Resolved Wildcard SSL Certificate Auto Renewals not Working for Let's Encrypt with External DNS

[hellostorm]

Server operating system version

AlmaLinux release 8.7 (Stone Smilodon)

Plesk version and microupdate number

Plesk Obsidian Web Host Edition Version 18.0.51

Good morning all,

I've recently purchased a server from 1&1 with Plesk installed on it. It's mostly self-explanatory however I've hit a bit of a wall with a certain issue surrounding SSL certificates.

On a separate server I have using cPanel my SSLs are using Let's Encrypt and are renewed automatically by AutoSSL which is what I want to happen within my Plesk server. The SSLs in cPanel covers example.com and www.example.com but not subdomains so I believe this isn't using Wildcard SSL certificates like I'm trying to with Plesk.

I've read over so many articles in the forum but some are out-of-date so wondered if there was someone who knew how to auto renew wildcard SSLs for domains using an external DNS? I've read about some people using acme.sh but not sure if this is the right solution? All of my clients have their DNS registered with their own various registrars.

These are the articles I've read:

Issue - No automatic renewal of wildcard certificates when dns is set as secondary in plesk

On daily basis I’m getting errors by mail for renewing the lets encrypt wildcard certificates. Skip wildcard certificate renewal for the domain 'XXX'. TXT record could not be created automatically. Try to renew domain certificate manually. This seems to be related to the fact that I’m using a...

talk.plesk.com

Resolved - Let's encrypt - auto-renew with external primary DNS server?

All the domains hosted on my Plesk server are managed through an external DNS server. As far as I understand, this setup is not compatible with automatically renewing certificates from Let's Encrypt because the Plesk server needs direct access to the DNS records. So, for this to work, Plesk...

talk.plesk.com

Issue - Let's Encrypt Issues with Renewal

I'm using Let's Encrypt to secure my domains via wildcard certificates. It's set to renew the first day of every month, no matter how old the certificate is. Unfortunately that hasn't been working for quite a while now and i'm tired of manually renewing now. I get the following via mail for all...

talk.plesk.com

I would just like to have wildcards certificates auto renewed every 3 months automatically without having to find logins for my clients domains, change the DNS record etc. it would save me a lot of time trying to chase down credentials and going through 60 odd websites doing this with lots of different expiration dates is quite time consuming. There must be a way to automate this?

I'd appreciate any help here as I'm at a bit of a loss. The errors I'm getting in my /var/log/plesk/panel.log file are:

[2023-04-18 07:46:08.188] 1799053:643e4ab96c3fc ERR [extension/sslit] Failed to renew certificate of domain 'example.com': Invalid response from https://acme-v02.api.letsencrypt.org/acme/authz-v3/220394752127.
Details:
Type: urn:ietfarams:acme:error:unauthorized
Status: 403
Detail: Incorrect TXT record "CGMKSefHUHyATKnEoWE-rAaLW10475mO9ydLAmpxXGc" found at _acme-challenge.example.com

But I've checked and this DNS record does exist and it has done for the last couple of months when I first setup this domain.

If anyone has any ideas I could try, please let me know.

Thanks!

 

[Peter Debik]

There must be a way to automate this?

No, unfortunately not.

 

[hellostorm]

No, unfortunately not.

Thanks for your reply.

Does it not work just because the SSLs are domain validated and require a new TXT record. Would standard SSLs work that aren't domain validated?

Those few articles I linked in my original posts seemed to have found ways around this.

Thanks!

 

[Peter Debik]

Yes, standard SSL certs work, because they do not need the DNS entry. Only for wildcards a DNS entry is needed, because for those, a validation against "every" thinkable domain is not possible. Wildcards work when you use Plesk as DNS server, because there the required TXT record will be set automatically. This is not possible for externally hosted DNS, because it would require an interface to your specific DNS provider, login data etc.

 

[Craswer]

Hello!

I had the same problem becouse I have my DNS on Cloudflare. I followed this link to solve it: How to Auto-renew and Issue Plesk Lets Encrypt SSL certificate with Cloudflare DNS – Smart Help Guides

To generate a Wildcard certificate, I found the way to do it is by adding an NS type record for _acme-challenge pointing to the domain, and this way it takes the TXT record from Plesk.

I hope this helps someone.

 

[learning_curve]

Good morning all,

I've recently purchased a server from 1&1 with Plesk installed on it. It's mostly self-explanatory however I've hit a bit of a wall with a certain issue surrounding SSL certificates.
~~~~
If anyone has any ideas I could try, please let me know.

@hellostorm You've not said what type of server you purchased (from what was 1and1 but is now IONOS) nor (unless I've missed it) where your DNS is controlled from i.e. Plesk or External to Plesk e.g. IONOS But... FWIW.... We have IONOS Cloud Servers & all their DNS is provided external to Plesk (via our IONOS Account). For all Single Domain Normal and/or Wildcard SSL Certificates and all San (Multi-Domain) Normal and/or Wildcard SSL Certificates, we use ACME GitHub - acmesh-official/acme.sh: A pure Unix shell script implementing ACME client protocol With our IONOS Account correctly configured, we provide API access and ACME provide an API solution: dnsapi2 You can use this API manually or, (as we do) set up a CRON job for ALL SSL renewals. Yes there's a quite a bit of setup work, especially with renewals of San (Multi-Domain) Wildcard SSL Certificates... but once complete, it saves a lot of work for all SSL Renewals and (currently anyway) does what Plesk cannot do. However, IF your DNS is within Plesk and/or you do not have full route access for your IONOS server, this won't work the same way unfortunately.

 

[NickSick]

Hello!

I had the same problem becouse I have my DNS on Cloudflare. I followed this link to solve it: How to Auto-renew and Issue Plesk Lets Encrypt SSL certificate with Cloudflare DNS – Smart Help Guides

To generate a Wildcard certificate, I found the way to do it is by adding an NS type record for _acme-challenge pointing to the domain, and this way it takes the TXT record from Plesk.

I hope this helps someone.

Thank you so much!