme-challenge/<example-domain.test>. Error: HTTPConnectionPool(host='www.example-domain.test', port=80): Max retries exceeded with url: /.well-known/acme-challenge/example-domain.test (Caused by NewConnectionError('<urllib3.connection.HTTPConnection object at 0x7f139d352a90>: Failed to establish a new connection: [Errno -2] Name or service not known',))
[06.30.2022_01-49-14] Status Code: 404 for: http://example-domain.test/.well-known/acme-challenge/example-domain.test. Error: <!DOCTYPE html>
<html style="height:100%">
<head>
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<title> 404 Not Found
</title></head>
<body style="color: #444; margin:0;font: normal 14px/20px Arial, Helvetica, sans-serif; height:100%; background-color: #fff;">
<div style="height:auto; min-height:100%; "> <div style="text-align: center; width:800px; margin-left: -400px; position:absolute; top: 30%; left:50%;">
<h1 style="margin:0; font-size:150px; line-height:150px; font-weight:bold;">404</h1>
<h2 style="margin-top:20px;font-size: 30px;">Not Found
</h2>
<p>The resource requested could not be found on this server!</p>
</div></div><div style="color:#f0f0f0; font-size:12px;margin:auto;padding:0px 30px 0px 30px;position:relative;clear:both;height:100px;margin-top:-101px;background-color:#474747;border-top: 1px solid rgba(0,0,0,0.15);box-shadow: 0 1px 0 rgba(255, 255, 255, 0.3) inset;">
<br>Proudly powered by <a style="color:#fff;" href="http://www.litespeedtech.com/error-page">LiteSpeed Web Server</a><p>Please be advised that LiteSpeed Technologies Inc. is not a web hosting company and, as such, has no control over content found on this site.</p></div></body></html>
[06.30.2022_01-49-16] /root/.acme.sh/acme.sh --issue -d example-domain.test -d www.example-domain.test --cert-file /etc/letsencrypt/live/<example-domain.test>/cert.pem --key-file /etc/letsencrypt/live/<example-domain.test>/privkey.pem --fullchain-file /etc/letsencrypt/live/<example-domain.test>/fullchain.pem -w /usr/local/lsws/Example/html -k ec-256 --force --server letsencrypt
[06.30.2022_01-49-16] Failed to obtain SSL for: example-domain.test and: www.example-domain.test
[06.30.2022_01-49-16] /root/.acme.sh/acme.sh --issue -d example-domain.test --cert-file /etc/letsencrypt/live/<example-domain.test>/cert.pem --key-file /etc/letsencrypt/live/<example-domain.test>/privkey.pem --fullchain-file /etc/letsencrypt/live/example-domain.test/fullchain.pem -w /usr/local/lsws/Example/html -k ec-256 --force --server letsencrypt
[06.30.2022_01-49-16] Failed to obtain SSL, issuing self-signed SSL for: example-domain.test
[06.30.2022_01-49-16] [Errno 111] Connection refused
[06.30.2022_01-49-17] Self signed SSL issued for example-domain.test.
Workaround solutions
The workaround I’ve found to work for me is to manually create the static file and Issue the SSL from GUI.
Option 1 – Using Command Line
- Create the folders and files
# mkdir -p /home/example-domain.test/public_html/.well-known/acme-challenge
# touch /home/example-domain.test/public_html/.well-known/acme-challenge/example-domain.test
- Repeat touch command for each sub-domains you have. (Including www.)
- Ensure all domain and subdomains IPs are pointing to the hosting CyberPanel’s IP address(es).
- Issue the SSL from GUI
CyberPanel Issue SSL module
Option 2 – Using File Manager
1. Original directory structure
2. Create .well-known folder inside public_html folder
3 Create acme-challenge folder inside .well-known folder
4. Create a static file named after your domain or subdomain name
5. Full file and directory structure
6. Issue SSL from CyberPanel GUI