Checking domain name of existing cert may fail #115

New Issue

adam · 2025-12-29T00:25:10+01:00

adam commented

2025-12-29 00:25:10 +01:00

Originally created by @jlesage on GitHub (Jun 27, 2016).

I have a scenario where, during server deployment, ${CERTDIR}/${domain}/cert.pem is pointing to a self-signed certificate. This is done to make sure applications won't complain about missing certificate if letsencrypt.sh didn't ran yet.

When running letsencrypt.sh in this scenario, the script fails because the existing certificate doesn't contains the string DNS:.

The problem is with the following line:

certnames="$(openssl x509 -in "${cert}" -text -noout | grep DNS: | _sed 's/DNS://g' | tr -d ' ' | tr ',' '\n' | sort -u | tr '\n' ' ' | _sed 's/ $//')"

I guess that not finding the DNS: string should not be considered as an error and should force a renew.

Originally created by @jlesage on GitHub (Jun 27, 2016). I have a scenario where, during server deployment, ${CERTDIR}/${domain}/cert.pem is pointing to a self-signed certificate. This is done to make sure applications won't complain about missing certificate if letsencrypt.sh didn't ran yet. When running letsencrypt.sh in this scenario, the script fails because the existing certificate doesn't contains the string `DNS:`. The problem is with the following line: ``` certnames="$(openssl x509 -in "${cert}" -text -noout | grep DNS: | _sed 's/DNS://g' | tr -d ' ' | tr ',' '\n' | sort -u | tr '\n' ' ' | _sed 's/ $//')" ``` I guess that not finding the `DNS:` string should not be considered as an error and should force a renew.

adam closed this issue

2025-12-29 00:25:10 +01:00

adam commented

2025-12-29 00:25:11 +01:00

@lukas2511 commented on GitHub (Jan 30, 2017):

Not going to fix this, if this is really necessary I suggest putting your certificate in fullchain.pem, as that is what you'd want to use later anyway and the script should work fine that way.

@lukas2511 commented on GitHub (Jan 30, 2017): Not going to fix this, if this is really necessary I suggest putting your certificate in fullchain.pem, as that is what you'd want to use later anyway and the script should work fine that way.

adam referenced this issue

2025-12-29 01:28:40 +01:00

[PR #115] [CLOSED] Check all certificate expiration dates #722

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: starred/dehydrated#115