Question: About Let's Encrypt using BNcert Tool - Firewall Ports

anas.hamra 2020-05-10 05:44:14 UTC #1

Keywords: Apache Guacamole - Virtual Machines - Technical issue - Secure Connections (SSL/HTTPS)
Description:
Thanks to this post

I was able to fix the issue by opening the ports 443 and 80 for both TCP and UDP

I have a question, do we need to keep the port opened and reserved for cert renewal? I need to use the ports for another server.

Please advise.

michiel 2020-05-11 06:53:36 UTC #2

Hi @anas.hamra,

Yes, the cert renewal requires both ports to be open.

Regards,
Michiel

anas.hamra 2020-05-11 08:10:54 UTC #3

Thanks for the confirmation. @michiel

It makes sense.

Is there a way to import existing cert files or PFX cert file instead of generating new one?

That would fix my issue instead of leaving the ports open.

Thanks.

jota 2020-05-11 08:54:43 UTC #4

Hi @anas.hamra,

If you want to use other certificate files, you can copy them to the instance and configure Apache to use them. You can find all the configuration inside the /opt/bitnami/apache/conf directory.

Happy to help!

Was my answer helpful? Click on

anas.hamra 2020-05-11 09:09:58 UTC #5

Hi @jota

Thanks for the quick response.

I found this video helpful to use the bncert tool by @michiel.

Is there another video/guide to recommend for the steps I need to take for manual cert import to changing domain name?

Thanks

jota 2020-05-12 08:00:53 UTC #6

Hi @anas.hamra,

If you already have valid certificates for your domain, you can replace the certificates inside the /opt/bitnami/apache/conf/bitnami/certs/ folder and specify them in the Guacamole HTTPS configuration file (/opt/bitnami/apache/conf/vhosts/guacamole-https-vhost.conf).

You will also need to configure the permissions and restart Apache

sudo chown root:root /opt/bitnami/apache2/conf/bitnami/certs/*.crt
sudo chmod 600 /opt/bitnami/apache2/conf/bitnami/certs/*.key
sudo /opt/bitnami/ctlscript.sh restart

Happy to help!

Was my answer helpful? Click on

anas.hamra 2020-05-23 08:30:51 UTC #7

Hi @jota

I found a really much easier way, where I did setup Nginx Proxy Server sitting in front of all my web servers and and it's like a charm now with both my own certs and generating new ones from Let's encrypt.

Thanks for the help.
Anas

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!