Asus Lets Encrypt Certificate will not renew

[Col8eral]

I have an ASUS RT-AC88U router with lets encrypt enabled. The certificate is shown as dated 2018. When I visit my router via WAN I am getting a browser security certificate warning.

Is there a way to fix this problem.

Many thanks

 

[RMerlin]

Look at the system log, it will tell you why the certificate isn't getting renewed. Chances are it's because there are too many users using the same DDNS domain as you, and Let's Encrypt is throttling certificate emission.

If you need something reliable, you will have to either start managing your own CA, or switch to a different DDNS domain.

 

[Col8eral]

I currently use the domain provided by ASUS.

I cant see anything in the syslog

is there a way t manually update?
Do I need to have any ports open to allow the auto update?

 

[GoNzCiD]

I have the same problem with AC87U in latest merlin firm. My cert expired yesterday, I have no change my asus config since months, only firmware upgrades.

It indicates than cert status is OK, the SAN & Issued to values are right and the date is old...

In log I can see this:

Dec  4 10:35:00 rc_service: service 6005:notify_rc restart_letsencrypt
Dec  4 10:35:09 kernel: /usr/sbin/acme-client: SSL_read return 5: Success
Dec  4 10:35:09 kernel: /usr/sbin/acme-client: https://acme-v01.api.letsencrypt.org/acme/new-reg: bad comm
Dec  4 10:35:09 kernel: /usr/sbin/acme-client: transfer buffer: [{ "ZV5ahDGw_q0": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417", "key-change": "https://acme-v01.api.letsencrypt.org/acme/key-change", "meta": { "caaIdentities": [ "letsencrypt.org" ], "terms-of-service": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf", "website": "https://letsencrypt.org" }, "new-authz": "https://acme-v01.api.letsencrypt.org/acme/new-authz", "new-cert": "https://acme
Dec  4 10:35:12 kernel: /usr/sbin/acme-client: SSL_read return 5: Success
Dec  4 10:35:12 kernel: /usr/sbin/acme-client: https://acme-v01.api.letsencrypt.org/acme/new-authz: bad comm
Dec  4 10:35:12 kernel: /usr/sbin/acme-client: transfer buffer: [{ "ZV5ahDGw_q0": "https://community.letsencrypt.org/t/adding-random-entries-to-the-directory/33417", "key-change": "https://acme-v01.api.letsencrypt.org/acme/key-change", "meta": { "caaIdentities": [ "letsencrypt.org" ], "terms-of-service": "https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf", "website": "https://letsencrypt.org" }, "new-authz": "https://acme-v01.api.letsencrypt.org/acme/new-authz", "new-cert": "https://acme
Dec  4 10:35:49 roamast: eth1: add client [24:62:ab:00:82:06] to monitor list

If I run /usr/sbin/gencert.sh, I can see this:

If i run /sbin/le_acme nothing is retuned in terminal but in log:

Dec  4 10:42:38 kernel: /usr/sbin/acme-client: /tmp/.le/www/.well-known/acme-challenge: -C directory must exist

I use a DDNS but it isn't the problem because my IP not change frecuently. Maybe for months.

 

[Dabombber]

There's some more recent posts about this, best place to look would be the 384.14 beta thread where it should be fixed.

 

[Roadspill]

Let’s Encrypt changed their backend to a new version and disabled the old version. ASUS is lagging behind in implementing a functioning Let’s Encrypt feature. Sooo, from the sounds of it we probably won’t see it running anytime soon.


Sent from my iPhone using Tapatalk

 

[RMerlin]

Sooo, from the sounds of it we probably won’t see it running anytime soon.

Wrong. Asus started releasing fixed firmware releases for some models about three weeks ago.

 

[GoNzCiD]

There's some more recent posts about this, best place to look would be the 384.14 beta thread where it should be fixed.

Thanks for the info, then I'll wait to the .14 release and I expect asus release new packages for AC87U, than I'm reading this bad notice...