Resolved Security Advisor - Plesk Panel Certificate Expired

[BizMarquee]

I secured my panel with a Lets Encrypt! certificate, but it did not automatically renew, and it expired and now my panel is not secured, but SA says it is. Is there a command line I can run to re-secure my panel?

 

[UFHH01]

Hi BizMarquee,

but SA says it is.

Could you pls. explain, what "SA" should stand for? You should consider to refrain from abbreviations, because due to national and international differences such abbreviations can lead to misunderstandings.


Since Plesk Onyx, Plesk provides the following wiki - article for your question:

Is there a command line I can run to re-secure my panel?

=> Secure Plesk Panel · plesk/letsencrypt-plesk Wiki · GitHub

... and with the newest Plesk Let's Encrypt Extensions, you should consider to inspect Let's Encrypt issues in your "panel.log".​

 

[BizMarquee]

SA = Security Advisor.

 

[WielM]

I'm having the same problem. My secured sites worked for 3 months and than expired. They were renewed as I can see using

openssl x509  -in cert-xxxxxx -text -noout

where I can read:

        Validity
            Not Before: Sep 25 23:53:00 2017 GMT
            Not After : Dec 24 23:53:00 2017 GMT

But the expired sites still show the privacy error page (NET::ERR_CERT_DATE_INVALID)

A manual renew also didn't work (which is not surprising as it seems that the cert files have the right dates)

 

[UFHH01]

Hi WielM,

pls. have a look at your "panel.log" ( => /usr/local/psa/admin/logs/panel.log - /var/log/plesk/ ), as Let's Encrypt logs its actions there. If you desire help for further investigations, pls. consider to post the corresponding entries from your logs, so that people willing to help you have something to start with their investigations.


Additional informations:

=> Plesk for Linux services logs and configuration files ( KB - article: 213403509 )​

Sometimes, it is as well a good idea to change the log - level ( TEMPORARILY! ), to get more informations in Plesk - log - files:

=> How to enable/disable debug logging in Plesk 11.5 and up? ( KB - article: 213408889 )​

 

[WielM]

Solved!
Obviously, the renew process restarts apache and nginx. The nginx restart failed during restart (didn't pass the config-test) and therefore the old instance of nginx kept running, with the old certificate information! After repairing the nginx config, the renewed certificate became active after an nginx daemon restart.
Maybe you have the same problem, BizMarquee?