# Let's Encrypte with multiple domains wasn't working for ECC certs

**URL:** <https://meta.discourse.org/t/lets-encrypte-with-multiple-domains-wasnt-working-for-ecc-certs/328109>\
**Category:** Self-hosting\
**Created:** [September 24, 2024, 10:37am UTC](https://meta.discourse.org/t/lets-encrypte-with-multiple-domains-wasnt-working-for-ecc-certs/328109 "2024-09-24T10:37:49Z")\
**Posts on this page:** 1\
**Showing post:** 9

<div class="post-metadata">

**Author:** ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)\
**Post date:** [September 25, 2024, 4:26pm UTC](https://meta.discourse.org/t/lets-encrypte-with-multiple-domains-wasnt-working-for-ecc-certs/328109/9 "2024-09-25T16:26:58Z")

</div>

Here is `/etc/runit/1.d/letsencrypt`

```plaintext
#!/bin/bash
/usr/sbin/nginx -c /etc/nginx/letsencrypt.conf

issue_cert() {
  LE_WORKING_DIR="${LETSENCRYPT_DIR}" /shared/letsencrypt/acme.sh --issue $2 -d test.myforum.us -d extrahostname.myforum.us --keylength $1 -w /var/www/discourse/public
}

cert_exists() {
  [["$(cd /shared/letsencrypt/test.myforum.us$1 && openssl verify -CAfile <(openssl x509 -in ca.cer) fullchain.cer | grep "OK")"]]
}

########################################################
# RSA cert
########################################################
issue_cert "4096"

if ! cert_exists ""; then
  # Try to issue the cert again if something goes wrong
  issue_cert "4096" "--force"
fi

LE_WORKING_DIR="${LETSENCRYPT_DIR}" /shared/letsencrypt/acme.sh \
  --installcert \
  -d test.myforum.us \
  -d extrahostname.myforum.us --fullchainpath /shared/ssl/test.myforum.us.cer \
  --keypath /shared/ssl/test.myforum.us.key \
  --reloadcmd "sv reload nginx"

########################################################
# ECDSA cert
########################################################
issue_cert "ec-256"

if ! cert_exists "_ecc"; then
  # Try to issue the cert again if something goes wrong
  issue_cert "ec-256" "--force"
fi

LE_WORKING_DIR="${LETSENCRYPT_DIR}" /shared/letsencrypt/acme.sh \
  --installcert --ecc \
  -d test.myforum.us \
  --fullchainpath /shared/ssl/test.myforum.us_ecc.cer \
  --keypath /shared/ssl/test.myforum.us_ecc.key \
  --reloadcmd "sv reload nginx"

if cert_exists "" || cert_exists "_ecc"; then
  grep -q 'force_https' "/var/www/discourse/config/discourse.conf" || echo "force_https = 'true'" >> "/var/www/discourse/config/discourse.conf"
fi

/usr/sbin/nginx -c /etc/nginx/letsencrypt.conf -s stop

```

Ah. I see it’s in the RSA (bad) cert, but not in the ECC (good) cert.

OK. now I get it. That `--fullcert` stanza needs `global: true` in it. I’m testing it now.

---

_[View the full topic](https://meta.discourse.org/t/lets-encrypte-with-multiple-domains-wasnt-working-for-ecc-certs/328109)._