Broken wordpress after ssl renew

simpleFeynman 2019-12-03 03:15:43 UTC #1

Keywords: WordPress - AWS - Technical issue - Secure Connections (SSL/HTTPS)
bnsupport ID: 2f1680ce-ddad-bda2-e869-47edfa31285c
Description:
bnsupport ID: 2f1680ce-ddad-bda2-e869-47edfa31285c

Hello fellows, i was trying to renew the ssl certificate with the bncert-tool but it wasnt working, so i tried to delete with

rm -rf /opt/bitnami/letsencrypt

and with

sudo mv /opt/bitnami/apache2/conf/server.crt.old /opt/bitnami/apache2/conf/server.crt
sudo mv /opt/bitnami/apache2/conf/server.key.old /opt/bitnami/apache2/conf/server.key
sudo /opt/bitnami/ctlscript.sh restart

but it was not able to stop or restart services, so i tried to restart the server from aws, but after that, the wordpress is not responding anymore, "err connection refused".

can you guide me a little bit?
thanks in advance

tomasp 2019-12-03 09:41:10 UTC #2

Hi @simpleFeynman,

Thanks for sending the support code. I've checking the output and it seems only apache service is not working. However, I don't see a clear error in the log.

Can you stop the server, start it again and re-create the support bundle? Hopefully that will log the error in the apache error log and we can see it.

simpleFeynman 2019-12-04 04:54:26 UTC #3

hey Tomas, the ID from the new output of tool is "11f1f725-4acf-224c-136a-9ecf7e81bf83", just restart the instance from aws, then tried to run this command "sudo /opt/bitnami/ctlscript.sh status" and it says: apache is not running, then i tried: "sudo /opt/bitnami/ctlscript.sh restart apache" and i got this message:

bitnami@ip-:~$ sudo /opt/bitnami/ctlscript.sh restart apache         Unmonitored apache
AH00526: Syntax error on line 46 of /opt/bitnami/apache2/conf/bitnami/bitnami.conf:
SSLCertificateFile: file '/opt/bitnami/apache2/conf/bytestrader.io.crt' does not exist or is empty
apache config test fails, aborting
AH00526: Syntax error on line 46 of /opt/bitnami/apache2/conf/bitnami/bitnami.conf:
SSLCertificateFile: file '/opt/bitnami/apache2/conf/bytestrader.io.crt' does not exist or is empty
apache config test fails, aborting
Monitored apache

so, what would be the right approach to solve this problem?
thanks in advance,

tomasp 2019-12-04 09:32:18 UTC #4

I see, so the issue is clear, the file /opt/bitnami/apache2/conf/bytestrader.io.crt does not exist so Apache is unable to start.

Can you verify if the path and name are correct? In order to start Apache you will need to configure it with a proper certificate.

If you don't know where your certificate is, you can execute this command:

sudo find /opt/bitnami -name "*.crt"

The previous command should return a list with all the files with .crt extension inside the /opt/bitnami directory.

Once you identify the certificate, you should update the file /opt/bitnami/apache2/conf/bitnami/bitnami.conf and update the following properties:

  SSLCertificateFile "/opt/bitnami/apache2/conf/bytestrader.io.crt"
  SSLCertificateKeyFile "/opt/bitnami/apache2/conf/bytestrader.io.key"

simpleFeynman 2019-12-04 16:59:00 UTC #5

Hi again, with the first one I got that the cert is located on "/opt/bitnami/apache2/conf/bytestrader.io.crt"
also ran the same but with *.key and its in the same place too. the bitnami.conf is pointing to those locations. im using the git bash and when I "ls" the directory both files appear with red color. Any ideas on how to proceed? thanks in advance.

tomasp 2019-12-05 09:43:53 UTC #6

Hi @simpleFeynman,

Can you run ls -alrth /opt/bitnami/apache2/conf/, I think the red color means that they are symlinks but the original file does not exist anymore.

Can you open the file with a cat command for example? (Do not share the output if you can see the file content)

simpleFeynman 2019-12-05 14:09:50 UTC #7

when running "ls -alrth /opt/bitnami/apache2/conf/" got the files in red color, when trying to run cat "no such file or directory".
looks like they are gone, any ideas on how to proceed? how may i remove that cert and create a new one? or is there a way to restore the original bitnami.conf file?
thanks in advance.

simpleFeynman 2019-12-05 17:15:59 UTC #8

so i followed the alternative approach from this https://docs.bitnami.com/aws/how-to/generate-install-lets-encrypt-ssl/ and looks like the apache server is now able to find the new certificate. thanks for all the help tomasp and have a good one mate.

simpleFeynman 2019-12-05 19:49:17 UTC #9

Also, i was trying to renew the cert with the bncertool and i was using cloudfare, the tool was telling me that there was an error with the ip he was seeing becasue didnt match the original from the server (i guess because of the cloudfare dns), is that a problem with the tool? or is there a way to solve this problem? thanks in advance.

jsalmeron 2019-12-06 09:30:05 UTC #10

Hi,

I'm not 100% sure if the case of Cloudflare DNS is taken into account by the tool. It would be interesting checking it out. Could you share the exact error the tool returned?

Best regards,

Javier J. Salmerón

Was my answer helpful? Click on

simpleFeynman 2019-12-06 19:41:42 UTC #11

The error was: The ip from the server doesnt match the original ip x.x.x.x. you should try to remove or edit them in your DNS.

michiel 2019-12-09 11:27:45 UTC #12

Hi @simpleFeynman,

Thank you for sharing. We will take it into consideration for further improvements to the bncert tool.

Regards,
Michiel

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!