Ran “generate-certificate.sh” (for Let’s Encrypt) then my “vhosts” entries were overridden (GCP, GCE VM, PHP)

tinman 2019-08-15 05:46:53 UTC #1

Keywords: LAMP/MAMP/WAMP - Google Cloud Platform - Technical issue - Other
bnsupport ID: d003002d-4626-6b51-11f4-dd328ae8092b
Description:
Hi,

My apologies. This is related to an unresolved but closed post that I authored (https://community.bitnami.com/t/ran-generate-certificate-sh-for-lets-encrypt-then-my-vhosts-entries-were-overridden-gcp-gce-vm-php)

I have been off work due to health issues, but now return and would like to resolve it.

The issue is exactly as stated in the post. I have just run the Bitnami Support tool as last advised by @Jota

The code generated is: d003002d-4626-6b51-11f4-dd328ae8092b

amoreno 2019-08-15 14:04:03 UTC #2

I can see these lines at the end of your /opt/bitnami/apache2/conf/httpd.conf file:

# Include "/opt/bitnami/apache2/conf/bitnami/bitnami.conf"

Include "/opt/bitnami/apache2/conf/bitnami/httpd.conf"

It looks like you have commented out the /opt/bitnami/apache2/conf/bitnami/bitnami.conf created by us and that you are using a custom file /opt/bitnami/apache2/conf/bitnami/httpd.conf created by you. Can you try uncommenting the bitnami.conf file, commenting the httpd.conf file, and restarting Apache?

Regards,
Alejandro

tinman 2019-08-21 05:19:13 UTC #3

Hi Alejandro,

Thank-you for responding.

I have done so but it still hasn't resolved the original issue that my vhosts entries are being overridden.

Instead the default document root "/opt/bitnami/apache2/htdocs" is being used.

I had followed https://docs.bitnami.com/aws/infrastructure/lamp/administration/create-custom-application-php/

jota 2019-08-21 11:53:30 UTC #4

I just checked your configuration and the new vhosts files you include look fine. Did you get any error message when restarting the Apache service?

sudo /opt/bitnami/ctlscript.sh restart apache

Thanks

tinman 2019-08-21 14:46:47 UTC #5

The problem is that it is not respecting the vhosts configs.

When I browse, Instead of directing it to the configured subdomains, it directs to the default document root "/opt/bitnami/apache2/htdocs"

Before I used "generate-certificate.sh", my subdomain worked and were directed to the appropriate application directories

After I ran "generate-certificate.sh" all requests are being directed to the root directory

For example, before running "generate-certificate.sh" I could go to

api.mydomain.com and
blogs.mydomain.com

I configured these subdomains/vhosts based on https://docs.bitnami.com/virtual-machine/infrastructure/lamp/configuration/configure-custom-application/

I configured the applications based on https://docs.bitnami.com/aws/infrastructure/lamp/administration/create-custom-application-php/

It would direct to the correct, configured vhost folder/application.

But after running "generate-certificate.sh", I am now being directed to the same, default root directory, regardless of whether I go to api.mydomain.com or blogs.mydomain.com

jota 2019-08-22 09:21:42 UTC #6

I reviewed your conf files again and noticed one more thing. In the apps/api/conf/httpd-vhosts.conf and apps/admin/conf/httpd-vhosts.conf files, you only defined the virtual host for the port 443. That means that you will only access those sites when using https and not when using http. So for example, if you go to http://api.****go.co.za, you obtain the information inside the apache2/htdocs folder (because it uses the default virtual host for the port 80) but if you go to https://api.****go.co.za, you access your site. The same happens with the other subdomain.

You probably removed the VirtualHost for the port 80 before running the generate-certificate.sh script but the changes were applied when you ran in because it restarts the Apache server. You can recreate them by adding a similar block to this one in both httpd-vhosts.conf files

<VirtualHost *:80>
    ServerName YOUR_DOMAIN

    DocumentRoot "/opt/bitnami/apps/YOUR_APP/htdocs"

    Include "/opt/bitnami/apps/YOUR_APP/conf/httpd-app.conf"
</VirtualHost>

Remember to restart Apache after that

sudo /opt/bitnami/ctlscript.sh restart apache

tinman 2019-08-22 15:01:31 UTC #7

Sounds like you're closer to the answer. I appreciate your time and effort.

