Mailinabox: v0.26 - Let’s Encrypt won't work (Certbot problem), can't install, the same applies to upgrading.

[xetorixik]

Let’s Encrypt does not work anymore here. Not with my existing installation. Not with a fresh installation.
Where it always worked (backup).

Does this have something to do with "free_tls_certificates" as MIB's free_tls_certificates is using version 0.2.0?: https://community.letsencrypt.org/t/important-what-you-need-to-know-about-tls-sni-validation-issues/50811

If you use Certbot in its automatic Nginx or Apache modes, you need to upgrade to version 0.21 in order to issue certificates for new domain names.

Installing a fresh MIB v0.26 blocks at https://github.com/mail-in-a-box/mailinabox/issues/1326
Upgrading a fresh MIB v0.25 with patch https://github.com/mail-in-a-box/mailinabox/issues/1327 to MIB v0.26 gives the following error:

Traceback (most recent call last):
File "management/ssl_certificates.py", line 803, in
provision_certificates_cmdline()
File "management/ssl_certificates.py", line 446, in provision_certificates_cmdline
status = provision_certificates(env, agree_to_tos_url=agree_to_tos_url, logger=my_logger, force_domains=force_domains, show_extended_problems=show_extended_problems)
File "management/ssl_certificates.py", line 331, in provision_certificates
logger=my_logger)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 64, in issue_certificate
agree_to_tos_url, validation_method, acme_server, logger)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 112, in validate_domain_ownership
acme_server=acme_server)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 314, in create_client
key = load_or_generate_private_key(account_key_file, log)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 337, in load_or_generate_private_key
from acme import jose
ImportError: cannot import name 'jose'

Upgrading a used MIB installation v0.25 to MIB v0.26, seems to be working fine at first sight.
But no TLS certificates could be provisoned at this time.

GUI
Error
Something went wrong, sorry.

Terminal
no TLS certificates could be provisoned at this time.

v0.26 is unstable and very error prone here.
Let’s Encrypt won't work.
Installer won't work here.

• I have updated this ticket a few times with all the error codes.

[elementc]

reproduced.

manually installed the missing package, jose, but unfortunately this seems like it's going to need more configuration than i am familiar with.

[scottnzuk]

Also getting this error message when added a new domain to my just upgraded system (GUI shows

Running:
root@box:~/mailinabox# ./management/ssl_certificates.py

shows the error below.

Traceback (most recent call last):
File "management/ssl_certificates.py", line 803, in
provision_certificates_cmdline()
File "management/ssl_certificates.py", line 446, in provision_certificates_cmdline
status = provision_certificates(env, agree_to_tos_url=agree_to_tos_url, logger=my_logger, force_domains=force_domains, show_extended_problems=show_extended_problems)
File "management/ssl_certificates.py", line 331, in provision_certificates
logger=my_logger)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 64, in issue_certificate
agree_to_tos_url, validation_method, acme_server, logger)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 112, in validate_domain_ownership
acme_server=acme_server)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 314, in create_client
key = load_or_generate_private_key(account_key_file, log)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 337, in load_or_generate_private_key
from acme import jose
ImportError: cannot import name 'jose'

[xetorixik]

ImportError: cannot import name 'jose'

Upstream acme changed josepy instead of acme.jose. https://github.com/certbot/certbot/pull/5203
Can this cause the problem?
As Mib is looking for acme.jose, which no longer exists? https://github.com/mail-in-a-box/free_tls_certificates/commit/08323c54a328f72939761b924a8990a94e818547

@JoshData Can you take a look at this. Thanks Josh.

[scottnzuk]

So running curl -s https://mailinabox.email/setup.sh | sudo bash

will install the update/commit changes?

Regards
Code Noob.

[JoshData]

No, it won't pick up any changes until I release a new version. I'm not even sure if the change fixed the problem yet.

[scottnzuk]

I'm happy to help test if need me too.

[xetorixik]

Thanks Josh for your fixed code.

The GUI 'Install certificate' is not working yet with the latest master branch.

Something went wrong, sorry.

The other bugs seem resolved.
With both an upgrade and a fresh installation, I was able to obtain the certificates for the domains.

However, these were new test domain names.
I do not know if the automatically renew function works after 90 days - 14.

I do not have certificates that expire within the month. So it is difficult to test.

[ptibbetts]

Thanks Josh, your change worked for me on a fresh install.

[scottnzuk]

How can I push update to current system? I have two domains awaiting for first time certs and creating afew cert errors, or is this currently only still done via manual change till release full new version?

