DEFAULT_CA settings may need to be specified before renewals about ubios-cert

[alxwolf]

Thanks for making the effort to document this.

I've looked into it and here are my thoughts:

My first reaction was to to add the --set-default-ca --server ${DEFAULT_CA} to each call of renew or forcerenew. But doing this could lead to a situation where someone who issues multiple certificates (some from LE, others from ZeroSSL) is forcing only one issuer on all certs - that would not work, either, as it would try renewing a ZeroSSL certificate with a fall to LetsEncrypt, for example.

Usually, I'd expect acme.sh to pull the right issuer for an existing certificate from the <certname>/<certname>.conffile, using the Le_API='https://acme-v02.api.letsencrypt.org/directory' variable.

In your case, it seems(!) like the original certificate was issued using ZeroSSL, in that case "defaultca" is not applied but the "initially used" is being applied.

That's my best guess for now, therefore I suggest to not change anything right now but rather have a look in about 9 weeks if your cert "auto-updates" OK or not.

But, during todays research I noticed that it should be wise to pull the latest image for acme.sh before running it, so I will implement that separately.

[tackynugget]

Thanks.

I didn't know about the <certname>/<certname>.conf file. Interestingly, mine starts with an undocumented e_API variable:

e_API='https://acme-v02.api.letsencrypt.org/directory'
Le_API='https://acme-v02.api.letsencrypt.org/directory'

The /mnt/data/ubios-cert/acme.sh/account.conf also has

DEFAULT_ACME_SERVER='https://acme-v02.api.letsencrypt.org/directory'

I have never used ZeroSSL and there were no references to ZeroSSL in any of the above 3 files.

I'm wondering if an update to acme.sh is causing it to default to ZeroSSL and something is interfering with its ability to fallback to Let's Encrypt.

Your suggestion to wait 9 weeks makes sense. And I can appreciate the caution in not wanting to force the DEFAULT_CA variable from the ubios-cert.env file over a renewal.

[alxwolf]

the "e_API" seems to be some kind of "mistake" with the "L" being cut off... it should safe to just delete that line.

acme.sh switched to ZeroSSL as default CA in August 2021, anything issued after that date, using acme.sh V3.0, and without having set a default CA, got issued by ZeroSSL. So that may have been the case, in your case, but we'll probably never know as the old certificate will be gone by now.

DEFAULT_ACME_SERVER is set by --set-default-ca, and Le_API is set by either that DEFAULT_ACME_SERVER or a dedicated --server argument, to be chosen from this list.