Cannot find issuer for certificate about letsencrypt-siteextension HOT 16 CLOSED

We moved all our certificates to Azure app service managed certificates. They are free now, so the use of this extension is somewhat deprecated.
App service managed certificates does exactly what this plugin does as well, but with certificates from another provider.

from letsencrypt-siteextension.

Uploaded a new version, but didnt test it, let me know if it fixes anything.

from letsencrypt-siteextension.

Same here:

This is the thread from Lets Encrypt Forum for your information

https://community.letsencrypt.org/t/can-not-find-issuer-c-us-o-internet-security-research-group-cn-isrg-root-x1-for-certificate-c-us-o-lets-encrypt-cn-r3/208268

from letsencrypt-siteextension.

My colleague and me forked the code and updated several libraries and also the .net version to be able to update the used Certes library.
Please see the pull request pointing to this issue.

We have updated our plugin, but it would be really nice if the pull request was merged and a new extension was published to the azure marketplace.

from letsencrypt-siteextension.

Same challenge here. I also moved to managed certificates for app service.

https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex#create-a-free-managed-certificate

from letsencrypt-siteextension.

It seems we have the same issue since last Saturday on renewing our certificates.

Exception while executing function: Functions.RenewCertificate Microsoft.Azure.WebJobs.Host.FunctionInvocationException : Exception while executing function: Functions.RenewCertificate ---> Certes.AcmeException : Can not find issuer 'C=US,O=Internet Security Research Group,CN=ISRG Root X1' for certificate 'C=US,O=Let's Encrypt,CN=R3'. at Certes.Pkcs.CertificateStore.GetIssuers(Byte[] der) at Certes.CertificateChainExtensions.ToPem(CertificateChain certificateChain,IKey certKey) at async LetsEncrypt.Azure.Core.Services.AcmeService.RequestCertificate() at D:\a\1\s\LetsEncrypt.SiteExtension.Core\Services\AcmeService.cs : 61 at async LetsEncrypt.Azure.Core.CertificateManager.RequestInternalAsync(IAcmeConfig config) at D:\a\1\s\LetsEncrypt.SiteExtension.Core\CertificateManager.cs : 210 at async LetsEncrypt.Azure.Core.CertificateManager.RequestAndInstallInternalAsync(IAcmeConfig config) at D:\a\1\s\LetsEncrypt.SiteExtension.Core\CertificateManager.cs : 234 at async LetsEncrypt.Azure.Core.CertificateManager.RenewCertificate(Boolean skipInstallCertificate,Int32 renewXNumberOfDaysBeforeExpiration) at D:\a\1\s\LetsEncrypt.SiteExtension.Core\CertificateManager.cs : 176 at async LetsEncrypt.SiteExtension.Functions.RenewCertificate(TimerInfo timerInfo) at D:\a\1\s\LetsEncrypt.SiteExtension.WebJob\Functions.cs : 68 at async Microsoft.Azure.WebJobs.Host.Executors.VoidTaskMethodInvoker2.InvokeAsync[TReflected,TReturnType](TReflected instance,Object[] arguments)
at async Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker2.InvokeAsync[TReflected,TReturnValue](Object instance,Object[] arguments) at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeAsync(IFunctionInvoker invoker,ParameterHelper parameterHelper,CancellationTokenSource timeoutTokenSource,CancellationTokenSource functionCancellationTokenSource,Boolean throwOnTimeout,TimeSpan timerInterval,IFunctionInstance instance) at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstance instance,ParameterHelper parameterHelper,TraceWriter traceWriter,CancellationTokenSource functionCancellationTokenSource) at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(??) at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(??) End of inner exception

from letsencrypt-siteextension.

@wzoet - I did a similar thing a while back to enable using a newer version of the WebSites Management dll. The issue detailed above is a new problem that is coming down the line when Lets Encrypt make changes to the certificate chain. This will require Certes and Bouncy Castle changes from what I can make out as well.

from letsencrypt-siteextension.

@wzoet I tried upgrading the packages but couldn't get the certificate to upload to Azure anymore.

