bncert-tool

medtatva 2019-10-29 17:34:15 UTC #1

Keywords: Django - Google Cloud Platform - Technical issue - Secure Connections (SSL/HTTPS)
bnsupport ID: 4bf6472c-1820-c0d9-eda8-dc12697f2abf
Description:
I am using the bitnami django on Google Cloud platform stack.

I have purchased a domain using google domains.

I have set up google dns to point to the IP address as I see in the bitnami stack.
mydomain.com and www.mydomain.com -> ipaddress/home in Google domain name settings

I then tried to run the tool /opt/bitnami/bncert-tool:
sudo /opt/bitnami/bncert-tool

Welcome to the Bitnami HTTPS Configuration tool.

Domains

Please provide a valid space-separated list of domains for which you wish to
configure your web server.

Domain list []: mydomain.com

The following domains were not included: www.medtatva.com. Do you want to add them? [Y/n]: n

Warning: No www domains (e.g. www.example.com) or non-www domains (e.g.
www.example.com) have been provided, so the following redirections will be
disabled: non-www to www, www to non-www.
Press [Enter] to continue:
Warning: The domain 'mydomain.com' resolves to a different IP address than the
one detected for this machine, which is 'aa.bb.ccc.dddd'. Please fix its DNS
entries or remove it. For more info see:
https://docs.bitnami.com/general/faq/configuration/configure-custom-domain/
Press [Enter] to continue:

MY QUESTION:
How do I resolve this? I even tried adding both domains
mydomain.com www.mydomain.com

I want SSL enabled for https://mydomain.com and https://www.mydomain.com and not sure where I am going wrong?

Secondy, after the link forwards, how to associate my domain name so that the static IP doesn't keep displaying instead it shows the mapped domain mydomain.com/home

I use the google https://domains.google.com/m/registrar/medtatva.com/dns to forward the mydomain.com to my ip address. It auto adds the A entries.
thanks
Suds

medtatva 2019-10-30 02:26:05 UTC #3

Would it be possible to expedite the response to the above question? We are blocked hence the urgency.

medtatva 2019-10-30 09:03:42 UTC #4

I have checked my google dns settings it clearly says

Domain forward
mydomain.com, www.mydomain.com → http://IP address specified/medtatva/home/

medtatva 2019-10-30 09:04:28 UTC #5

Domain forwards to
http://ip address/home/
Redirect Type
Temporary redirect (302)
Path forwarding
Do not forward p
ath
SSL
SSL On

medtatva 2019-10-30 09:17:09 UTC #6

I tried multiple things but still get the error
"Warning: The domain 'mydomain.com' resolves to a different IP address than the
one detected for this machine, which is 'aa.bb.ccc.dddd'."

medtatva 2019-10-30 09:21:12 UTC #7

No files called bncert*.loog in
/tmp/ called bncert-*.log

medtatva 2019-10-30 09:23:46 UTC #8

DNS Checker - DNS Check Propagation Tool Used this tool

IT is clear. I am able to resolve my IP address also.

medtatva 2019-10-30 09:24:50 UTC #9

I refered to your doc
https://docs.bitnami.com/aws/faq/configuration/configure-custom-domain/

and ensure static ip is set at the nic level. when I click on vM instances and see the external IP it shows the same as the one I am trying to map into.

medtatva 2019-10-30 09:50:30 UTC #10

when I run the command
sudo /opt/bitnami/bncert-tool

I don't get the list of options. the following chnages will be performed..... So I don't even get to that point.

gongomgra 2019-10-30 11:04:57 UTC #11

Hi @medtatva,

As you can see in the link below, your DNS configuration is different for medtatva.com and for www.medtatva.com

https://www.whatsmydns.net/#A/medtatva.com
https://www.whatsmydns.net/#A/www.medtatva.com

One is pointing to multiple IP address (which usually means that you are using a load balancer or a CDN) and the other one is pointing to different IP address depending on the DNS server. Can you ensure your DNS configuration is ok?

In case you are using a load balancer, please note the bncert tool won't work in that scenario, because your server IP address and the load balancer IP address will never match.

Regards,
Gonzalo

medtatva 2019-10-30 13:39:06 UTC #12

I am just using Google Domain Name service and forwarding requests from the domain to the static ip address I have from you folks. This is a bitnami stack on top of Django framework hosted on Google Cloud Platform. I have no load balancer etc installed on my own at least.

jota 2019-10-31 10:51:00 UTC #13

Hi @medtatva,

I'm sorry but if you want to generate a Let's Encrypt certificate, both domains will need to point to the instance's IP. That's the way the tool we use has to verify that the domains point to the correct IP so it can generate the certificates properly.

