SSL Error The domain 'DOMAIN_NAME.com' resolves to a different IP address than the one detected for this machine

travelingsession 2020-09-24 06:34:09 UTC #1

Keywords: WordPress - AWS - Technical issue - Secure Connections (SSL/HTTPS)
bnsupport ID: e6a416b3-5550-5dfb-57ec-7a2a9b06eb78
Description:
I just migrated my WordPress site from one Lightsail instance to another. I used All-in-One WP Migration and everything seemed to work fine. When I switched the elastic IP to the new instance, the site is unreachable using the https. If I switch the IP back to the old instance it comes right back up.

My site is integrated into Ezoic so it goes through Cloudflare.

I ran the Bitnami HTTPS Configuration Tool with and without the www domain and get the message below.
Warning: The domain 'travelingsession.com' resolves to a different IP address
than the one detected for this machine, which is '54.209.161.113'. Please fix
its DNS entries or remove it. For more info see:
https://docs.bitnami.com/general/faq/configuration/configure-custom-domain/

I followed the steps here, but no luck (Redirect All Domains To Your Own Domain and Redirect All Domains To Your Own Domain And Force HTTPS.
https://docs.bitnami.com/installer/apps/wordpress/administration/use-single-domain/

Is there a way to fix this? I saw this mentioned in the forums several times, but I never saw a fix. I ran the support app and the code is below.

e6a416b3-5550-5dfb-57ec-7a2a9b06eb78

OpenSSL Error messages:\nerror:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

Ibone 2020-09-24 11:55:55 UTC #2

Hi @travelingsession,

Thanks for using Bitnami. Could you follow this guide https://docs.bitnami.com/aws/apps/wordpress/administration/configure-domain/?

I hope that helps you,
Ibone.

travelingsession 2020-09-24 13:04:09 UTC #3

I tried the above guide and there was no change.

jota 2020-09-25 11:05:29 UTC #4

Hi @travelingsession,

I found this error in the Apache's log

[Thu Sep 24 04:43:21.347224 2020] [proxy_fcgi:error] [pid 1356:tid 140393857234688] [client 74.82.47.2:36282] AH01071: Got error 'PHP message: PHP Warning:  getimagesize(): SSL operation failed with code 1. OpenSSL Error messages:\nerror:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed in /opt/bitnami/apps/wordpress/htdocs/wp-content/plugins/td-cloud-library/shortcodes/header/tdb_header_logo.php on line 792PHP message: PHP Warning:  getimagesize(): Failed to enable crypto in /opt/bitnami/apps/wordpress/htdocs/wp-content/plugins/td-cloud-library/shortcodes/header/tdb_header_logo.php on line 792PHP message: PHP Warning:  getimagesize(https://54.209.161.113/wp-content/uploads/2020/05/Watermark_Trans_White_text_side_below_TTT_mobile.png): failed to open stream: operation failed in /opt/bitnami/apps/wordpress/htdocs/wp-content/plugins/td-cloud-library/shortcodes/header/tdb_header_logo.php on line 792

It seems the application is using the IP and it can validate the SSL certificate. However, as you can see, the plugin "td-cloud-library" is the one throwing the error, can you disable that plugin using the CLI tool?

https://docs.bitnami.com/aws/apps/wordpress/administration/use-wpcli/

As you are using Cloudflare, you are not pointing the domain to the instance directly.

https://www.whatsmydns.net/#A/travelingsession.com

It's cloudflare what is caching the requests so you need to configure the SSL certificate there.

OpenSSL Error messages:\nerror:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed

travelingsession 2020-09-25 16:45:42 UTC #5

I spun up a new instance from a snapshot of right after I built the instance and before I migrated the site. I still got the same error, which pretty much eliminates the server.
Cloudflare, at least from my understanding of how the Ezoic implementation goes, pulls your key from the server and takes over management of it. However, since the key is not on the server to make that communication, https traffic can't pass. I went to my domain provider and set it back to the default dns settings to eliminate the redirect to Cloudflare, but the settings remain until it's completely propogated.

travelingsession 2020-09-28 04:55:59 UTC #6

So, I figured out what happened. My domain is integrated into the Ezoic network, which uses a CDN. When you integrate into their system, the CDN pulls a copy of your certificates and takes over management of them. Part of that is pointing the key to the CDN and not my server. This works perfectly as long as the key is still on the server. But, when I migrated to my new server, the key isn't there. And because the key is now pointing to a different IP than that of the host, it won't let me reissue it through Lets Encrypt. And because the domain is in use, I can't request a new key. And because that's the key that is loaded on the CDN, I can't revoke it. So, copying the files over seemed to be the only option.
I'll try to put something together later, but basically, this was the process. I packaged the certs and key into a .pfx file on the old server. Downloaded it and uploaded it to the new server, and installed them manually.
I'm still getting an SSL error, but at least it's up.

travelingsession 2020-10-10 16:38:27 UTC #7

I saw this issue posted a couple of times before, without the fix being explained. I wanted to put something together a bit more comprehensive, but I didn't have the chance. These links should be able to get anyone in this situation back up.
https://www.liquidweb.com/kb/transfer-an-ssl-to-ubuntu-16-04-or-centos-7/
https://www.ssl.com/how-to/create-a-pfx-p12-certificate-file-using-openssl/
https://www.ssl.com/how-to/export-certificates-private-key-from-pkcs12-file-with-openssl/
https://lightsail.aws.amazon.com/ls/docs/en_us/articles/amazon-lightsail-using-lets-encrypt-certificates-with-wordpress
https://webkul.com/blog/ssl-certificate-installation-on-bitnami-server/#:~:text=SSL%20Certificates%20Activation%20Process.,%2Fconf%2Fbitnami%2Fbitnami.

jota 2020-10-13 08:48:32 UTC #8

Hi @travelingsession,

Thank you for the links but I want to clarify that we have our own guide to configure the Let's Encrypt certificates and you and whoever takes a look at this thread should follow it.

Bitnami HTTPS configuration tool: https://docs.bitnami.com/aws/how-to/understand-bncert/
Manual approach: https://docs.bitnami.com/aws/how-to/generate-install-lets-encrypt-ssl/#alternative-approach

We suggest you follow any of those guides instead of following the Lightsail guide (we do not maintain that guide)

travelingsession 2020-10-13 09:22:17 UTC #9

Just to clarify, these links are for instances after a migration where neither the Bitnami HTTPS configuration tool nor the Manual approach, and you must download the certificates from the original server. I did not see any guides for identifying and packaging certificates on the origin server or manually installing the certificates uploaded to a server.

jota 2020-10-14 09:07:46 UTC #10

Hi @travelingsession,

If you already have valid certificates, you can simply copy them from one instance to the user using the SFTP protocol.

https://docs.bitnami.com/aws/faq/administration/upload-files/

You can download the certificates from one instance to your computer and then upload them from your computer to the new instance. This other guide explains where the certificates need to be places and what commands to run

https://docs.bitnami.com/aws/apps/wordpress/administration/enable-https-ssl-apache/

system 2020-10-28 09:08:01 UTC #11

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!