github-starred/gitea
2
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-03-12 02:24:21 -05:00
Code Issues 2.6k Packages Projects Releases 100 Wiki Activity

ACME certificate fails to renew (incorrect directory) #13565

New Issue
Closed
opened 2025-11-02 10:46:13 -06:00 by GiteaMirror · 9 comments
GiteaMirror commented 2025-11-02 10:46:13 -06:00
Owner
Copy Link

Originally created by @Jburso on GitHub (Oct 4, 2024).

Description

ACME renewal fails due to certmagic trying to find the certificate in the wrong directory. Initial issuance works just fine though. Certificates located in /var/lib/gitea/https/certificates/ca.mydomain.com-acme-acme-directory/ but renewals check for the certificate in /var/lib/gitea/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/.

certmagic prints: error while checking if stored certificate is also expiring soon

Relevant parts of my config are below:

; ACME support

PROTOCOL = https
ENABLE_ACME = true
ACME_ACCEPTTOS = true
ACME_URL = https://ca.mydomain.com/acme/acme/directory
ACME_DIRECTORY = https
ACME_EMAIL = nan@nan

Gitea Version

1.21.9

Can you reproduce the bug on the Gitea demo site?

No

Log Gist

https://gist.github.com/Jburso/5004c35ad7f4a0260a85a9044c3802f5

Screenshots

No response

Git Version

No response

Operating System

No response

How are you running Gitea?

Running on Alpine 3.20.3 and installed through the community v3.20 repo

Database

SQLite

Originally created by @Jburso on GitHub (Oct 4, 2024). ### Description ACME renewal fails due to certmagic trying to find the certificate in the wrong directory. Initial issuance works just fine though. Certificates located in `/var/lib/gitea/https/certificates/ca.mydomain.com-acme-acme-directory/` but renewals check for the certificate in `/var/lib/gitea/.local/share/certmagic/certificates/acme-v02.api.letsencrypt.org-directory/`. certmagic prints: `error while checking if stored certificate is also expiring soon` Relevant parts of my config are below: ``` ; ACME support PROTOCOL = https ENABLE_ACME = true ACME_ACCEPTTOS = true ACME_URL = https://ca.mydomain.com/acme/acme/directory ACME_DIRECTORY = https ACME_EMAIL = nan@nan ``` ### Gitea Version 1.21.9 ### Can you reproduce the bug on the Gitea demo site? No ### Log Gist https://gist.github.com/Jburso/5004c35ad7f4a0260a85a9044c3802f5 ### Screenshots _No response_ ### Git Version _No response_ ### Operating System _No response_ ### How are you running Gitea? Running on Alpine 3.20.3 and installed through the [community v3.20 repo](https://pkgs.alpinelinux.org/package/v3.20/community/x86_64/gitea) ### Database SQLite
GiteaMirror added the issue/confirmedtype/bug labels 2025-11-02 10:46:13 -06:00
GiteaMirror commented 2025-11-02 10:46:14 -06:00
Author
Owner
Copy Link

@EmperorEarth commented on GitHub (Jan 1, 2025):

Got the same on Forgejo 7.x/Gitea 1.21.x. Converting to Gitea paths, I was able to bandaid until bugfix with something like:

	sudo cp -r /var/lib/gitea/https/certificates /var/lib/gitea/.local/share/certmagic/certificates
	sudo systemctl stop gitea
	sudo systemctl start gitea

Both directories were updated during the certificate renewal.

Note: I'm not sure manually stopping and starting the SystemD daemon was necessary.

