Today I updated all modules on one of my deployments (Distro version 12.7.8-2302-1.sng7) running Freepbx 16.0.40. After, the GUI was no longer accessible. It appears the /etc/httpd/pki/webserver.crt file is zero length. I removed ssl redirection and was able to log in to the GUI, but I cannot create a working LE certificate from the CLI or GUI. In each case, it appears the cert is issued properly but the crt is always 0 bytes. If I remove it and try to create a self signed cert, I get an error that says in part “Unable to generate certificate: Error Generating Certificate: unknown option 730 usage: x509 args”.
I decided to try installing the edge version of certman and it threw a similar error while installing. Here’s the log:
fwconsole ma upgrade certman --edge
Edge repository temporarily enabled
No repos specified, using: [standard,extended,commercial] from last GUI settings
Downloading module 'certman'
Processing certman
Downloading...
220816/220816 [============================] 100%
Finished downloading
Extracting...Done
Download completed in 0 seconds
Updating tables certman_mapping, certman_csrs, certman_certs, certman_cas...Done
No Certificates exist
Generating default certificate...Failed! [Error Generating Certificate: unknown option 730
usage: x509 args
-inform arg - input format - default PEM (one of DER, NET or PEM)
-outform arg - output format - default PEM (one of DER, NET or PEM)
-keyform arg - private key format - default PEM
-CAform arg - CA format - default PEM
-CAkeyform arg - CA key format - default PEM
-in arg - input file - default stdin
-out arg - output file - default stdout
-passin arg - private key password source
-serial - print serial number value
-subject_hash - print subject hash value
-subject_hash_old - print old-style (MD5) subject hash value
-issuer_hash - print issuer hash value
-issuer_hash_old - print old-style (MD5) issuer hash value
-hash - synonym for -subject_hash
-subject - print subject DN
-issuer - print issuer DN
-email - print email address(es)
-startdate - notBefore field
-enddate - notAfter field
-purpose - print out certificate purposes
-dates - both Before and After dates
-modulus - print the RSA key modulus
-pubkey - output the public key
-fingerprint - print the certificate fingerprint
-alias - output certificate alias
-noout - no certificate output
-ocspid - print OCSP hash values for the subject name and public key
-ocsp_uri - print OCSP Responder URL(s)
-trustout - output a "trusted" certificate
-clrtrust - clear all trusted purposes
-clrreject - clear all rejected purposes
-addtrust arg - trust certificate for a given purpose
-addreject arg - reject certificate for a given purpose
-setalias arg - set certificate alias
-days arg - How long till expiry of a signed certificate - def 30 days
-checkend arg - check whether the cert expires in the next arg seconds
exit 1 if so, 0 if not
-signkey arg - self sign cert with arg
-x509toreq - output a certification request object
-req - input is a certificate request, sign and output.
-CA arg - set the CA certificate, must be PEM format.
-CAkey arg - set the CA key, must be PEM format
missing, it is assumed to be in the CA file.
-CAcreateserial - create serial number file if it does not exist
-CAserial arg - serial file
-set_serial - serial number to use
-text - print the certificate in text form
-C - print out C code forms
-<dgst> - digest to use, see openssl dgst -h output for list
-extfile - configuration file with X509V3 extensions to add
-extensions - section from config file with X509V3 extensions to add
-clrext - delete extensions before signing and input certificate
-nameopt arg - various certificate name options
-engine e - use engine e, possibly a hardware device.
-certopt arg - various certificate text options
-checkhost host - check certificate matches "host"
-checkemail email - check certificate matches "email"
-checkip ipaddr - check certificate matches "ipaddr"
]
Generating CSS...Done
Module certman version 16.0.25 successfully installed
Updating Hooks...Done
Chowning directories...Done
Updating Hooks...Done
Chowning directories...Done
Resetting temporarily repository state
I’m really not sure what else to I can do to resolve this. Any guidance would be greatly appreciated.
I removed /var/www/html/admin/modules/certman and reinstalled certman. This did not resolve the issue. The error “Generating default certificate…Failed! [Error Generating Certificate: unknown option 730” is still reported and I cannot create any certificates. Also, UCP will not start. I’m fairly sure this is related. I have no idea where to go from here…
Not sure about the certs, but can you restore from a FreePBX backup or if a VM, from a snapshot, pre update? You might need to engage Sangoma for support directly.
