Login
You're viewing the discuss.systems public feed.
  • Tim Chasegumnos@bsd.cafe
    Oct 8, 2026, 7:56 PM

    blargh. Shot waaaay too much time trying to diagnose an httpd(8) + acme-client(1) issue on a recent #OpenBSD install.

    I pointed acme-client at the Let's Encrypt testing/dev endpoint, got the certs/chain/keys in the right place, reloaded httpd, and refreshed. Cert-chain looked like what I expected, rolling up to the (unrecognized) root and throwing Unknown CA warnings.

    So I repointed my acme-client.conf file at the *production* Let's Encrypt endpoint, re-issued the acme-client command to re-fetch them, reloaded httpd, and refreshed the browser. but still got the same errors. The chain kept showing the old dev-signing certs, not the valid ones.

    Apparently acme-client only (re)downloads certs if they're coming up on needing renewal. So acme-client was running, seeing that my bad-certs were sufficiently recent, and just not requesting/writing updated fullchain/key files.

    Deleted the bogus testing certs, re-ran acme-client, reloaded httpd, and 🪄 everything worked fine. 😑

    Hopefully this saves someone else the trouble.

    💬 2🔄 3⭐ 0

Replies

  • Tim Chasegumnos@bsd.cafe
    Oct 9, 2026, 11:25 AM

    to be fair, I could have also used the -F option to force a refresh. I should have checked the exit-status first (it returns 0 on successful certificate renewal, 1 on failure, and 2 if nothing changed).

    💬 0🔄 0⭐ 0
  • Tompertho@bsd.cafe
    Oct 8, 2026, 8:40 PM

    @gumnos Hey I got a question: On OpenBSD's acme-client, how do you find out the account URI? All I have is a private key (in PEM format). It should be something like acme-v02.api.letsencrypt.org/a (where # is a digit from 0-9). I can't seem to find it. However, certbot and dehydrated both save the account ID in files.

    💬 1🔄 0⭐ 0
  • Tim Chasegumnos@bsd.cafe
    Oct 8, 2026, 8:53 PM

    @pertho

    I used the template, updating the domain in question

    root@my.domain.com# sed 's/example.com/my.domain.com/' /etc/examples/acme-client.conf > /etc/acme-client.conf

    which has both the dev & production API endpoint URLs in it. I uncommented out the "sign with letsencrypt-staging" and commented out the "sign with letsencrypt-staging" for testing

    # acme-client my.domain.com
    # rcctl restart httpd

    and then reversed the commenting back once I'd gotten the bogus test-cert. And then deleted the bogus certs 😆

    # rm /etc/ssl/my.domain.com.fullchain.pem /etc/ssl/private/my.domain.com.key
    $ acme-client my.domain.com
    $ rcctl restart httpd

    💬 0🔄 0⭐ 0