@EmperorEarth commented on GitHub (Jan 1, 2025): Got the same on Forgejo 7.x/Gitea 1.21.x. Converting to Gitea paths, I was able to bandaid until bugfix with something like: ``` sudo cp -r /var/lib/gitea/https/certificates /var/lib/gitea/.local/share/certmagic/certificates sudo systemctl stop gitea sudo systemctl start gitea ``` Both directories were updated during the certificate renewal. Note: I'm not sure manually stopping and starting the SystemD daemon was necessary.
GiteaMirror commented 2025-11-02 10:46:14 -06:00
Author
Owner
Copy Link

@wxiaoguang commented on GitHub (Jan 1, 2025):

I think this will fix: Try to fix ACME directory problem #33072

@wxiaoguang commented on GitHub (Jan 1, 2025): I think this will fix: Try to fix ACME directory problem #33072
GiteaMirror commented 2025-11-02 10:46:14 -06:00
Author
Owner
Copy Link

@lunny commented on GitHub (Jan 2, 2025):

It seems that for some reason, magic.Storage = &certmagic.FileStorage{Path: setting.AcmeLiveDirectory} doesn’t appear to be taking effect.

@lunny commented on GitHub (Jan 2, 2025): It seems that for some reason, `magic.Storage = &certmagic.FileStorage{Path: setting.AcmeLiveDirectory} ` doesn’t appear to be taking effect.
GiteaMirror commented 2025-11-02 10:46:14 -06:00
Author
Owner
Copy Link

@wxiaoguang commented on GitHub (Jan 2, 2025):

doesn’t appear to be taking effect.

Actually it takes effect.

@wxiaoguang commented on GitHub (Jan 2, 2025): > doesn’t appear to be taking effect. Actually it takes effect.
GiteaMirror commented 2025-11-02 10:46:15 -06:00
Author
Owner
Copy Link

@Jburso commented on GitHub (Feb 21, 2025):

After testing on v1.23.3, where the above fix was merged, I am still getting an incorrect path when a certificate renewal is being attempted. /var/lib/gitea/https/certificates/ca.mydomain.com-acme-acme-directory/ is the correct directory but the renewal attempts to access /var/lib/gitea/https/certificates/acme-v02.api.letsencrypt.org-directory/. The root directory is now correct, but it seems like there's an assumption that LetsEncrypt is being used when that's not the case.

This issue does not seem to occur immediately after gitea is restarted.

I think this issue should be reopened.

@Jburso commented on GitHub (Feb 21, 2025): After testing on v1.23.3, where the above fix was merged, I am still getting an incorrect path when a certificate renewal is being attempted. `/var/lib/gitea/https/certificates/ca.mydomain.com-acme-acme-directory/` is the correct directory but the renewal attempts to access `/var/lib/gitea/https/certificates/acme-v02.api.letsencrypt.org-directory/`. The root directory is now correct, but it seems like there's an assumption that LetsEncrypt is being used when that's not the case. This issue does *not* seem to occur immediately after gitea is restarted. I think this issue should be reopened.
GiteaMirror commented 2025-11-02 10:46:15 -06:00
Author
Owner
Copy Link

@wxiaoguang commented on GitHub (Feb 21, 2025):

/var/lib/gitea/https/certificates/ca.mydomain.com-acme-acme-directory/ is the correct directory but the renewal attempts to access /var/lib/gitea/https/certificates/acme-v02.api.letsencrypt.org-directory/. The root directory is now correct, but it seems like there's an assumption that LetsEncrypt is being used when that's not the case.

If I understand correctly, that directory is from CA (aka setting.AcmeURL => ACME_URL). If you use the default ACME service (letsencpryt), then the URL is https://acme-v02.api.letsencrypt.org/directory, then it uses .../https/certificates/acme-v02.api.letsencrypt.org-directory. If you use a customized ACME service https://ca.mydomain.com/acme/acme/directory, then it becomes .../https/certificates/ca.mydomain.com-acme-acme-directory.

At the moment, I don't see the logic on Gitea side is changed. #33072 and its following up fix only set the global default storage path.

So maybe it is a misconfiguration or the ACME package's problem?