I will test it in the next few hours and give feedback

tinman 2019-08-23 06:18:03 UTC #8

That was the issue! Thank-you for the support! I can now browse both sub-domains and they point to the relevant vhost files. I went on further to fors HTTPS redirection by following the instructions here: https://docs.bitnami.com/google/infrastructure/django/administration/force-https-apache/

I have one final related issue:

I noticed that "generate-certificate.sh" is an old tool that has since been replaced with "/opt/bitnami/bncert-tool": https://docs.bitnami.com/google/how-to/generate-install-lets-encrypt-ssl/ I managed to download it because my stack does not include it (https://docs.bitnami.com/google/how-to/understand-bncert/)

After downloading, I ran it but encountered the following error when it tried to create an auto-renewal cron job:

/
Error: Error running crontab -u bitnami /tmp/cron20190823060328: new crontab
file is missing newline before EOF, can't install.
Press [Enter] to continue:
/Warning: Certificates may not renew automatically, due to a web server
configuration issue. For more information see:
https://docs.bitnami.com/general/how-to/understand-bncert/#certificates-not-renew
ed-automatically
Press [Enter] to continue:

I went through the troubleshooting steps in the link above, but none of them mention the error: "new crontab
file is missing newline before EOF, can't install."

gongomgra 2019-08-23 10:48:04 UTC #9

You will need to edit the crontab file for the bitnami user by using the command below and include an entire new blank line at the end of the file

sudo crontab -e -u bitnami

After that, please run the bncert tool again.

Hope it helps,
Gonzalo

tinman 2019-08-26 19:20:20 UTC #10

Thank-you for your response but it is still not working.

I am getting the following an even less descriptive error than the first error:

Some errors occurred

The configuration was applied, but some of the changes could not be applied.
Find the details below.

The configuration report is shown below.

Failed steps:
* Creating Let's Encrypt certificate: Automatic renewal not working

Backup files:
* /opt/bitnami/apache2/conf/httpd.conf.back.201908261906
* /opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf.back.201908261906
* /opt/bitnami/apache2/conf/bitnami/bitnami.conf.back.201908261906

Find more details in the log file:

/tmp/bncert-201908261906.log

If you find any issues, please check Bitnami Support forums at:

https://community.bitnami.com

Press [Enter] to continue:

tinman 2019-08-26 19:29:06 UTC #11

Also, why do I have to re-run it if the SSL certificate was initially successfully installed.

The current problem being a cron issue?

gongomgra 2019-08-27 09:46:03 UTC #12

Can you check the content of the bncert tool log file mentioned in the error message you got?

/tmp/bncert-201908261906.log

Apart from that, we have a Support Tool that will gather relevant information for us to analyze your configuration and logs. Could you please download and execute it on the machine where the stack is running by following the steps described in the guide below?

How to Run the Bitnami Support Tool

Please note that you need to paste the code outputted by the tool in your reply.

Regards,
Gonzalo

tinman 2019-08-27 19:44:44 UTC #13

I ran the tool.

The following is the code that was output:

01e7c269-da09-4282-6927-ddc250fd11ac

Regards,
T

gongomgra 2019-08-28 10:19:34 UTC #14

Thanks for sending the bnsupport code. Did you have a chance to check the bncert log? Apart from that, I see you have the correct line in the cronjob. The issue regarding the message below is that using custom virtualhosts require to add an extra configuration to the vhost configuration for the renewal to work properly.

Failed steps:
* Creating Let's Encrypt certificate: Automatic renewal not working

You can find more information about this issue and how to fix it in our guide linked below

https://docs.bitnami.com/aws/how-to/understand-bncert/#certificates-not-renewed-automatically

Hope it helps,
Gonzalo

tinman 2019-09-01 19:32:27 UTC #15

Hi,

I tried your suggestion and I am still getting errors.

I then searched through the forum and followed the example here: https://community.bitnami.com/t/when-will-bitnami-https-configuration-tool-renew-ssl/70230/15

Performing changes to your installation
The Bitnami HTTPS Configuration Tool will perform any necessary actions to your
Bitnami installation. This may take some time, please be patient.
|Warning: Certificates may not renew automatically, due to a web server
configuration issue. For more information see:
https://docs.bitnami.com/general/how-to/understand-bncert/#certificates-not-renew
ed-automatically
Press [Enter] to continue:

Some errors occurred
The configuration was applied, but some of the changes could not be applied.
Find the details below.
The configuration report is shown below.
Failed steps:
* Creating Let's Encrypt certificate: Automatic renewal not working
Backup files:
* /opt/bitnami/apache2/conf/httpd.conf.back.201909011909
* /opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf.back.201909011909
* /opt/bitnami/apache2/conf/bitnami/bitnami.conf.back.201909011909
Find more details in the log file:
/tmp/bncert-201909011909.log
If you find any issues, please check Bitnami Support forums at:
https://community.bitnami.com
Press [Enter] to continue:

