Request DietPi-Banner Certification Status showing expiration date of ACTIVE certificate (or all certificates)

[echtfrank]

More than a year ago, I had to restore my system after my SD-card broke. With some help I managed to restore my system using a fresh DietPi-image using the "restore-on-first-boot" function.

The only thing that I needed te repair manually was my certicate (Letsencrypt)... From the logging I now know that there was quite some time between the last backup and the restore. Meanwhile the old certification was not valid anymore, so I exectued Letsencrypt and everything worked: I have a working system. Nextcloud is available on my own domain and the certificate is renewed.

Only thing is that DietPi-Banner keeps showing the old VALID until date

- Let's Encrypt cert status : Valid until 2024-Nov-26 05:49:34 
- MOTD : Open Beta v10.0 | Please help testing our upcoming release: [https://github.com/MichaIng/]

I see that I now have multiple certificates (folders in /etc/letsencrypt/live/*). One of them being the active certicate, the others are history / obsolete. In the DietpiBanner-code I can see that only the first certificate found (in case of multiple certificates) is shown in the banner.

Suggestion:

• In case of multiple certicates, show them all? For example:

Certificate: /etc/letsencrypt/live/example.com/cert.pem
Valid until 2026-14-Jan 12:00:00
----------------------------------------
Certificate: /etc/letsencrypt/live/anotherdomain.com/cert.pem
Valid until 2026-20-Feb 10:30:00
----------------------------------------

Questions:

• Is it possible to only show the actual certificate? I don't know if it is possible to determine this in letsencrypt-configfiles?
• Can I just manually remove obsolete subfolders in /etc/letsencrypt/live/*? or is there any other way to clean this up?

Thanks in advance,
Frank

[MichaIng]

So you registered a new domain and the old one is not in use anymore (on this system)? You could just remove the obsolete one:

sudo certbot delete --cert-name anotherdomain.com

Since both are active/valid, we cannot know which one is the "actual" one, or we would need to check the webserver config. But the other one could be well used by other web applications.

Also, if you do need multiple domains, you can do that with kne cert, entering the domain names comma-separated. The first is taken as main domain, and applied to webserver configs, in case. But the cert will then be valid for the other entered domains as well.

Listing all certs would be an option, but requires some adjustment of the current single-line info.

[echtfrank]

I am going to explain a bit. I think that I have multiple certificates (folders in /etc/.../live/), because I experimented with subdomains. E.g. first time running Letsecrypt I generated a certificate for "mydomain.com, cloud.mydomain.com, photos.mydomain.com" and after a while I ran Letsecrypt again but now for "mydomain.com, cloud.mydomain.com, jellyfin.mydomain.com" - effectively replacing subdomain photos with jellyfin. It is very likely I did such action again later. So technically speaking I have one domain.

I made these explicit subdomains in the certificates in an effort 'to make things explicit'... May be that was not very handy. What is handy? Could you give some advice? Should I only use "mydomain.com"? Is that suitable for evntually subdomains?

[MichaIng]

As long as the first domain in the list is the same, it should have the same certificate name "mydomain.com", i.e. overwriting the existing one in case. Using your examples, "mydomain.com" is not a subdomain of "anotherdomain.com" vice versa, is it? But I never really tried, also not sure what it does if you use a subdomain as first domain, and the parent domain later. Anyway, not an issue to just removing the obsolete certificate name, whatever domain name it has.

A cert for a parent domain is not automatically valid for its subdomains. An alternative to explicit subdomains is wildcard domains. But those do not work with the ACME challenge, since theoretically it would need to check every possible subdomain name, to verify you really own all of them. The owner of the parent domain is not necessarily the owner of all of its subdomains. So this works only with a "DNS challenge". For this you need an additional plugin for Certbot, which depends on the registrar/domain provider you use: https://eff-certbot.readthedocs.io/en/latest/using.html#dns-plugins

But dietpi-letsencrypt does not support that directly, i.e. you need to call certbot manually then with the respective arguments to do the challenge with the plugin. Since dietpi-letsencrypt also just calls certbot to create or renew certs, it does not conflict, but either the certs overwrite each other or are created and renewed aside of each other, depending on the cert name (primary domain).