How Xera SSL issuance work?

[lamanrasmi]

Hi, i just want to confirm a few stuffs related to the SSL flow. Because i'm trying to create a user guide for my users.

1. Click the SSL Cert tab on dashboard.
2. Click Create Button.
3. Select SSL type and input the domain name.
4. ....this step onwards, i'm not sure how its work.......
5. SSL Pending Status. - when i click on Manage button, Let's Encrypt show acme TXT record info. Do the user need to create this record manually within the vpanel? How to add txt record in vpanel?
6. For GogetSSL - Once submitted & change to pending status, the Manage button show CNAME records that need to be added. Does the user need to create the CNAME record manually in vpanel?
7. I tested by setting the cname manually, and after sometime (what is the refresh time for cname verification?), the SSL changed to ACTIVE and the Manage section shows all the cert details to be inserted in vpanel. These had to be manually insert, right?

Am I getting the correct flow here?
Manual Process - add cname/txt record, insert generated ssl in vpanel, restart the same process for renewal.
Automated - cname verify, ssl generate

[mahtab2003]

Hi, i just want to confirm a few stuffs related to the SSL flow. Because i'm trying to create a user guide for my users.

1. Click the SSL Cert tab on dashboard.
2. Click Create Button.
3. Select SSL type and input the domain name.
4. ....this step onwards, i'm not sure how its work.......
5. SSL Pending Status. - when i click on Manage button, Let's Encrypt show acme TXT record info. Do the user need to create this record manually within the vpanel? How to add txt record in vpanel?
6. For GogetSSL - Once submitted & change to pending status, the Manage button show CNAME records that need to be added. Does the user need to create the CNAME record manually in vpanel?
7. I tested by setting the cname manually, and after sometime (what is the refresh time for cname verification?), the SSL changed to ACTIVE and the Manage section shows all the cert details to be inserted in vpanel. These had to be manually insert, right?

Am I getting the correct flow here? Manual Process - add cname/txt record, insert generated ssl in vpanel, restart the same process for renewal. Automated - cname verify, ssl generate

You are right about this but let me tell you that dns verification not automated. every time a pending ssl is viewed in the view ssl page it sends a request to it's respective server for verification and if it passes then ssl status changes to active.

[santydesignscr]

I want to clarify that now ACME uses CNAME delegation, so you can get a CNAME for validation

[Keshavi15]

Are there changes in SSL validation process? I tried to get SSL certificate with GoGetSSL, through CNAME validation, though adding CNAME record with domain registrar (NameSilo.com), status is pending, not proceeding. Asked with nameSilo, they said, thirdparty CNAME will not propagate, have to add through hosting. Added CNAME on hosting via cPanel, still there is no chance to propagate. Can anyone help?

[santydesignscr]

No, we didn't made any changes on the GoGetSSL module, and the CNAME records should propagate as normal, I don't know why they told you that

[greenreader9]

I tried to get SSL certificate with GoGetSSL, through CNAME validation, though adding CNAME record with domain registrar (NameSilo.com), status is pending, not proceeding. Asked with nameSilo, they said, thirdparty CNAME will not propagate, have to add through hosting. Added CNAME on hosting via cPanel, still there is no chance to propagate.

You need to add the record with your DNS provider (usually whoever your nameservers are pointing to). If you are using free hosting nameservers, add the records in your vP, if Cloudflare NS add in CF, etc...

Then remember that DNS changes are not instant, and it may take up to 72 hours.

Then also remember that GoGetSSL does not continuously recheck the records ever single second, so you may need to make the 'revalidate' API call or login to your GGSSL dash and request a check of the records.

[Keshavi15]

Yes. while using free nameservers crafted by MOFH such as ns1.freehosting-domain.com. We are pointing to free hosting nameservers, and on free hosting cPanel we are only allowed to add CNAME records. But unfortunately we get TXT records while ordering SSL from Lets Encrypt or ZeroSSL. These are not passing acme challenge. Wondering, how we can convert these TXT records to CNAME? Though greenreader9 has showed me the link https://letsencrypt.org/docs/challenge-types/ went through it and hopefully we have to go through https://www.eff.org/deeplinks/2018/02/technical-deep-dive-securing-automation-acme-dns-challenge-validation. Wondering if anyone has coded to generate ACME Magic (automate acme challange) like infinityfree.com is providing and allowing auto installation.

[Keshavi15]

Hi, santydesignscr. Just wondering if i made any mistake in setup. I am getting record-type: TXT not CNAME. I have attached images for reference.

[santydesignscr]

Do you have the latest version of Xera?

[Keshavi15]

Hi santydesignscr, I installed xera 1.3.1 (Eternity Enhanced) was on Xera 1.3 (previously). 1.3.1 has solved all issues: I can delete pending SSL orders, get SSLs CNAMEs & SSLs. Only problem, I encountered is: while creating hosting Account, though MOFH releases all hosting details, but on Xera Portal status remains pending. Callback action Not working probably. Though I have set Callback URL as https://domain-name/c/mofh
So, temporarily, I have made a change as:
File : app/models/mofh.php
Line: 183
Code: 'account_status' => 'pending', changed to 'account_status' => 'active',
This issue i had encountered with previous version 1.3 as well.
Thank you guys for your hard works.

[santydesignscr]

Please check the callback url, thats the problem, some users had it too, if it starts with https change to http, or if it starts with http change to https, change that on MOFH Panel

[NotKRhero]

in xera it shows to put
https://dash.myhosting.tld/c/mofh
as u sayed i have to put in mofh panel as
http://dash.myhosting.tld/c/mofh
???

[santydesignscr]

Try with both, the one that works is good for you

[santydesignscr]

It depends of your server