Lego add more domains for SSL

anthony2 2018-09-26 05:51:17 UTC #1

Hi,
I'm running a multisite wordpress install using LAMP stack.
I've already issued SSL certs using LEGO for multiple domains as per this link: https://docs.bitnami.com/bch/how-to/generate-install-lets-encrypt-ssl/ and all was working.

However, I have more domains I need to add the SSLs to. I just ran this:

sudo lego --email="webmaster@domain.com" --domains="domain.com" --domains="domain.com.au" --domains="domain1.com" --domains="domain1.com.au" --domains="test.domain.com.au" --domains="test2.domain.com.au" --domains="domain2.com" --domains="domain3.com.au" --path="/etc/lego" run

Now none of my sites are running SSL.

Did I do it right? What should I have done?

Please help.

anthony2 2018-09-26 08:23:50 UTC #2

Ok... well, I ended up getting to work by deleting the old certificates and running through the process again. Bit of a headache but got there

anthony2 2018-09-26 08:50:36 UTC #3

One last thing. How do I restore the permissions on the certificates folder?

michiel 2018-09-26 10:15:41 UTC #4

Hi @anthony2,

I'm glad to hear you've solved it.

Best regards,

Michiel D'Hont

Please, click on if you think my answer was helpful

anthony2 2018-09-27 11:19:03 UTC #5

Thanks Michiel.
How do I restore the default permission for the certificates folder?

michiel 2018-09-28 09:50:46 UTC #6

Hi @anthony2,

Can you run the We have a Support Tool? It gathers information about your current permissions.

How to Run the Bitnami Support Tool

Please note that you need to paste the code outputted by the tool in your reply.

anthony2 2018-09-28 23:56:13 UTC #7

Hi @michiel

Here's the ticket. b86722b1-3cc3-27a6-cd23-9756e2fd4fe8

Thanks

michiel 2018-10-01 12:02:06 UTC #8

Hi @,

Can you try the following:

cd /opt/bitnami/apache2/conf/
sudo chown root:root server.*

And then restart apache?

/opt/bitnami/ctlscript/sh restart

Best regards,

Michiel D'Hont

Please, click on if you think my answer was helpful

anthony2 2018-10-03 07:06:53 UTC #9

Hi,

I'm getting this error:
$/opt/bitnami/apache2/conf$ sudo chown bitnami root:root server.*
chown: cannot access 'root:root': No such file or directory
chown: cannot dereference 'server.crt.old': No such file or directory
chown: cannot dereference 'server.crt.old1': No such file or directory
chown: cannot dereference 'server.key.old': No such file or directory
chown: cannot dereference 'server.key.old1': No such file or directory

Also, now when trying to restart, all I get is this:
$sudo /opt/bitnami/ctlscript.sh restart apache
Unmonitored apache
Monitored apache

I have to run:
sudo /opt/bitnami/ctlscript.sh stop

and then
sudo /opt/bitnami/ctlscript.sh start

I didn't have to do that before.

Please help

michiel 2018-10-03 10:54:36 UTC #10

Hi @anthony2,

Sorry, the command I gave you was wrong, it should be:

 cd /opt/bitnami/apache2/conf/
 sudo chown root:root server.*

I've changed it in the original message to avoid confusion for other users.

Best regards,

Michiel D'Hont

Please, click on if you think my answer was helpful

anthony2 2018-10-03 12:09:04 UTC #11

Hi @michiel ,

I'm still getting this:
$ sudo chown root:root server.*
chown: cannot dereference 'server.crt.old': No such file or directory
chown: cannot dereference 'server.crt.old1': No such file or directory
chown: cannot dereference 'server.key.old': No such file or directory
chown: cannot dereference 'server.key.old1': No such file or directory

and the folder is still accessible.

and I get this when running the restart command:
$ /opt/bitnami/ctlscript/sh restart
-bash: /opt/bitnami/ctlscript/sh: No such file or directory

and when running the restart command that was working before, I get this:
$sudo /opt/bitnami/ctlscript.sh restart apache
Unmonitored apache
Monitored apache

Please help

michiel 2018-10-04 11:13:44 UTC #12

Hi @anthony2,

A colleague will contact you soon to help you with this issue.

Best regards,

Michiel D'Hont

Please, click on if you think my answer was helpful

marcos 2018-10-05 13:14:43 UTC #13

Hi @anthony2,

You are running the ctlscript command wrong, you must do the following:

sudo /opt/bitnami/ctlscript.sh restart

You can see that Apache is running with the following command:

ps aux | grep httpd

Regarding the error "chown: cannot dereference...", it means some certificate links are broken. We recommend you to list the files with the command below and see if there is any issue:

ls -lh /opt/bitnami/apache2/conf/

If you see the symlinks being broken (red color and gray background), you can probably remove the affected files (server.crt.old, server.crt.old1, etc.), for instance to remove one of them:

sudo rm /opt/bitnami/apache2/conf/server.crt.old

Let us know if you are experiencing any other issue.

anthony2 2018-10-08 01:11:57 UTC #14

Hi @marcos,

Thanks. I removed most of the old server files but not sure if I should remove this one:

lrwxrwxrwx 1 daemon daemon 33 Aug 2 15:55 serv -> /etc/lego/certificates/DOMAIN.key

Also, how do I set default permissions for the wordpress install?

Thanks

marcos 2018-10-08 10:57:56 UTC #15

Hi @anthony2,

If the file "serv" is used by your Apache server, you should not remove it. However, note that it is a symbolic link and therefore /etc/lego/certificates/DOMAIN.key needs to exist, if not you will get the error you saw before.

Also, how do I set default permissions for the wordpress install?