I opened the log file and it says:

[19:12:17] Domain ****go.co.za did not pass HTTP challenge validation

I ran the support tool, and the code is:

3be4aacd-7b2d-b743-bd14-ecc5a0816d3d

gongomgra 2019-09-02 09:33:25 UTC #16

You are missing the configuration below on your /opt/bitnami/apps/[APP_NAME]/httpd-app.conf file as mentioned in our documentation linked above. Please note you will need to add this configuration snippet to the httpd-app.conf config file of every application.

Alias /.well-known/ "/opt/bitnami/apps/letsencrypt/.well-known/"
<Directory "/opt/bitnami/apps/letsencrypt/.well-known">
    Options +MultiViews
    AllowOverride None
    Require all granted
</Directory>

Also note that you are configuring your custom apps as prefix and virtualhosts. If you want to use virtualhosts, please comment out the related lines in the /opt/bitnami/apache2/conf/bitnami-apps-prefix.conf file.

At the end, restart Apache for changes to take effect

sudo /opt/bitnami/ctlscript.sh restart apache

Hope it helps,
Gonzalo

tinman 2019-09-05 06:25:53 UTC #17

Hi Gonzalo,

Thank-you for your support and patience, but you last suggestion also does not work.

List item
I commented out the related lines in /opt/bitnami/apache2/conf/bitnami-apps-prefix.conf as you advised
I then added the snippet you mentioned to /opt/bitnami/apps/[APP_NAME]/httpd-app.conf at the end of the file (you did not say where to place it)
You also did not say if I should remove what was suggested here too: https://community.bitnami.com/t/when-will-bitnami-https-configuration-tool-renew-ssl/70230/15
I restarted Apache

I now get an error on restarting Apache:

[Wed Sep 04 19:46:43.870611 2019] [alias:warn] [pid 15714:tid 139849633781504] AH00671: The Alias directive in /opt
/bitnami/apps/[APP_NAME]/conf/httpd-app.conf at line 17 will probably never match because it overlaps an earlier Alias.
[Wed Sep 04 19:46:43.871062 2019] [alias:warn] [pid 15714:tid 139849633781504] AH00671: The Alias directive in /opt
/bitnami/apps/[APP_NAME]/conf/httpd-app.conf at line 17 will probably never match because it overlaps an earlier Alias.
Syntax OK

I ran the support tool: d335a41a-d472-7ff8-47e4-6fcfca80eb6e

gongomgra 2019-09-05 10:08:19 UTC #18

You can add it in any place of the httpd-app.conf file, but as mentioned in our guide you should add the configuration either into the VirtualHost or into the http-app.conf file. As you already added them into the VirtualHost, you don't need to add them in the other files. Sorry for that. Please remove the related configuration from all the http-app.conf files.

After that, please ensure that you are adding the config below into the right place

Custom redirections are enabled. In such case you need to disable the redirection when accessing /.well-known by adding the following rule, right before the line performing the redirection:

RewriteCond %{REQUEST_URI} !^/\.well-known

Restart Apache and try again to run the bncert tool. Please run the bnsupport tool again if you find issues.

Hope it helps,
Gonzalo

tinman 2019-09-06 03:55:10 UTC #19

I have reversed your previous suggestions as advised.

I restarted and that error does not show.

For your latest solution, you do not tell me where the right place is. Where do I put this in my configs?

It has remained unchanged and exists in my apps/[APP_NAME]/conf/httpd-vhosts.conf configs

gongomgra 2019-09-06 10:09:50 UTC #20

As mentioned in my previous message, you need to add the .well-known rewrite condition "right before the line performing the redirection". To do that, please rewrite the redirects lines from

    RewriteCond %{REQUEST_URI} !^/\.well-known
    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP_HOST} !^(localhost|127.0.0.1)
    RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R,L]

to

    RewriteCond %{HTTPS} !=on
    RewriteCond %{HTTP_HOST} !^(localhost|127.0.0.1)
    RewriteCond %{REQUEST_URI} !^/\.well-known
    RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R,L]

in all the files in which you added them. After that, restart Apache and run the bncert tool again.

sudo /opt/bitnami/ctlscript.sh restart apache

Hope it helps,
Gonzalo

Powered by Discourse, best viewed with JavaScript enabled

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!

SugarCRM

Drupal

WordPress

Joomla!

Redmine