问题起因
代理证书到期，自动续期失败，提示Nginx启动失败。
问题一：Ubuntu 20.04自带的apache2占用80端口导致nginx启动失败
- 首先考虑了Nginx版本问题。先尝试升级Nginx，但由于未知原因导致卸载Nginx后apt无法正常使用，只能使用系统备份恢复到 Jan 28, 2023 状态。
- 再次试图手动启动nginx，发现日志提示80端口被占用，搜索了nginx的80端口占用问题。
- 查看占用80端口的进程，发现是apache2（web服务器软件），搜索后得知是ubuntu20.04自带的。
- 尝试 kill apache2后发现又会重启，搜索后得知需要修改配置文件的监听端口或者卸载。这里选择修改默认监听端口。
# 查看占用 netstat -lnp|grep 80 # 返回结果 # tcp6 0 0 :::80 :::* LISTEN 3606/apache2
# 找到目录 whereis apache2 cd /etc/apache2 vim ports.conf # 修改Listen后80端口为其他，例如880 # 再次kill掉 apache2 # 重启nginx nginx # 查看占用情况 netstat -lnp|grep 80 # 发现现在是nginx占用80端口 tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 4323/nginx: master
问题二：acme证书续期失败
解决端口占用问题后，证书依然无法续期，用vasma自带的证书更新功能会报错，提示nginx启动失败，日志如下：
[Sun 05 Feb 2023 11:27:02 PM UTC] ===Starting cron=== [Sun 05 Feb 2023 11:27:02 PM UTC] Renew: '*.dariolink.ml' [Sun 05 Feb 2023 11:27:02 PM UTC] Renew to Le_API=https://acme-v02.api.letsencrypt.org/directory [Sun 05 Feb 2023 11:27:02 PM UTC] It seems that you are using dns manual mode. Read this link first: https://github.com/acmesh-official/acme.sh/wiki/dns-manual-mode [Sun 05 Feb 2023 11:27:02 PM UTC] Error renew *.dariolink.ml_ecc. [Sun 05 Feb 2023 11:27:02 PM UTC] ===End cron=== [Sun 05 Feb 2023 11:27:02 PM UTC] The domain 'proxy.dariolink.ml' is not a cert name. You must use the cert name to specify the cert to install. [Sun 05 Feb 2023 11:27:02 PM UTC] Can not find path:'/root/.acme.sh/proxy.dariolink.ml_ecc'
手动启动nginx，发现在试图启用3977端口，这是老配置用过的端口，怀疑是老脚本残留，在系统里依然有自动任务在执行。查看3977端口占用情况，发现是xray占用，kill后没有自动重启。
root@vultr:~# nginx nginx: [emerg] bind() to 0.0.0.0:3977 failed (98: Address already in use) nginx: [emerg] bind() to [::]:3977 failed (98: Address already in use) nginx: [emerg] bind() to 0.0.0.0:3977 failed (98: Address already in use) nginx: [emerg] bind() to [::]:3977 failed (98: Address already in use) nginx: [emerg] bind() to 0.0.0.0:3977 failed (98: Address already in use) nginx: [emerg] bind() to [::]:3977 failed (98: Address already in use) nginx: [emerg] bind() to 0.0.0.0:3977 failed (98: Address already in use) nginx: [emerg] bind() to [::]:3977 failed (98: Address already in use) nginx: [emerg] bind() to 0.0.0.0:3977 failed (98: Address already in use) nginx: [emerg] bind() to [::]:3977 failed (98: Address already in use) nginx: [emerg] still could not bind() root@vultr:~# netstat -lnp|grep 80 tcp6 0 0 :::8007 :::* LISTEN 704/filebrowser root@vultr:~# netstat -lnp|grep 3977 tcp6 0 0 :::3977 :::* LISTEN 8215/xray
尝试用vasma重新安装，其他组件都正常，但证书依然更新失败，遂准备手动用acme.sh申请证书。
acme官方建议用DNS API来自动续订证书，支持DNS API的域名服务商列表如下：
CTRL+F搜索不到代理使用的freedom服务商，只能考虑DNS手动模式，官方文档如下：
但按照指导步骤执行，一直卡在TXT record验证阶段，报错如下：
[Sun 05 Feb 2023 11:47:11 PM UTC] Please be aware that you prepend _acme-challenge. before your domain [Sun 05 Feb 2023 11:47:11 PM UTC] so the resulting subdomain will be: _acme-challenge.proxy.dariolink.ml [Sun 05 Feb 2023 11:47:11 PM UTC] Please add the TXT records to the domains, and re-run with --renew.
