Let's Encrypte with multiple domains wasn't working for ECC certs

Product Support Self-hosting
9

Here is /etc/runit/1.d/letsencrypt

#!/bin/bash
/usr/sbin/nginx -c /etc/nginx/letsencrypt.conf

issue_cert() {
  LE_WORKING_DIR="${LETSENCRYPT_DIR}" /shared/letsencrypt/acme.sh --issue $2 -d test.myforum.us -d extrahostname.myforum.us --keylength $1 -w /var/www/discourse/public
}

cert_exists() {
  [[ "$(cd /shared/letsencrypt/test.myforum.us$1 && openssl verify -CAfile <(openssl x509 -in ca.cer) fullchain.cer | grep "OK")" ]]
}

########################################################
# RSA cert
########################################################
issue_cert "4096"

if ! cert_exists ""; then
  # Try to issue the cert again if something goes wrong
  issue_cert "4096" "--force"
fi

LE_WORKING_DIR="${LETSENCRYPT_DIR}" /shared/letsencrypt/acme.sh \
  --installcert \
  -d test.myforum.us \
  -d extrahostname.myforum.us  --fullchainpath /shared/ssl/test.myforum.us.cer \
  --keypath /shared/ssl/test.myforum.us.key \
  --reloadcmd "sv reload nginx"

########################################################
# ECDSA cert
########################################################
issue_cert "ec-256"

if ! cert_exists "_ecc"; then
  # Try to issue the cert again if something goes wrong
  issue_cert "ec-256" "--force"
fi

LE_WORKING_DIR="${LETSENCRYPT_DIR}" /shared/letsencrypt/acme.sh \
  --installcert --ecc \
  -d test.myforum.us \
  --fullchainpath /shared/ssl/test.myforum.us_ecc.cer \
  --keypath /shared/ssl/test.myforum.us_ecc.key \
  --reloadcmd "sv reload nginx"

if cert_exists "" || cert_exists "_ecc"; then
  grep -q 'force_https' "/var/www/discourse/config/discourse.conf" || echo "force_https = 'true'" >> "/var/www/discourse/config/discourse.conf"
fi

/usr/sbin/nginx -c /etc/nginx/letsencrypt.conf -s stop

Ah. I see it’s in the RSA (bad) cert, but not in the ECC (good) cert.

OK. now I get it. That --fullcert stanza needs global: true in it. I’m testing it now.