@wxiaoguang commented on GitHub (Feb 21, 2025): > `/var/lib/gitea/https/certificates/ca.mydomain.com-acme-acme-directory/` is the correct directory but the renewal attempts to access `/var/lib/gitea/https/certificates/acme-v02.api.letsencrypt.org-directory/`. The root directory is now correct, but it seems like there's an assumption that LetsEncrypt is being used when that's not the case. If I understand correctly, that directory is from `CA` (aka `setting.AcmeURL` => `ACME_URL`). If you use the default ACME service (letsencpryt), then the URL is `https://acme-v02.api.letsencrypt.org/directory`, then it uses `.../https/certificates/acme-v02.api.letsencrypt.org-directory`. If you use a customized ACME service `https://ca.mydomain.com/acme/acme/directory`, then it becomes `.../https/certificates/ca.mydomain.com-acme-acme-directory`. At the moment, I don't see the logic on Gitea side is changed. #33072 and its following up fix only set the global default storage path. So maybe it is a misconfiguration or the ACME package's problem?
GiteaMirror commented 2025-11-02 10:46:15 -06:00
Author
Owner
Copy Link

@wxiaoguang commented on GitHub (Feb 21, 2025):

The best guess from my side is like this " Fix ACEM path when renew #33668 "(see the comment)

And @techknowlogick , the certmagic code is from "Use caddy's certmagic library for extensible/robust ACME handling (#14177)"

@wxiaoguang commented on GitHub (Feb 21, 2025): The best guess from my side is like this " Fix ACEM path when renew #33668 "(see the comment) And @techknowlogick , the certmagic code is from "Use caddy's certmagic library for extensible/robust ACME handling (#14177)"
GiteaMirror commented 2025-11-02 10:46:15 -06:00
Author
Owner
Copy Link

@wxiaoguang commented on GitHub (Mar 5, 2025):

OK, the new "fix" is still problematic.

-> Revert "Try to fix ACME path when renew (#33668)" #33805
-> Revert "Try to fix ACME path when renew (#33668) (#33693)" #33804

I give up for this problem. Maybe the original authors @techknowlogick could know how to make it right.

@wxiaoguang commented on GitHub (Mar 5, 2025): OK, the new "fix" is still problematic. -> Revert "Try to fix ACME path when renew (#33668)" #33805 -> Revert "Try to fix ACME path when renew (#33668) (#33693)" #33804 I give up for this problem. Maybe the original authors @techknowlogick could know how to make it right.
GiteaMirror commented 2025-11-02 10:46:16 -06:00
Author
Owner
Copy Link

@wxiaoguang commented on GitHub (Mar 5, 2025):

The last try: Try to fix ACME (3rd) #33807

@wxiaoguang commented on GitHub (Mar 5, 2025): The last try: Try to fix ACME (3rd) #33807
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
$20
$250
$50
$500
backport/done
💎 Bounty
docs-update-needed
good first issue
hacktoberfest
issue/bounty
issue/confirmed
issue/critical
issue/duplicate
issue/needs-feedback
issue/not-a-bug
issue/regression
issue/stale
issue/workaround
lgtm/need 2
modifies/api
modifies/translation
outdated/backport/v1.18
outdated/theme/markdown
outdated/theme/timetracker
performance/bigrepo
performance/cpu
performance/memory
performance/speed
pr/breaking
proposal/accepted
proposal/rejected
pr/wip
pull-request
Mirrored from GitHub Pull Request
 reviewed/wontfix
💰 Rewarded
skip-changelog
status/blocked
topic/accessibility
topic/api
topic/authentication
topic/build
topic/code-linting
topic/commit-signing
topic/content-rendering
topic/deployment
topic/distribution
topic/federation
topic/gitea-actions
topic/issues
topic/lfs
topic/mobile
topic/moderation
topic/packages
topic/pr
topic/projects
topic/repo
topic/repo-migration
topic/security
topic/theme
topic/ui
topic/ui-interaction
topic/ux
topic/webhooks
topic/wiki
type/bug
type/deprecation
type/docs
type/enhancement
type/feature
type/miscellaneous
type/proposal
type/question
type/refactoring
type/summary
type/testing
type/upstream
No Label issue/confirmed type/bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/gitea#13565
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?