不知道是否是domain头问题，又按照官方文档对使用nginx的指导，尝试重新申请。
acme.sh --issue -d mydomain.com --nginx
验证时报错
[Sun 05 Feb 2023 11:49:15 PM UTC] Reload nginx [Sun 05 Feb 2023 11:49:17 PM UTC] Processing, The CA is processing your order, please just wait. (1/30) [Sun 05 Feb 2023 11:49:21 PM UTC] Processing, The CA is processing your order, please just wait. (2/30) [Sun 05 Feb 2023 11:49:24 PM UTC] Processing, The CA is processing your order, please just wait. (3/30) [Sun 05 Feb 2023 11:49:28 PM UTC] proxy.dariolink.ml:Verify error:"error":{ [Sun 05 Feb 2023 11:49:28 PM UTC] Restoring from /root/.acme.sh/proxy.dariolink.ml_ecc/backup/proxy.dariolink.ml.nginx.conf to /etc/nginx/conf.d/alone.conf [Sun 05 Feb 2023 11:49:28 PM UTC] Reload nginx
再次试图用vasma重装时发现刚才用acme手动申请的example证书被识别到
[Sun 05 Feb 2023 11:49:47 PM UTC] ===Starting cron=== [Sun 05 Feb 2023 11:49:47 PM UTC] Renew: '*.dariolink.ml' [Sun 05 Feb 2023 11:49:47 PM UTC] Renew to Le_API=https://acme-v02.api.letsencrypt.org/directory [Sun 05 Feb 2023 11:49:47 PM UTC] It seems that you are using dns manual mode. Read this link first: https://github.com/acmesh-official/acme.sh/wiki/dns-manual-mode [Sun 05 Feb 2023 11:49:47 PM UTC] Error renew *.dariolink.ml_ecc. [Sun 05 Feb 2023 11:49:47 PM UTC] Renew: 'example.com' [Sun 05 Feb 2023 11:49:47 PM UTC] Renew to Le_API=https://acme.zerossl.com/v2/DV90 [Sun 05 Feb 2023 11:49:47 PM UTC] Skip invalid cert for: example.com [Sun 05 Feb 2023 11:49:47 PM UTC] Skipped example.com_ecc [Sun 05 Feb 2023 11:49:47 PM UTC] Renew: 'proxy.dariolink.ml' [Sun 05 Feb 2023 11:49:47 PM UTC] Renew to Le_API=https://acme.zerossl.com/v2/DV90 [Sun 05 Feb 2023 11:49:47 PM UTC] Skip invalid cert for: proxy.dariolink.ml [Sun 05 Feb 2023 11:49:47 PM UTC] Skipped proxy.dariolink.ml_ecc [Sun 05 Feb 2023 11:49:47 PM UTC] ===End cron===
遂准备删除acme目录下所有域名的证书，重头申请。
vasma申请了两次TLS证书，第一次报错如下：
---> TLS安装失败，正在检查80、443端口是否开放 /usr/bin/vasma: /usr/sbin/ufw: /usr/bin/python3: bad interpreter: Permission denied /usr/bin/vasma: /usr/sbin/ufw: /usr/bin/python3: bad interpreter: Permission denied
这个老问题出现较久了，在试图解决问题一：Ubuntu 20.04自带的apache2占用80端口导致nginx启动失败 时nginx list无法被apt读取就是报同样的错误，google了很多问题都没提供解决方案，这个问题得持续追踪来解决 。
第二次安装后成功，两次安装的差别暂不清楚。
至此，问题解决。
总结与后续跟进
- Unbuntu自带Apache2默认占用80端口，会和http冲突，这个问题要注意
- vasma证书续期时删除acme目录下所有带有域名的目录，可以重新申请。
- - freedom不支持DNS API, 无法自动续期
找一个靠谱的域名服务商，购买一个长期域名
python bad interpreter问题(https://www.notion.so/dariolink/ubuntu-python3-permission-denied-3afd66a494644baeb2c2f05bdf54ceaf)