السي بانال WHM/CPanel حل مشكلة The SSL cert will expire in less than 30 days

[Rise Company]

السي بانال WHM/CPanel حل مشكلة The SSL cert will expire in less than 30 days
SSL certificate is not renewed automatically - cPanel SSL Certificate will Expire in 30 Days
How to reset/renew cPanel/WHM Self-signed Certificate?
free cPanel-signed hostname certificate
السي بانال WHM/CPANEL حل مشكلة شهادة SSL و LET'S ENCRYPT A RATE LIMIT PREVENTS DCV

https://www.rise.company/upload/uploads/163961245439022.png

المشكلة :

تاتى ايميلات بان هناك مشكلة فى توليد شهادة ssl تلقائيا وهيتبقى مدة للمحاولة القادمة
لتوليد شهادة جديدة بعد 15 يوم او قبل الانتهاء ب 3 ايام او ان انتهت المدة ددون توليد شهادة جديدة.



You might be receiving an email with subject like “The SSL certificate for “[service like exim, ftp, dovcot, cpanel]” on “[Vpshostname]” will expire in less than 30 days.” These all are self signed certificates of services cpanel, exim, dovecot, ftp etc which are required to be reset every year.

او


90 day cPanel issued SSL certificates are renewed three days before expiration instead of 25 days
When /usr/local/cpanel/bin/checkallsslcerts runs it thinks cPanel provided hostname certificates are third-party SSL certificates, which causes the SSL to be renewed three days prior to expiration.

-------------------------------------------------------
حل المشكلة توليد شهادة من السيرفر Self-signed Certificate
-------------------------------------------------------

هذه شهادة self حماية ضعيفة مؤقت وليست شهادة حقيقية وهيخرج له تنبيه من المتصفح
على بعض خدمات whm وخاصة ميزة cpanel login الموجود عند الدخول من داخل whmcs
هتجد تنبيه وهتفتح cpanel العلامء وهناك شهادة عليها تعجب انها self
ولكن الهدف منها هو حذف الشهادة القديمة وتوليد شهادة جديدة !



Login to your WHM control panel.
Go to Home > Service Configuration > Manage Service SSL Certificates.This will display a list of certificates used by various services on your server along with their expiry dates.
If any of the certificates are expiring within 30 days, click on the Reset Certificate link in the Action column.
Once a new certificate is generated and installed, the Certificate Expirationcolumn will display the new expiry date.


https://www.rise.company/forum/images/imported/2021/12/61.png

هيظهر تنبيه Confirm SSL Certificate Reset وافق ثم هتجد Expiration تجدد لمدة سنة

https://www.rise.company/forum/images/imported/2021/12/62.png

ثم هيطلب ريستارت ... قم بالموافقه فقط
Restart cpsrvdIn order to complete your SSL Certificate installation cpsrvd will need to be restarted.Restart cpsrvd now?
ومبروك تم تجديد ssl

فى حالة الرغبة فى التراجع عن Self-signed؟

اضغط على browse certificates وهتجد الشهادة القديمة موجودة
علم علامة صح مثل الى فى الصورة على الجميع ثم هتجد الشهادة القديمة اخترها
والشرح هنا فى حالة انها expired او انك لا تريد الانتظار !! خطوة reset هامة لتوليد شهادة جديدة !!

https://www.rise.company/upload/uploads/163965873889121.png

توليد شهادة حقيقية free cPanel-signed hostname certificate :

https://www.rise.company/upload/uploads/163979470063221.png

من المفترض من تلقاء نفسها تولد شهادة جديدة فى اوقات محددة ولكن قد يصادف هذا الوقت
تعطل لها بسبب وجود ضغط على موقع توليد الشهادات وهيترتب على ذلك الانتظار كثير !

this certificate will still update once the certificate has reached 3 days before expiry. This notification is a false-positive, however, if you still would like to replace your certificate immediately, you can complete the following steps: First, reset the hostname certificate to a self-signed one:

بعد عمل reset للشهادات من داخل whm او من خلال هذا الامر



for service in ftp exim dovecot cpanel ; do whmapi1 --output=jsonpretty reset_service_ssl_certificate service=$service ;done

قم بتنفيذ هذا الامر لنقل / حذف الشهادات القديمة لتوليد اخري جديدة
اذا لما يعطى لك نتيجة بالنقل فامر reset عمل ذلك لا حاجة لعمل شىء

Next, move aside the old CSR (if it exists):



mv /var/cpanel/hostname_cert_csrs{,.cpbkp} -v

هنا ادخل امر فى terminal لتوليد شهادة جديدة

Finally, run checkallsslcerts to order a new certificate:



/usr/local/cpanel/bin/checkallsslcerts

النتيجة :

https://www.rise.company/upload/uploads/163983088643781.png

اذا لم يعمل واعطى خطا هنا هناك لود على مولد الشهادات وجرب بعد ساعات وهيعمل 100 %

سبب بلوك الفايروول CSF / Hulk انك لم تضع اي بيهات مولد SSL
فى csf يجب ان تضع الايبيهات فى كلا allow + Ignore
https://support.cpanel.net/hc/en-us/articles/360053968633-What-IP-addresses-do-Sectigo-DCV-requests-originate-from