Im also seeing
Mail-in-a-Box Version: v0.26

Updating system packages...
Installing system packages...
Initializing system random number generator...
Firewall is active and enabled on system startup
Installing nsd (DNS server)...
Installing Postfix (SMTP server)...
Installing Dovecot (IMAP server)...
Installing OpenDKIM/OpenDMARC...
Installing SpamAssassin...
Installing Nginx (web server)...
Installing Roundcube (webmail)...
Installing Nextcloud (contacts/calendar)...
Nextcloud is already latest version
Installing Z-Push (Exchange/ActiveSync server)...
Installing Mail-in-a-Box system management daemon...
Installing Munin (system monitoring)...
Incorrect username or password
Incorrect username or password
Traceback (most recent call last):
File "management/ssl_certificates.py", line 803, in
provision_certificates_cmdline()
File "management/ssl_certificates.py", line 446, in provision_certificates_cmdline
status = provision_certificates(env, agree_to_tos_url=agree_to_tos_url, logger=my_logger, force_domains=force_domains, show_extended_problems=show_extended_problems)
File "management/ssl_certificates.py", line 331, in provision_certificates
logger=my_logger)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 64, in issue_certificate
agree_to_tos_url, validation_method, acme_server, logger)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 112, in validate_domain_ownership
acme_server=acme_server)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 314, in create_client
key = load_or_generate_private_key(account_key_file, log)
File "/usr/local/lib/mailinabox/env/lib/python3.4/site-packages/free_tls_certificates/client.py", line 337, in load_or_generate_private_key
from acme import jose
ImportError: cannot import name 'jose'
The management daemon refused access. The API key file may be out of sync. Try 'service mailinabox restart'.

Worried I might have broken something else..

[ptibbetts]

@scottnzuk see https://github.com/mail-in-a-box/mailinabox#installation for information on installing from Git.

The master branch contains a fix for the ImportError: cannot import name 'jose' error which hasn't been released as a new version yet so do not run the git checkout v0.26 command.

[scottnzuk]

@ptibbetts Cant install via git clone as not a new system. "see https://github.com/mail-in-a-box/mailinabox#installation for information on installing from Git." Throws a fatal: destination path already exists and is not an empty directory.

[ptibbetts]

@scottnzuk as far as I know you can safely delete the original mailinabox directory and replace it with the one installed by Git. Your emails and user settings won't be affected as they're stored in /home/user-data. The mailinabox directory is only used to store the code that sets everything up.

[scottnzuk]

Renamed to _OLD and all working now. Thank you!

Still getting the The management daemon refused access. The API key file may be out of sync. Try 'service mailinabox restart'. But Cant see any issues all looks working.

[KeiroD]

@scottnzuk try killing off the old mailinabox daemon. Do a ps auxf | grep mailinabox and use the PID it has to kill it via killall -9 $PID. Then do service mailinabox start

[scottnzuk]

Hi @KeiroD Run this, using sudo kill -9 PID Then did start service and reboot, then re-run the setup but still same error.

Mail-in-a-Box Version: v0.26b

Updating system packages...
Installing system packages...
Initializing system random number generator...
Firewall is active and enabled on system startup
Installing nsd (DNS server)...
Installing Postfix (SMTP server)...
Installing Dovecot (IMAP server)...
Installing OpenDKIM/OpenDMARC...
Installing SpamAssassin...
Installing Nginx (web server)...
Installing Roundcube (webmail)...
Installing Nextcloud (contacts/calendar)...
Nextcloud is already latest version
Installing Z-Push (Exchange/ActiveSync server)...
Installing Mail-in-a-Box system management daemon...
Installing Munin (system monitoring)...
Incorrect username or password
Incorrect username or password
No domains hosted on this box need a new TLS certificate at this time.
The management daemon refused access. The API key file may be out of sync. Try 'service mailinabox restart'.

---

Your Mail-in-a-Box is running.

[yodax]

Can you try removing (or move it) the /usr/local/lib/mailinabox directory, reboot and the restart the setup? This contains the deamon/web files. No user data.

[scottnzuk]

Still same error. however emails are working so not worried too much

[qwicfingers]

I had the same issue. Killing mailinabox, deleting /usr/local/lib/mailinabox and rerunning setup fix it.

[JoshData]

The latest issue here should be fixed by #1339. Thanks for reporting!

[scottnzuk]

not sure if its related but now im getting (https://discourse.mailinabox.email/t/glue-records-correct-but-error-on-working-system/2866?u=scottnzuk) and system looks like its falling over?

[angsuman]

I made the following changes in /usr/local/lib/python3.4/dist-packages/free_tls_certificates/client.py to fix the issue locally:

1.

def request_certificate_issuance(client, challgs, csr, logger):
    import josepy
    # Convert the OpenSSL.crypto.X509Req to a ComparableX509 expected by request_issuance.
    csr = josepy.util.ComparableX509(csr)

2.

def load_or_generate_private_key(keyfile, log):
    import josepy

3.

key = josepy.JWKRSA(key=josepy.ComparableRSAKey(key))

Tip: Search for jose and replace with josepy. Import josepy instead of jose from acme.