Can you update your DNS provider and configure your www and non-www domains with the IP of your instance (A record)?

Thanks

medtatva 2019-10-31 13:04:57 UTC #14

let me explain my setup

Domain Name Registrar: Google
Google dns says Domain forward
medtatva.com, www.medtatva.com → http://34.93.235.143/medtatva/home/

DNS forward my domain -> the static IP I got from the deployment manager of GCP -> deployments -> clicked on . my deployments, there is a static IP indicated where my application is hosted.

The reason you see 4 IP address is because this is done by Google not me.

$nslookup medtatva.com
Server:     192.168.0.1
Address:    192.168.0.1#53

Non-authoritative answer:
Name:   medtatva.com
Address: 216.239.32.21
Name:   medtatva.com
Address: 216.239.34.21
Name:   medtatva.com
Address: 216.239.36.21
Name:   medtatva.com
Address: 216.239.38.21
$ nslookup www.medtatva.com
Server:     192.168.0.1
Address:    192.168.0.1#53

Non-authoritative answer:
www.medtatva.com    canonical name = ghs.googlehosted.com.
Name:   ghs.googlehosted.com
Address: 172.217.26.179


$ dig +short NS medtatva.com 
ns-cloud-b1.googledomains.com.
ns-cloud-b2.googledomains.com. 
ns-cloud-b3.googledomains.com.
ns-cloud-b4.googledomains.com.

$ dig +short NS www.medtatva.com
ghs.googlehosted.com.

So my question is this:
Should I move my DNS from Google domains to Google Cloud Platform and then set up a DNS managed zone and then modify my DNS on Google Cloud to point A record to new IP for medtatva.com and create a CNAME record for www to resolve to medtatva.com?

I fear the not moving of my DNS from Google to Google Cloud Platform is causing this.

medtatva 2019-10-31 13:08:26 UTC #15

DNS provider is Google Domains. I already did this once and Google dns says Domain forward
medtatva.com, www.medtatva.com → http://34.93.235.143/medtatva/home/

That is what resulted in those IP map you saw https://www.whatsmydns.net/#A/www.medtatva.com and
https://www.whatsmydns.net/#A/medtatva.com

See my last post also. I am wondering if I should just delete everything in google domain registrar, simply copy the nameservers that Google Cloud Platform suggests when I setup the same using Cloud DNS.

Google Cloud DNS zones let you define your namespace. You can create public zone. Is that what I should be doing?

medtatva 2019-10-31 15:15:23 UTC #16

I made the changes u suggested.

Now when I visit my IP address I see some errors:
Invalid HTTP_HOST header: '34.93.235.143'. You may need to add '34.93.235.143' to ALLOWED_HOSTS.

But this issues wasn't happening before.

medtatva 2019-10-31 15:26:08 UTC #17

DisallowedHost at /
Invalid HTTP_HOST header: '34.93.235.143'. You may need to add '34.93.235.143' to ALLOWED_HOSTS.

All I did was to run the sudo /opt/bitnami/bncert-tool
It seemed to have done everything right. It generated the certificates. But post that
I visited medtatva.com it didn't work.

Then I visited 34.93.235.143, the django applicaiton page showed up. I clicked on my application and then I Saw the invalid http_host header. But my application settings.py file seems fine.

What happened?

medtatva 2019-10-31 15:41:59 UTC #18

I see these errors now in my apache error.log

what did bncert do for my application was running properly. I see the ALLOWED HOSTS in settings.py and it seems right.

[Thu Oct 31 15:37:42.020078 2019] [wsgi:error] [pid 21472] [remote 117.201.11.248:58638] Invalid HTTP_HOST header: '34.93.235.143
'. You may need to add '34.93.235.143' to ALLOWED_HOSTS.
[Thu Oct 31 15:37:42.066641 2019] [wsgi:error] [pid 21472] [remote 117.201.11.248:58638] Bad Request: /Project/

medtatva 2019-11-01 13:41:27 UTC #19

I have found an answer to this. Documented my answer in this thread.

davidg 2019-11-01 15:11:54 UTC #20

Hi @medtatva,

Just to confirm it. Have this case resolved the issue you were facing?

Regards

medtatva 2019-11-01 16:06:25 UTC #21

Yes but I am very disappointed with the support I got from bitnami. I am currently using your stack on top of GCP and makes me wonder about support. The stack is not adding much value in my opinion and neither is there a good support.

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!