When going to https://geo.synchro.net I get a "Your connect to this site is not secure" warning and that my "Certificate is not valid"/
My letsencrypt.ini settings are:
When going to https://geo.synchro.net I get a "Your connect to this site is not secure" warning and that my "Certificate is not valid"/
My letsencrypt.ini settings are:
Host = acme-v02.api.letsencrypt.org
Directory = /directory
TOSAgreed = true
GroupReadableKeyFile = false
SysopEmail = sysop@geo.synchro.net
But I keep getting this error:
8/7 09:05:42a 3144 TLS WARNING 'Received TLS alert message: Certificate unknown' (-26) setting session active
When the SYNCRYPT timed event occurs, this is what the log reports:
8/7 09:12:04a BBS Events Semaphore signaled for Timed Event:
SYNCRYPT
8/7 09:12:04a SYNCRYPT Running timed event: SYNCRYPT
8/7 09:12:04a SYNCRYPT Timed event: SYNCRYPT returned 0
Any idea what I'm doing wrong here?
Re: HTTPS Help
By: SYS64738 to all on Wed Aug 07 2024 09:24:14
Your website is using a self-signed certificate generated last Wednesday. No browser will trust it by default.
The settings look fine, but if that's the actual filename, you need to move it to 'ctrl/letsyncrypt.ini'.
Consider disabling the SYNCRYPT timed event for now and run the script manually in your exec/ directory like:
jsexec ./letsyncrypt.js
Additional command line options are listed in the wiki, but try running it without any parameters first:
https://wiki.synchro.net/module:letsyncrypt
This way you'll see the full output of the script. Once it's working, re-enable the timed event.
When letsyncrypt.js runs successfully, it'll add [key_id] and [State] sections to your letsyncrypt. ini file. If those sections don't exist, then letsyncrypt.js isn't running successfully. So try running letsyncrypt.js manuall (e.g. via jsexec) and watch the output for some helpful log message to give you a clue what to do.
--
digital man (rob)
https://wiki.synchro.net/module:letsyncrypt
This way you'll see the full output of the script. Once it's working, re-enable the timed event.
I did. It appears that everything is working as it should since this is a self-signed certificate. I do appreciate the pointers.
When letsyncrypt.js runs successfully, it'll add [key_id] and [State] sections to your letsyncrypt. ini file. If those sections don't exist, then letsyncrypt.js isn't running successfully. So try running letsyncrypt.js manuall (e.g. via jsexec) and watch the output for some helpful log message to give you a clue what to do.
Yes, it added those sections to my letsyncrypt.ini file.
As echicken
pointed out, it's a self-signed certificate. Under that circumstance, it seems logical that I would receive those responses in my log. Or am I overlooking something?
I did. It appears that everything is working as it should since this is a self-signed certificate. I do appreciate the pointers.
Re: HTTPS Help
By: SYS64738 to echicken on Wed Aug 07 2024 19:09:56
I pointed out the self-signed cert because it indicates you aren't using a Let's Encrypt cert, instead you're still on the default one generated by the BBS.
Can you confirm that you have the config filename spelled correctly? You said 'letsencrypt.ini' while it should be 'letsyncrypt.ini' - small but important difference.
Sorry for the delayed response. Yes, the file name is spelled "letsyncrypt.ini". Below is how my timed event is set up:
Re: HTTPS Help
By: SYS64738 to echicken on Sun Aug 18 2024 03:12:45
And if you do 'jsexec -A -L7 letsynccrypt.js --force' what output do you see?
I looked up line 273 and it says "ks.add_private_key(rsa, syspass);"
So, I am guessing that the key needs to be located somewhere and it is not...?
Re: HTTPS Help
By: SYS64738 to echicken on Mon Aug 19 2024 01:09 am
No, more likely, you changed your system password and need to regenerate the private key. But I would expect there to be SSH server errors too: https://wiki.synchro.net/faq:tcpip#ssh_session_key
--
digital man (rob)
Re: HTTPS Help
By: SYS64738 to echicken on Mon Aug 19 2024 01:09 am
No, more likely, you changed your system password and need to regenerate the private key. But I would expect there to be SSH server errors too: https://wiki.synchro.net/faq:tcpip#ssh_session_key
--
digital man (rob)
Ok. I moved the old cryptlib.key and ssl.cert files, restarted the BBS, and it generated new cryptlib.key and ssl.cert files.
Still getting the same error or should i give it some time?