شاهد ايضا
السي بانال WHM/CPanel حل مشكلة ssl/certificate/whm-license/90-day (https://www.rise.company/forum/threads/81025-%D8%A7%D9%84%D8%B3%D9%8A-%D8%A8%D8%A7%D9%86%D8%A7%D9%84-WHM-CPanel-%D8%AD%D9%84-%D9%85%D8%B4%D9%83%D9%84%D8%A9-ssl-certificate-whm-license-90-day)
السي بانال WHM/CPANEL حل مشكلة شهادة SSL و LET'S ENCRYPT A RATE LIMIT PREVENTS DCV (https://www.rise.company/forum/showthread.php/94226-%D8%A7%D9%84%D8%B3%D9%8A-%D8%A8%D8%A7%D9%86%D8%A7%D9%84-WHM-cPanel-%D8%AD%D9%84-%D9%85%D8%B4%D9%83%D9%84%D8%A9-%D8%B4%D9%87%D8%A7%D8%AF%D8%A9-SSL-%D9%88-Let-s-Encrypt-A-rate-limit-prevents-DCV)

المرجع:
https://docs.cpanel.net/whm/scripts/the-checkallsslcerts-script/
https://support.cpanel.net/hc/en-us/articles/4411838154903-cPanel-SSL-issued-90-day-SSL-certificates-are-renewed-three-days-before-expiration
https://support.cpanel.net/hc/en-us/articles/4406515008023-The-cPanel-Store-returned-an-error-X-Item-Validation-in-response-to-the-request-POST-ssl-certificate-whm-license-90-day-The-provided-dcv-methods-is-invalid
https://docs.cpanel.net/whm/service-configuration/manage-service-ssl-certificates/
https://manage.accuwebhosting.com/knowledgebase/2394/How-to-resetorrenew-cPanelorWHM-Self-signed-Certificate.html
https://www.web24.com.au/tutorials/cpanel-ssl-certificate-will-expire-in-30-days
https://iserversupport.com/blog/ssl-cert-will-expire-less-30-days-fixed/
https://forums.cpanel.net/threads/ssl-certificate-is-not-renewed-automatically.649833/
https://cwcshd.freshdesk.com/support/solutions/articles/15000017931-the-ssl-certificate-for-service-on-hostname-will-expire-in-less-than-30-days-
https://areatype.com/blog/updating-security-certificate-whm

[Rise Company]

/usr/local/cpanel/bin/checkallsslcerts

ادخل هذا الامر وهتجد انه هيولد الشهادة من جديد او
هيخبرك ان السيستم قبل الموعد بـ 3 ايام اذا وجد الشهادة القديمة موجوده هيبدل الشهادة باخرى جديدة

ادخل هذا الامر فى حالة عمل Update للسي بانيل والذى يساعد فى توليد الشهادة ايضا


/usr/local/cpanel/scripts/upcp

Keep in mind that certificates are not issued instantly, and processing times can sometimes take up to 24 hours.

This can happen if your server's firewall is blocking access attempts from Comodo to validate the certificate, but validation is also sometimes delayed for a few hours during manual steps sometimes required by Comodo during the validation process. Anyone experiencing an issue with certificate issuance where it's been over 24 hours since the initial request for the certificate was made can open a support ticket using the link in my signature so we can check on the status of the order.
-------------------------------------

cPanel, L.L.C. offers valid cPanel & WHM license holders a free signed certificate for the services on your server’s hostname. This offer replaces the certificates for these services that meet any of the following conditions:



[*=center]Maintains a weak signature algorithm.
[*=center]Revoked.
[*=center]Self-signed.
[*=center]Invalid (For example, your server’s hostname must be valid and resolve in DNS).
[*=center]Will expire soon, based on the following criteria:

cPanel-provided certificates that expire in less than 25 days.
Certificates issued by any other provider that expire in less than 3 days.




When the existing certificate meets any of these conditions, the server will order a replacement certificate when the /usr/local/cpanel/scripts/upcp maintenance runs. The system will download and install that certificate when available. If the existing certificate expires before the replacement certificate is available, the system will install a self-signed certificate, and then replace it with the ordered certificate when available.
--------------------------------------------------------


يمكنك ايضا تفعيل Allow AutosSSL to replace


Each AutoSSL provider may wait for a specific amount of time to replace an AutoSSL-provided certificate before it expires. For example:
AutoSSL attempts to renew certificates that cPanel, Inc. provides when they expire within 15 days.
AutoSSL attempts to renew certificates that Let's Encrypt provides when they expire within 29 days.
Due to rate limits, AutoSSL prioritizes new certificates over the renewal of existing certificates.


https://www.rise.company/upload/uploads/163961245434381.png

When a certificate expires, your server installs a self-signed certificate. If your server meets the requirements to obtain a free cPanel-signed certificate, the server automatically orders one the next time that the upcp maintenance script runs. When the signed certificate becomes available, the server downloads and installs it.