Major SSL Certificate issues in CyberPanel
1. A Record or IP Address Issue
CyberPanel can only get you certificates for the websites that are on the server and the domain that is connected to the server too. In order to verify this, you can use Whats My DNS to verify that the A record for your domain points to the server IP shown on the top left of the CyberPanel dashboard just below the CyberPanel logo.
If that doesn’t match, kindly change the A record to this IP in your domain manager’s DNS settings. If you are using Cloudflare, you might see a different IP on Whats My DNS but you should make sure that the IP in DNS setting is the same as the server IP.
2. ACME Client Verification
CyberPanel uses acme-client for issuance and regeneration of SSL certificates every 90 days. Sometimes either the client is outdated or removed from the server that makes the whole process impossible.
In order to check and update the ACME client to the latest version run the following command:
wget -O - https://get.acme.sh | sh
Now you can go back to the menu and choose Manage SSL from the SSL menu to issue SSL again.
3. Folder permissions
Let’s Encrypt Authority verifies that you are indeed the owner and in control of the domain that you want to get a certificate for so they offer a few forms of verification.
HTTP-01 Challenge (or file-based challenge): This is the most common challenge type currently. Let’s Encrypt gives a token to your ACME client, and your ACME client puts a file on your web server at http://<YOUR_DOMAIN>/.well-known/acme-challenge/<TOKEN>.
DNS-01 challenge: This challenge asks you to prove that you control the DNS for your domain name by putting a specific value in a TXT record under that domain name. Let’s Encrypt gives your ACME client a token, your client will create a TXT record derived from that token and your account key, and put that record at _acme-challenge.<YOUR_DOMAIN>
CyberPanel uses file-based verification because it’s easier and DNS records can take a very long time to propagate.
Sometimes, users change files and folder permission which makes it impossible CyberPanel to add the required file for the verification and the verification fails.
In order to fix these issues go to Websites->List Websites where you will see something like this
Click the Manage button next to the website that you want to issue SSL for and you will be greeted with a screen like this
Use the File Manager option to open the file manager for that website. Once the file manager is open, click the Fix Permissions button on the top right.
CyberPanel will fix the permissions for you and then you can issue a SSL certificate from SSL->Manage SSL as shown in the first issue.
4. ModSecurity Blocking
CyberPanel comes with ModSecurity that keeps your server and websites safe from a variety of hacking attempts and spam content, however sometimes as a false-positive, it can block legitimate traffic considering it spam or an attack.
Lets Encrypt verifies the identity of the domain by checking whether the file it provides is available at your domain or not. It does so by accessing that file from multiple servers to confirm that you are indeed the owner or authorized person for that domain. As they issue millions of certificates per day, their servers generate a lot of traffic and sometimes spam-fighting companies see a lot of similar traffic as spam and they put Lets Encrypt server IPs on their blacklists.
As a result, ModSecurity blocks all connections from those IPs and Let’s Encrypt isn’t able to verify the domain causing a failure to issue a SSL certificate.
There is a simple workaround to be able to issue SSL certificates in this case.
Go to Security-> ModSecurity Conf and you will be greeted with this screen
Turn off ModSecurity then go to SSL → Manage SSL and issue SSL certificate for your website. Once you are done, turn the ModSecurity back on.
Debugging with command line
If none of the above worked for you, it means you have a different issue that needs to be debugged and fixed. In order to do that, go to your terminal and type the following.
/root/.acme.sh/acme.sh --issue -d <YOUR\_DOMAIN> -d www.<YOUR\_DOMAIN> --cert-file /etc/letsencrypt/live/<YOUR\_DOMAIN>/cert.pem --key-file /etc/letsencrypt/live/<YOUR\_DOMAIN>/privkey.pem --fullchain-file /etc/letsencrypt/live/<YOUR\_DOMAIN>/fullchain.pem -w /home/<YOUR\_DOMAIN>/public\_html --force --debug