Got the following : BadRequest - At least one certificate is not valid (Certificate failed validation because it could not be loaded)

Not sure what package I shouldn't have updated but I had to roll back to keep production running.

Will need to go through them one at a time to figure out what happened using your pull request.

Really wish sjkp would help out on this. Great package,

from letsencrypt-siteextension.

@wzoet Thank-You! I was able to use your updates to successfully renew my certificate after getting the above error.

from letsencrypt-siteextension.

@wzoet, @joshualinde could you please share how to use this pull request to renew certificates on existing App Services? Is it needed to build and publish it as separate App Service Extension to nuget like here?

from letsencrypt-siteextension.

@wzoet Thank you, I somehow missed that App service managed certificates already supports naked domains.

from letsencrypt-siteextension.

Same issue, seems like somethings changed and the extension no longer works:

Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Microsoft.Azure.WebJobs.Host.FunctionInvocationException : Exception while executing function: Functions.RenewCertificate ---> Certes.AcmeException : Can not find issuer 'C=US,O=Internet Security Research Group,CN=ISRG Root X1' for certificate 'C=US,O=Let's Encrypt,CN=R3'. at Certes.Pkcs.CertificateStore.GetIssuers(Byte[] der) at Certes.CertificateChainExtensions.ToPem(CertificateChain certificateChain,IKey certKey) at async LetsEncrypt.Azure.Core.Services.AcmeService.RequestCertificate() at D:\a\1\s\LetsEncrypt.SiteExtension.Core\Services\AcmeService.cs : 61 at async LetsEncrypt.Azure.Core.CertificateManager.RequestInternalAsync(IAcmeConfig config) at D:\a\1\s\LetsEncrypt.SiteExtension.Core\CertificateManager.cs : 210 at async LetsEncrypt.Azure.Core.CertificateManager.RequestAndInstallInternalAsync(IAcmeConfig config) at D:\a\1\s\LetsEncrypt.SiteExtension.Core\CertificateManager.cs : 234 at async LetsEncrypt.Azure.Core.CertificateManager.RenewCertificate(Boolean skipInstallCertificate,Int32 renewXNumberOfDaysBeforeExpiration) at D:\a\1\s\LetsEncrypt.SiteExtension.Core\CertificateManager.cs : 176 at async LetsEncrypt.SiteExtension.Functions.RenewCertificate(TimerInfo timerInfo) at D:\a\1\s\LetsEncrypt.SiteExtension.WebJob\Functions.cs : 68 at async Microsoft.Azure.WebJobs.Host.Executors.VoidTaskMethodInvoker2.InvokeAsync[TReflected,TReturnType](TReflected instance,Object[] arguments)
at async Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker2.InvokeAsync[TReflected,TReturnValue](Object instance,Object[] arguments) at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.InvokeAsync(IFunctionInvoker invoker,ParameterHelper parameterHelper,CancellationTokenSource timeoutTokenSource,CancellationTokenSource functionCancellationTokenSource,Boolean throwOnTimeout,TimeSpan timerInterval,IFunctionInstance instance) at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithWatchersAsync(IFunctionInstance instance,ParameterHelper parameterHelper,TraceWriter traceWriter,CancellationTokenSource functionCancellationTokenSource) at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(??) at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(??) End of inner exception at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.ExecuteWithLoggingAsync(??) at async Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.TryExecuteAsync(IFunctionInstance functionInstance,CancellationToken cancellationToken)

from letsencrypt-siteextension.

@sjkp what are the chances of having #417 merged?

I appreciate this extension is mostly deprecated but it still fills in some useful gaps such as wildcard renewal, the PR would unblock those who still need this

from letsencrypt-siteextension.

I can merge it in, and make a new release, but I'm not going to do any extensive testing, as I'm not using the extension anymore.

from letsencrypt-siteextension.

@sjkp it worked the certificate renewed successfully after the update! Thank you!

from letsencrypt-siteextension.

@sjkp Thanks very much, this issue can be closed now I believe

from letsencrypt-siteextension.