Renewing SSL with Digital Ocean's Marketplace installation

Community Support
1

Description

I created a Digital Ocean Droplet following these instructions: Rocket.Chat Hosting | DigitalOcean Marketplace 1-Click App. Now, the SSL certificate is expired.

I normally can run “certbot” and regenerate the SSL on servers web that I manually set up. But this “Marketplace” installation doesn’t have things like that.

Everything is up-to-date, but I can’t run certbot. I even tried running “rocketchatctl configure --lets-encrypt --root-url=https://chat.my_domain.com” (with my_domain being my actual domain) and it didn’t work.

Any help would be appreciated.

2

Hi, welcome to the forum!

You can force the certs to renew, by

# backing up the existing file
sudo cp /etc/traefik/acme/acme.json /etc/traefik/acme/acme.json.old

Then open /etc/traefik/acme/acme.json and remove the lines/keys starting with Certificate & Key.

Restart traefik

sudo systemctl restart traefik
3

Renewal should’ve been automatic though. Idk why it wasnt. I’ll look into that. And at the same time maybe I’ll also add a rocketchatctl command to make force renewals easier.

4

I edited the files in Vim and removed the two lines. Now I’m clearly getting a syntax error.

Capture
Capture2113×128 16.9 KB

Thanks!

5

Can you post the file content here please? Removing private data?

6

The part that is breaking is here:

  "Certificates": [
    {
      "Domain": {
        "Main": "chat.private.com",
        "SANs": null
      }
    }
  ],
  "HTTPChallenges": {},
  "TLSChallenges": null
}
7

Here is what it looks like right after I edit and remove the lines you recommend:

Capture2

8

Please post the whole file, if uncomfortable you can dm me here as well:)

1 Like
9

Remove that comma please under SANs

1 Like
10

(post deleted by author)

11

Ok. I got traefik restarted. Thanks.

I’ve also rebooted the server (just in case) and I’m not sure which command I need to run to regenerate the SSL cert. I just looked at the acme.json file after restarting everything and I don’t see the certificate information, just my private key.

12

For some reason the server isn’t serving HTTP, only HTTPS. That’s why Let’s Encrypt isn’t reissuing the SSL certificate. I’m not sure why the redirect from HTTP to HTTPS isn’t working.

13

I figured it out. Don’t block port 80. :slight_smile:

1 Like