-
Title
Let's encrypt certificate not auto-renewing -
Description
With the need of securing the traffic and data of the SMA adding a SSL certificate is a highly recommended action but there might be occasions were a CA root cert is not available and adding a Self-Signed cert is not enough, reason why on version 13.0 Let's Encrypt SSL Integration was introduced in order to provide a free integrated alternative for SSL certificates.
The Let's Encrypt SSL certificate only last for 90 days so it needs to be renewed when it gets expired.
The SMA has a built-in script that runs on the backend days before the expiration day comes in, but in some situations it may fail to renew, causing the box to be unable to auto-renew the SSL cert. -
Cause
The SMA uses HTTP-01 challenge for the renewal process to validate the domain.
The HTTP-01 challenge can only be done on port 80, If the traffic in port 80 is blocked by the Firewall and is not allowed then the appliance will fail to renew the Let's Encrypt certificate. -
Resolution
For the auto-renewal process to work, the traffic via port 80 needs to be allowed on the Firewall (at least few days before the certificate is going to expire) so the cert validation can be successful and get the certificate renewed. After the certificate is renewed then it can be redirected to 443 only if desired but as per Let's encrypt documentation:
The HTTP-01 challenge can only be done on port 80.
This information is visible in the information icon (Mario block) on the SSL settings:
Keep in mind that this will happen every 90 days, so the same exception might need to be done every time the certificate is going to expire.
The expiration date of the certificate can be validated by looking at the certificate on the browser itself, like in the image below:
For any security concerns regarding this situation, obtaining a SSL certificate from a well-known CA is always a preferred option.Instructions on how to enable Let's Encrypt certificate from scratch can be found here .
For additional questions on this please contact KACE Support