![[PukiWiki]](image/pukiwiki.png "[PukiWiki]")
#author("2023-11-30T09:52:44+09:00","default:kuji","kuji") #author("2023-11-30T10:07:26+09:00","default:kuji","kuji") CONTENTS #contents ---- Lastmodified &lastmod; ---- *Certbot_Renew_Error [#z656048b] FreeBSD Base system の OpenSSLを使用している py-certbot は、certbot renew 出来るのに、 /etc/make.conf NO_SENDMAIL= true DEFAULT_VERSIONS+= perl5=5.34 # DEFAULT_VERSIONS+=ruby=2.7 DEFAULT_VERSIONS+=ssl=openssl ← これ OPTIONS_UNSET+=X11 #FORCE_PKG_REGISTER=yes #OPTIONS_UNSET+=GUI DEFAULT_VERSIONS+= bdb=18 WITH_BDB6_PERMITTED=yes の様に、ports でインストールしたOpenSSLで、certbot renew しようとするとエラーになる。 # /root/bin/Certbot_Renew.sh Traceback (most recent call last): File "/usr/local/bin/certbot", line 33, in <module> sys.exit(load_entry_point('certbot==2.7.4', 'console_scripts', 'certbot')()) File "/usr/local/bin/certbot", line 25, in importlib_load_entry_point return next(matches).load() File "/usr/local/lib/python3.9/importlib/metadata.py", line 86, in load module = import_module(match.group('module')) File "/usr/local/lib/python3.9/importlib/__init__.py", line 127, in import_module return _bootstrap._gcd_import(name[level:], package, level) File "<frozen importlib._bootstrap>", line 1030, in _gcd_import File "<frozen importlib._bootstrap>", line 1007, in _find_and_load File "<frozen importlib._bootstrap>", line 986, in _find_and_load_unlocked File "<frozen importlib._bootstrap>", line 680, in _load_unlocked File "<frozen importlib._bootstrap_external>", line 850, in exec_module File "<frozen importlib._bootstrap>", line 228, in _call_with_frames_removed File "/usr/local/lib/python3.9/site-packages/certbot/main.py", line 6, in <module> from certbot._internal import main as internal_main File "/usr/local/lib/python3.9/site-packages/certbot/_internal/main.py", line 21, in <module> import josepy as jose File "/usr/local/lib/python3.9/site-packages/josepy/__init__.py", line 40, in <module> from josepy.json_util import ( File "/usr/local/lib/python3.9/site-packages/josepy/json_util.py", line 14, in <module> from OpenSSL import crypto File "/usr/local/lib/python3.9/site-packages/OpenSSL/__init__.py", line 8, in <module> from OpenSSL import SSL, crypto File "/usr/local/lib/python3.9/site-packages/OpenSSL/SSL.py", line 9, in <module> from OpenSSL._util import ( File "/usr/local/lib/python3.9/site-packages/OpenSSL/_util.py", line 6, in <module> from cryptography.hazmat.bindings.openssl.binding import Binding File "/usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 15, in <module> from cryptography.exceptions import InternalError File "/usr/local/lib/python3.9/site-packages/cryptography/exceptions.py", line 9, in <module> from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions ImportError: /usr/local/lib/python3.9/site-packages/cryptography/hazmat/bindings/_rust.abi3.so: Undefined symbol "EVP_default_properties_is_fips_enabled" root@blackcube:~:23_11_28:9:07 # 同じようなエラーが、https://freebsd.sing.ne.jp/daily/13/14.html に記載されていた。 こちらの記事では、cryptography をPIPインストールして最新版にすることでエラー回避出来た様だ。が、最終手段としてφ(.. )メモ // root@blackhole:/usr/ports/security/openssl:23_11_28:14:59 # pkg info -r openssl // openssl-3.0.12_1,1: // postgresql12-client-12.17 // php81-imap-8.1.26 // php81-snmp-8.1.26 // php81-ftp-8.1.26 // php81-8.1.26 // py39-cryptography-41.0.5,1 // rust-1.73.0 // cmake-core-3.27.8 // python39-3.9.18 // postfix-3.8.2,1 // freetds-1.4.6,1 // mod_php81-8.1.25 // apache24-2.4.58_1 // p5-Net-SSLeay-1.92 // cyrus-sasl-saslauthd-2.1.28 // monit-5.33.0 // root@blackhole:/usr/ports/security/openssl:23_11_28:DING! # pkg info -d openssl // openssl-3.0.12_1,1: //// postgresql12-client php81-imap php81-snmp-8.1.26 php81-ftp php81 py39-cryptography rust-1.73.0 cmake-core python39 postfix freetds mod_php81 apache24 p5-Net-SSLeay cyrus-sasl-saslauthd monit ** OpenSSL のコンパイルオプションで対応 [#vdc591d0] エラー内様で "EVP_default_properties_is_fips_enabled" とあるので、FIPSのチェックを外して make しただけでは、エラー回避出来なかったと https://community.letsencrypt.org/t/did-openssl-3-0-break-certbot/207661/21 に記載があるので、LEGACY にチェックをいれてみる、と・・・ &ref(OpenSSL_config.PNG); FIPS のチェックを外し、LEGACY のチェックを入れる。 cd /usr/ports/security/openssl make deinstall make install clean エラー回避出来た！ # /root/bin/Certbot_Renew.sh Saving debug log to /var/log/letsencrypt/letsencrypt.log - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Processing /usr/local/etc/letsencrypt/renewal/blackhole.smb.net.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Hook 'pre-hook' ran with output: Stopping apache24. Waiting for PIDS: 29144. Renewing an existing certificate for blackhole.smb.net - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Congratulations, all renewals succeeded: /usr/local/etc/letsencrypt/live/blackhole.smb.net/fullchain.pem (success) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Hook 'post-hook' ran with output: Performing sanity check on apache24 configuration: Starting apache24. Hook 'post-hook' ran with error output: Syntax OK ---- **ところが、これをしても、エラーが出る機体がある。 [#m2585263] %% # cd /usr/ports/security/openssl %%~ %% make deinstall%% %%/etc/make.conf%%~ %% DEFAULT_VERSIONS+=ssl=openssl ← コメントアウトする%%~ %% reboot%% あれこれ試すも、エラー回避出来たのが、 %% # portupgrade -rfR py39-certbot-2.7.4,1 --batch%%~ %%NG!%% # portupgrade -rfR py39-cryptography --batch で、エラー回避できた。OK *** py-cryptgraphy ver up 最終手段？ [#jf00d1f6] [[PIP]]を用いる方法。別ページに記載 ---- Total access &counter(total);：本日 &counter(today);：昨日 &counter(yesterday); #counter([total|today|yesterday]);