Sorry, I do not understand what you mean about that. Note that Bitnami already customizes WordPress to be secured by default, and use proper permissions at "/opt/bitnami/apps/wordpress".

anthony2 2018-10-08 12:28:21 UTC #16

Hi @marcos,

Does that mean I should create it?

What I mean by default permissions is that I've changed the permissions for different folders so I was just hoping to reset it back to what it should be.

marcos 2018-10-09 11:42:03 UTC #17

Hi @anthony2,

Does that mean I should create it?

No, you should not create it unless it was created with Step 3 here.

If you messed up, just try again and let us know if you get it working.

What I mean by default permissions is that I've changed the permissions for different folders so I was just hoping to reset it back to what it should be.

What folders did you change permissions to? This way we can indicate what commands to run, to revert those changes. Are we right to assume the WordPress application is not working right now?

Also, is there any reason why you changed permissions for the application files? Just trying to understand if there is anything we need to change in our docs, in case it is confusing for users, as you should only have to modify ownership and permissions for the certificate files (/opt/bitnami/apache2/conf/server*), but not other files/directories for Apache or the application.

anthony2 2018-10-09 12:18:02 UTC #18

Hi @marcos,

My Wordpress is working fine.

Honestly, I can't remember which folders I've made changes to exactly as in each instance, I was trying to fix another thing that got broken.
e.g. My custom uploads folder became unwritable.
I had to upload themes and plugins
I had to edit htaccess

Just concerned that my security might not be as it should be. Is this all correct?

drwxrwxr-x 8 bitnami daemon 4.0K Oct 8 12:34 assets
-rw-rw-r-- 1 bitnami daemon 418 Jul 30 17:38 index.php
-rw-rw-r-- 1 bitnami daemon 20K Aug 6 15:21 license.txt
drwxrwxr-x 3 bitnami daemon 4.0K Jul 30 17:37 originalfiles
-rw-rw-r-- 1 bitnami daemon 7.3K Aug 6 15:21 readme.html
-rw-rw-r-- 1 bitnami daemon 5.4K Jul 30 17:38 wp-activate.php
drwxrwxr-x 9 bitnami daemon 4.0K Jul 30 17:39 wp-admin
-rw-rw-r-- 1 bitnami daemon 364 Jul 30 17:38 wp-blog-header.php
-rw-rw-r-- 1 bitnami daemon 1.9K Jul 30 17:38 wp-comments-post.php
-rw-rw-r-- 1 bitnami daemon 4.3K Oct 8 14:45 wp-config.php
-rw-rw-r-- 1 bitnami daemon 2.8K Jul 30 17:38 wp-config-sample.php
drwxrwxr-x 11 bitnami daemon 4.0K Oct 4 17:11 wp-content
-rw-rw-r-- 1 bitnami daemon 3.6K Jul 30 17:38 wp-cron.php
drwxrwxr-x 18 bitnami daemon 12K Jul 30 17:54 wp-includes
-rw-rw-r-- 1 bitnami daemon 2.4K Jul 30 17:38 wp-links-opml.php
-rw-rw-r-- 1 bitnami daemon 3.3K Jul 30 17:38 wp-load.php
-rw-rw-r-- 1 bitnami daemon 37K Aug 6 15:21 wp-login.php
-rw-rw-r-- 1 bitnami daemon 7.9K Jul 30 17:38 wp-mail.php
-rw-rw-r-- 1 bitnami daemon 16K Jul 30 17:38 wp-settings.php
-rw-rw-r-- 1 bitnami daemon 30K Jul 30 17:38 wp-signup.php
-rw-rw-r-- 1 bitnami daemon 4.6K Jul 30 17:38 wp-trackback.php
-rw-rw-r-- 1 bitnami daemon 3.0K Jul 30 17:38 xmlrpc.php

anthony2 2018-10-09 12:18:45 UTC #19

and this:
drwxrwxr-x 2 daemon daemon 4.0K Jul 11 12:52 bin
-rw-r--r-- 1 daemon daemon 8.5M Jul 8 04:52 bnconfig
drwxrwxr-x 2 daemon daemon 4.0K Jul 11 12:52 build
drwxrwxr-x 2 daemon daemon 4.0K Jul 11 12:57 cgi-bin
drwxrwxr-x 5 daemon daemon 4.0K Oct 8 12:08 conf
drwxrwxr-x 3 daemon daemon 4.0K Jul 11 12:52 error
drwxrwxr-x 7 bitnami daemon 4.0K Oct 9 22:26 htdocs
drwxrwxr-x 3 daemon daemon 4.0K Jul 11 12:52 icons
drwxrwxr-x 2 daemon daemon 4.0K Jul 11 12:52 include
drwxrwxr-x 3 daemon daemon 4.0K Oct 1 16:25 logs
drwxrwxr-x 2 daemon daemon 4.0K Jul 11 12:52 modules
drwxrwxr-x 2 daemon daemon 4.0K Jul 11 12:52 scripts
drwxrwxr-x 2 daemon daemon 4.0K Oct 4 14:56 temp
drwxrwxr-x 3 daemon daemon 4.0K Jul 11 12:52 var

marcos 2018-10-09 12:41:43 UTC #20

Hi @anthony2, your configuration seems correct and secure. The only strange thing is the Apache directory with 775 permissions for directories, but since all are owned by daemon:daemon that should not be an issue.

e.g. My custom uploads folder became unwritable.
I had to upload themes and plugins
I had to edit htaccess

Does that mean you cannot upload plugins and themes anymore, via wp-admin? Did you fix this issue?

If so, it seems like everything is correct. Let us know if we missed anything.

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!