Ah yes, that is a new error. Reading the error message suggests that we'll need to update the API URL that Dehydrated uses. According to a Let's Encrypt announcement disallowing new registrations for APIv1 wasn't supposed to happen until next month. Existing users have until June 2020 apparently, although this early breakage of v1 suggests that it's probably best not to wait...

I documented on the bug report how to install from upstream (it's a bit dirty, but in this case it's not "unsafe"). Not sure if you've done that, or the just "fixed" the single line (i.e. adjusting the single line in Dehydrated)?

Regardless, either of those will resolve the Nonce issue, but without further changes, it will still attempt to use the v1 API. I haven't done any testing yet, but a quick google suggests that we'll need to adjust the URL that Dehydrated connects to (stored in the CA variable). Currently it is:

CA="https://acme-v01.api.letsencrypt.org/directory"

For new users, that now needs to be:

CA="https://acme-v02.api.letsencrypt.org/directory"

It's probably also worth existing users changing that too and double checking that everything works as it should.

It's probably worth noting that there is now a newer version of Dehydrated in stretch-backports now (actually, it's the latest version). So installing from backports is another (cleaner) way to upgrade it.

As noted above, I'm yet to do any testing to confirm my understanding, but essentially, these steps should resolve the issue(s):

1. upgrade dehydrated (either from upstream or via stretch-backports)
2. update the confconsole hook script (from TurnKey's GH)
3. update the API URL (to v2)

And then everything should be all systems go!

I'll aim to look into this further ASAP (within the next few days) but I'm currently a bit bogged down with other stuff.

PS - I hope you don't mind me editing your post to make it a bit easier to read... :)

Judging from the error message "this_hookscript_is_broken__dehydrated_is_working_fine__please_ignore_unknown_hooks_in_your_script", I'm guessing that you haven't updated the hook script. To do that (as per step 2 of the workaround noted on the issue):

GH_URL=https://raw.githubusercontent.com/turnkeylinux/confconsole/master
GH_HOOK=share/letsencrypt/dehydrated-confconsole.hook.sh
CC_HOOK="$DEHYD_ETC/confconsole.hook.sh"
SH_HOOK=$SHARE/dehydrated-confconsole.hook.sh

wget $GH_URL/$GH_HOOK -O $SH_HOOK
cp $SH_HOOK $CC_HOOK

Hopefully that should get you up and running...

thanks for the update. very appealing to have someone so close..... tkl ROCKS!

i was specifically thinking of new vm with no cert. import content. from site A. then take Site A's fqdn. and apply a cert. but i will pursue the conf 1.1.2 route instead. tomorrow

i'm in CST, so day over for me

Hello. Yes, I follow the instructions (so I think).

I'm so sorry I disappointed you with my problems updating the confconsole package.

I'm a rookie at tunrkey and not too advanced with linux. I'm deploying the VM in VirtualBox 6.0.4 inside a Ubuntu 18.04LTS machine.

I use a clean VM, I simply change the passwords requested when I start the installation. I have redirected ports 80 and 443 to the VM with nginx.

I try to get the let's encript certificate and I get the error detailed before.

I start with the instructions in the "How to install/update" of github confconsole v1.1.2

When I get to the second step of point 3 (install the updated Confconsole) I get the following:

[root@nginx-php-fastcgi ~]# apt install ./confconsole_1.1.2_all.deb

WARNING: apt does not have a stable CLI interface. Use with caution in scripts.

Reading package lists...
Building dependency tree...
Reading state information...
The following additional packages will be installed:
  libsasl2-modules
Suggested packages:
  libsasl2-modules-gssapi-mit | libsasl2-modules-gssapi-heimdal
  libsasl2-modules-ldap libsasl2-modules-otp libsasl2-modules-sql
The following NEW packages will be installed:
  libsasl2-modules
The following packages will be upgraded:
  confconsole
1 upgraded, 1 newly installed, 0 to remove and 53 not upgraded.
Need to get 102 kB/359 kB of archives.
After this operation, 269 kB of additional disk space will be used.
Do you want to continue? [Y/n] Abort.

 

[root@nginx-php-fastcgi ~]#

If I continue with all the steps and try to get the certificate, from the WV menu to get the certificate by entering my domain, then I get this error:

If I force the installation instead of the automatic shutdown in step 3, the MV is ruined.

This is using the terminal (command shell) of the Webmin utilities, maybe that's the error? Better to enter by ssh?

Can you think of what mistake I might be making? Or how to fix it?

Sorry for the trouble. Thank you very much. Cheers.