Reading script from c:\sbbs\exec\letsyncrypt.js
c:\sbbs\exec\letsyncrypt.js compiled in 0.00 seconds
!JavaScript c:\sbbs\exec\letsyncrypt.js line 273: Error: Error -44 calling cryptAddPrivateKey()
!JavaScript c:\sbbs\exec\letsyncrypt.js line 273: Error: Error -44 calling cryptAddPrivateKey()
I don't think "giving it time" is going to fix anything. Are you getting any SSH-related errors reported by your terminal server?
--
digital man (rob)
I don't think "giving it time" is going to fix anything. Are you getting any SSH-related errors reported by your terminal server?
--
digital man (rob)
8/19 07:09:27p 2608 SSH WARNING 'Client sent malformed identifier string 'SSH-2.0-Go'' (-32) setting session active from bbs_thread
I don't think "giving it time" is going to fix anything. Are you getting any SSH-related errors reported by your terminal server?
--
digital man (rob)
I just noticed this error...?
8/19 07:09:27p 2608 SSH WARNING 'Client sent malformed identifier string 'SSH-2.0-Go'' (-32) setting session active from bbs_thread
That's kind of normal and not an issue. The SSH-related errors I was referring to would be present during terminal server startup.
--
digital man (rob)
No, more likely, you changed your system password and need to regenerate the private key. But I would expect there to be SSH server errors too: https://wiki.synchro.net/faq:tcpip#ssh_session_key
--
digital man (rob)
That error indicates that the script could not read your private key from letsyncrypt.key, but that there's already a private key in that file. The most likely causes of this issue are that the hostname of the AJAX service has changed (ie: the Host line in the State section of your INI file), or your system password has changed.
If you recently changed your system password, it's possible that my change to scfg which updated private keys when the system password is changed missed that file. If that's the case, keeping your private key will require some effort on your part... basically, you'll need to change your system password back to the old one using the current scfg, then update scfg and change it to the new one.
I'll update this ticket when/if I make that commit.
Yep, that's the problem. Pushing the commit right away. Be sure to set your syspass back first, update, then change your syspass to what you want.
Sorry for the inconvenience.
This is likely some bot connecting (using the Golang SSH package), and not relevant to your problem. (Weird though; there's nothing malformed about that identifier.)
echicken
That error indicates that the script could not read your private key from letsyncrypt.key, but that there's already a private key in that file. The most likely causes of this issue are that the hostname of the AJAX service has changed (ie: the Host line in the State section of your INI file), or your system password has changed.
If you recently changed your system password, it's possible that my change to scfg which updated private keys when the system password is changed missed that file. If that's the case, keeping your private key will require some effort on your part... basically, you'll need to change your system password back to the old one using the current scfg, then update scfg and change it to the new one.
I'll update this ticket when/if I make that commit.
Yep, that's the problem. Pushing the commit right away. Be sure to set your syspass back first, update, then change your syspass to what you want.
Sorry for the inconvenience.
Within the past couple of weeks, I did change my system password. However, I don't recall what the old system password was. Do you think this could be the issue? I tried reaching out to Deuce, but I haven't heard back.
You may have already tried this, but the best way to reach deuce is via the synchronet IRC channel.
In researching I ran across the same issue(https://gitlab.synchro.net/main/sbbs/-/issues/237) being experienced
Within the past couple of weeks, I did change my system password. However, I don't recall what the old system password was. Do you think this could be the issue? I tried reaching out to Deuce, but I haven't heard back.
I'd really have to dig through letsyncrypt.js to say. What happens if you run it with '--new-key', '--force', '--revoke', or combinations of these options?
If that doesn't help, how often do you change your system configuration? You may have several 'main.?.ini' files in your ctrl directory, which are backups of 'main.ini'. The system password is stored in this file. Perhaps one of these files is old enough to contain your previous syspass.
I'd really have to dig through letsyncrypt.js to say. What happens if you run it with '--new-key', '--force', '--revoke', or combinations of these options?
If that doesn't help, how often do you change your system configuration? You may have several 'main.?.ini' files in your ctrl directory, which are backups of 'main.ini'. The system password is stored in this file. Perhaps one of these files is old enough to contain your previous syspass.
changed it back to the old password, it started giving me errors about the syspass which had not happened before. So, I changed it back to my
"type": "urn:ietf:params:acme:error:malformed", "detail": "JWS verification error",
"status": 400
| Sysop: | Keyop |
|---|---|
| Location: | Huddersfield, West Yorkshire, UK |
| Users: | 408 |
| Nodes: | 16 (2 / 14) |
| Uptime: | 22:38:35 |
| Calls: | 8,560 |
| Calls today: | 12 |
| Files: | 13,219 |
| Messages: | 5,926,601 |
| Posted today: | 1 |