# Error when Provisioning TLS certs

**URL:** <https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758>\
**Category:** Help with Setup/Upgrade\
**Created:** [December 20, 2016, 4:36pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758 "2016-12-20T16:36:50Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![B\_DubHay](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/b/ed8c4c/32.png) [@B\_DubHay](https://discourse.mailinabox.email/u/B_DubHay)\
**Post date:** [December 20, 2016, 4:36pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/1 "2016-12-20T16:36:50Z")

</div>

Hello, it is time for me to get my tls certs renewed. I logged into my admin account, went to the TLS (SSL) Certificates page, hit the “Provision” button and get an error message. I tried looking through the MIAB forums but nothing in there helped resolve my problem. I look in my syslog and found an unusual (unusual to me at least) error:

`Dec 20 10:08:19 mail Exception on /ssl/provision ....... self._ctx.set_cipher_list(ciphers)#012TypeError: must be str, not bytes`

Is that the problem or is more information needed? Thanks.

Brian.

---

<div class="post-metadata">

**Author:** ![v60fan](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/v60fan/32/277_2.png) [@v60fan](https://discourse.mailinabox.email/u/v60fan)\
**Post date:** [December 20, 2016, 6:36pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/2 "2016-12-20T18:36:00Z")

</div>

There’s a couple threads floating around on this one. Try executing these commands and then going back to TLS to renew.

> ```
> apt-get remove python-openssl
> pip3 uninstall pyOpenSSL
> pip3 install pyOpenSSL --upgrade
> 
> ```

Other thread that had this resolution: [Let's encrypt failure: exception on /ssl/provision - #2 by mboersma](https://discourse.mailinabox.email/t/lets-encrypt-failure-exception-on-ssl-provision/1747/2)

---

<div class="post-metadata">

**Author:** ![mboersma](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/mboersma/32/474_2.png) [@mboersma](https://discourse.mailinabox.email/u/mboersma)\
**Post date:** [December 20, 2016, 6:48pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/3 "2016-12-20T18:48:25Z")

</div>

I’ve done exactly that (and several variations thereof), but it’s still broken with the `must be str, not bytes` error on my upgraded box.

---

<div class="post-metadata">

**Author:** ![mboersma](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/mboersma/32/474_2.png) [@mboersma](https://discourse.mailinabox.email/u/mboersma)\
**Post date:** [December 20, 2016, 6:55pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/4 "2016-12-20T18:55:25Z")

</div>

Well it never hurts to question your own assumptions! I repeated the above three commands and this time management/daily\_tasks.sh succeeded at provisioning new LetsEncrypt certs.

I swear I’d tried those same commands. Maybe I had reinstalled the packaged `python-openssl` version again, which seems to be the source of the conflict.

Thanks all!

---

<div class="post-metadata">

**Author:** ![B\_DubHay](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/b/ed8c4c/32.png) [@B\_DubHay](https://discourse.mailinabox.email/u/B_DubHay)\
**Post date:** [December 20, 2016, 7:15pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/5 "2016-12-20T19:15:44Z")

</div>

Thank you for the response. I’ve ran those commands before which solved a different problem I had. Do I need to run those commands after every upgrade of MIAB?

Also, after running those commands, and rebooting my MIAB machine, the provision button is still grayed out (not clickable), I don’t see any clues in the syslog file either. Where do go now?

---

<div class="post-metadata">

**Author:** ![v60fan](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/v60fan/32/277_2.png) [@v60fan](https://discourse.mailinabox.email/u/v60fan)\
**Post date:** [December 20, 2016, 9:04pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/6 "2016-12-20T21:04:02Z")

</div>

You shouldn’t need to run them again after every upgrade, no. I’m actually not sure how to solve your current issue.

---

<div class="post-metadata">

**Author:** ![B\_DubHay](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/b/ed8c4c/32.png) [@B\_DubHay](https://discourse.mailinabox.email/u/B_DubHay)\
**Post date:** [December 20, 2016, 9:56pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/7 "2016-12-20T21:56:00Z")

</div>

Well that was wierd. I went back into my administrator dashboard and the Provision button was active. I clicked it and I got the button to agree to terms of service (?). Now everything is working.

---

<div class="post-metadata">

**Author:** ![B\_DubHay](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/b/ed8c4c/32.png) [@B\_DubHay](https://discourse.mailinabox.email/u/B_DubHay)\
**Post date:** [December 20, 2016, 9:59pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/8 "2016-12-20T21:59:27Z")

</div>

How do i go about automating this process now? Is there a cron job I can make?

---

<div class="post-metadata">

**Author:** ![v60fan](https://discourse.mailinabox.email/user_avatar/discourse.mailinabox.email/v60fan/32/277_2.png) [@v60fan](https://discourse.mailinabox.email/u/v60fan)\
**Post date:** [December 20, 2016, 10:00pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/9 "2016-12-20T22:00:37Z")

</div>

It should automatically renew the certs before they expire. There is nothing more you need to do.

---

<div class="post-metadata">

**Author:** ![sander-schippers](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/s/74df32/32.png) [@sander-schippers](https://discourse.mailinabox.email/u/sander-schippers)\
**Post date:** [December 25, 2016, 10:44am UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/10 "2016-12-25T10:44:35Z")

</div>

For me, this worked perfectly. Had exactly the same problem. Thanks for posting it.

---

<div class="post-metadata">

**Author:** ![User5519](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/u/b77776/32.png) [@User5519](https://discourse.mailinabox.email/u/User5519)\
**Post date:** [December 26, 2016, 10:32am UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/11 "2016-12-26T10:32:56Z")

</div>

Worked for me with Python 2.7.6 and running ‘management/ssl\_certificates.py’ as root afterwards, thank you very much!

---

<div class="post-metadata">

**Author:** ![cc.noyes](https://discourse.mailinabox.email/letter_avatar_proxy/v4/letter/c/858c86/32.png) [@cc.noyes](https://discourse.mailinabox.email/u/cc.noyes)\
**Post date:** [December 26, 2016, 2:56pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/12 "2016-12-26T14:56:35Z")

</div>

I had a similar problem a couple of weeks ago. I solved it uprev’ing to the latest MIAB (v0.21b) - I was running a slightly older version. After the up-rev completed, I rebooted my server, logged into the Admin account via the GUI, clicked on the “Provision” button and the certs were renewed.

However, if everything is set up and working correctly, the LetsEncrypt certs should automatically renew without any user interaction.

---

<div class="post-metadata">

**Author:** ![system](https://discourse.mailinabox.email/uploads/default/original/2X/4/4d0933d13c456b7e57f296aa6cc344525b6f0c70.png) [@system](https://discourse.mailinabox.email/u/system)\
**Post date:** [January 2, 2017, 2:56pm UTC](https://discourse.mailinabox.email/t/error-when-provisioning-tls-certs/1758/13 "2017-01-02T14:56:46Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.