LetsEncrypt stooped working with error: Cannot ... | MDaemon Technologies Community Forum
  1. Forum
  2. MDaemon
  3. LetsEncrypt stooped working with error: Cannot validate argument on parameter 'Value'.

LetsEncrypt stooped working with error: Cannot validate argument on parameter 'Value'.

  • A

    I am still unable to get to http://autodiscover.cfts.co.

    Are you able to get to it from the internet.  Are you able to connect to it from the local machine?

    https works for me with a certificate error but not http.  So if the redirect is off something else must be blocking the traffic.

    --
    Arron Caruth

    0 likes
  • p

    I have installed wacs v2.2.5.1541 (x64, ReleaseTrimmed) installed on the same server as MDaemon and generated the certificates without issue?

     Enter email(s) for notifications about problems and abuse (comma-separated): peter@cfts.co

 Plugin Manual generated source mail2.cfts.co with 4 identifiers
 Plugin Single created 1 order
 [autodiscover.cfts.co] Authorizing...
 [autodiscover.cfts.co] Authorizing using http-01 validation (SelfHosting)
 [autodiscover.cfts.co] Authorization result: valid
 [mail1.cfts.co] Authorizing...
 [mail1.cfts.co] Authorizing using http-01 validation (SelfHosting)
 [mail1.cfts.co] Authorization result: valid
 [mail2.cfts.co] Authorizing...
 [mail2.cfts.co] Authorizing using http-01 validation (SelfHosting)
 [mail2.cfts.co] Authorization result: valid
 [webmail.cfts.co] Authorizing...
 [webmail.cfts.co] Authorizing using http-01 validation (SelfHosting)
 [webmail.cfts.co] Authorization result: valid
 Downloading certificate [Manual] mail2.cfts.co
 Store with CentralSsl...
 Copying certificate to the CentralSsl store
 Saving certificate to CentralSsl location D:\ssl\autodiscover.cfts.co.pfx
 Saving certificate to CentralSsl location D:\ssl\mail1.cfts.co.pfx
 Saving certificate to CentralSsl location D:\ssl\mail2.cfts.co.pfx
 Saving certificate to CentralSsl location D:\ssl\webmail.cfts.co.pfx
 Scheduled task looks healthy
 Adding renewal for [Manual] mail2.cfts.co
 Next renewal due after 2023/10/16
 Certificate [Manual] mail2.cfts.co created

 N: Create certificate (default settings)
 M: Create certificate (full options)

     


    I really like to get to the bottom of this?  it clearly not a firewall issue, any advise would be good.

    I have generated and tested the required ssl via wacs, all seems well, the issue seems to be somthing to do with mdaemon, but at least I have a usable fall back option now, was much easer than I thought it would be.

    the steps to the working solution:

     A simple Windows ACMEv2 client (WACS)
 Software version 2.2.5.1541 (release, trimmed, standalone, 64-bit)
 Connecting to https://acme-v02.api.letsencrypt.org/...
 Connection OK!
 Scheduled task looks healthy
 Please report issues at https://github.com/win-acme/win-acme

 N: Create certificate (default settings) <<
 M: Create certificate (full options)
 R: Run renewals (0 currently due)
 A: Manage renewals (1 total)
 O: More options...
 Q: Quit

 Please choose from the menu: 

 Running in mode: Interactive, Simple
 Source plugin IIS not available: No supported version of IIS detected.

 Please specify how the list of domain names that will be included in the
 certificate should be determined. If you choose for one of the "all bindings"
 options, the list will automatically be updated for future renewals to
 reflect the bindings at that time.

 1: Read bindings from IIS
 2: Manual input <<
 3: CSR created by another program
 C: Abort

 How shall we determine the domain(s) to include in the certificate?: 

Description:         A host name to get a certificate for. This may be a
                     comma-separated list.

 Host: mail1.cfts.co,mail2.cfts.co,autodiscover.cfts.co,webmail.cfts.co

 Source generated using plugin Manual: mail1.cfts.co and 3 alternatives
 Installation plugin IIS not available: No supported version of IIS detected.

 With the certificate saved to the store(s) of your choice, you may choose one
 or more steps to update your applications, e.g. to configure the new
 thumbprint, or to update bindings.

 1: Create or update bindings in IIS
 2: Start external script or program
 3: No (additional) installation steps <<

 Which installation step should run first?: 

 Plugin Manual generated source mail1.cfts.co with 4 identifiers
 Plugin Single created 1 order
 Downloading certificate [Manual] mail1.cfts.co
 Store with CertificateStore...
 Installing certificate in the certificate store
 Adding certificate [Manual] mail1.cfts.co @ 2023/8/22 to store My
 Scheduled task looks healthy
 Adding renewal for [Manual] mail1.cfts.co
 Next renewal due after 2023/10/16
 Certificate [Manual] mail1.cfts.co created

 N: Create certificate (default settings) <<
 M: Create certificate (full options)
 R: Run renewals (0 currently due)
 A: Manage renewals (2 total)
 O: More options...
 Q: Quit

 Please choose from the menu:

    '<<' mark the options I used, once done just pop back into mdaemon and check it picked up the SSL's from the windows CertificateStore.

    So now I can go back and get autodiscovery working :)

    0 likes
  • A

    While testing this morning, I noticed that I can now get to http://autodiscover.cfts.co and it redirects to https://autodiscover.cfts.co, most likely because of the new certificate that you put in place. Since challenges have now been completed for your hostnames, they will remain valid for a while and letsencrypt will not require new challenges to be completed.  We can try testing it, but until the LetsEncrypt challenges are expired, we won't know for sure.

    If you'd like to do more testing, turn off the redirect to HTTPS  and change the certificate.  To do this open MDaemon and go to Security / Security Settings / SSL & TLS / Webmail, select the radio button for HTTP and HTTPS. Then check the box next to your old certificate to activate it and uncheck the box next to your new certificate to deactivate it. Then restart webmail. Once webmail has restarted make sure you can connect to http://autodiscover.cfts.co and you are not redirected to https.  

    Then run the LetsEncrypt process in MDaemon.  You'll have to look at the log to see if LetsEncrypt required new challenges be completed.   

    --
    Arron Caruth

    0 likes
  • p

    Thanks Arron, I think i just keep using the 3rd party SSL tool, allowing http does not seems like a good idea, I gone to great lenghts to secure our system that seems like a step backwards, unless you tell me differnt?

    0 likes
  • A

    To be clear, I'm not suggesting that you leave it configured to not redirect HTTP to HTTPS. I'm just saying to allow HTTP so that you can test to make sure its working.  

    --
    Arron Caruth

    0 likes
  • p

    Ahh my bad, understood.

    0 likes
  • p

    Should you be interested, I've compiled a Statement of Process (SOP) for implementing auto-discovery with MDaemon its very specific to CFTS but should point you in the right direction :) it's quite comprehensive and covers the entire process, I'm more than willing to share a copy. Due to its length, I hesitate to post it here, but here is a link to the Autodiscover document

    0 likes
  • 1
  • 2 / 2
Please login to reply to this topic!

Participants