Standalone Server Roundcube

ted1 2020-05-18 01:44:44 UTC #21

Port 443 is now open. I ran a open port check. The same problem persists, however.
There is no firewall turned on. Is this where the Bitnami code needs to be entered into terminal ??
Is this where the Bitnami App is conjoined with the server in order to provide services
such as websites and email ??
I watched the video with Michiel D'Hon't. He talks about port 443 after the SSL certificate is installed.
I'm not sure but the version of UNIX in terminal has changed to ZSH. I don't know how this can affect my
use of the terminal. Last time I tried to restart apache it wouldn't even let me do that.
Does the Bitnami App use Apache ?? It appears to use Apache but don't know if it uses it's own version.
I appear to be stuck without the secure web address https.

jota 2020-05-18 07:01:45 UTC #22

Hi @ted1,

Please undo this change. The Bitnami configuration already configures the http and https connections. The port 443 is configured in the /opt/bitnami/apache2/conf/bitnami/bitnami.conf file

Can you share what error message do you get when restarting the Apache service?

sudo /opt/bitnami/ctlscript.sh restart

Yes, RoundCube has Apache and the version of the web server doesn't affect its configuration.

We have a Support Tool that will gather relevant information for us to analyze your configuration and logs. Could you please execute it on the machine where the stack is running by following the steps described in the guide below? You will need to access the Bitnami OS X VM console and run this program:

How to Run the Bitnami Support Tool in a cloud image or virtual machine

Please note that you need to paste the code ID that is shown at the end.

ted1 2020-05-19 00:27:44 UTC #23

Are we using the Bitnami terminal ?? This is accessible right from the Bitnami App !! Sorry.
I guess I was incorrect trying to use the system terminal that comes with Macosx Catalina(ZSH).
I deleted that line of code(listen:443) from the apache httpd.conf file and pressed save.

This is the support code used to access the information uploaded to you about my server.
afd87901-3132-1e99-d259-7807b902fe80
I think we need to use it.
You will see where I tried to apply the code in the first document you sent
(Enable HTTPS Support with Apache). This was unsuccessful.
I'm used to installing the certificate and key without the terminal where the Macosx
Server App can use it(drag and drop).

Below is what the cert and key from Digicert look like:

Thx, Ted

jota 2020-05-19 06:51:46 UTC #24

Hi @ted1,

You can use the drag & drop method with the Bitnami VM, but you will need to mount the directory and access it using Finder.

In the screenshot you shared, you have the crt file, but what .key file did you use to generate the file that you sent to the CA? I mean, when you request a certificate, you first need to send a file with the information of your domain. If you replace the server.crt file with the eagle3000_tedmachine_info.crt file and the server.key with the .key file you used, you will be able to restart Apache and have a secure site after that.

ted1 2020-05-20 00:57:55 UTC #25

After checking ports again I seem to notice that port 443 is no longer available.
Don't know what is causing this. This will be important going forward.
If you look at the screen shot the machine cert and the CA cert were dropped into apache2/conf folder.

But, how can the cert be of any use if the CSR was generated by the Macosx Server App ??
If I reissue the certificate it will void the previous certificate(maybe).
The first document link you sent me identifies these locations.
The server.crt file may be causing a conflict with any .crt file added by me.
Folder permissions don't seem to permit me to delete or swap files.
The intermediate(CA) cert must be the key cert. This is what goes into the "keychain" in Macosx.
I also ran the code in the document but not clear on its exact purpose.

Thx, Ted

jota 2020-05-20 09:05:14 UTC #26

Hi @ted1,

You didn't replace the server.crt and server.key files. In your case, as you used different file names, you will need to edit the Apache's conf file at /opt/bitnami/apache2/conf/bitnami/bitnami.conf. You will need to edit these lines

SSLCertificateFile "/opt/bitnami/apache2/conf/server.crt"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/server.key"

configure the permissions properly

sudo chown root:root /opt/bitnami/apache2/conf/NAME_OF_YOUR_FILE_HERE
sudo chmod 600 /opt/bitnami/apache2/conf/NAME_OF_YOUR_FILE_HERE

and restart Apache

sudo /opt/bitnami/ctlscript.sh restart apache

ted1 2020-05-26 00:42:54 UTC #27

I get "command not found."
You can see where I tried to add quotes thinking I forgot this.
I tried sudo. Nothing worked.

Thx, Ted

jota 2020-05-26 06:58:47 UTC #28

@ted1,

What I wrote in my previous message were lines to edit in the file, no commands you needed to run in the command line. You need to edit the /opt/bitnami/apache2/conf/bitnami/bitnami.conf file using nano for example

sudo nano /opt/bitnami/apache2/conf/bitnami/bitnami.conf

and substitute your current SSLCertificateFile and SSLCertificateKeyFile lines with the ones I mentioned

SSLCertificateFile "/opt/bitnami/apache2/conf/NAME_OF_YOUR_FILE_HERE"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/NAME_OF_YOUR_KEY_FILE_HERE"

and restart Apache after that.

ted1 2020-05-27 00:12:35 UTC #29

I used TextEdit to edit the bitnami.conf file where the key file is what Digicert calls the intermediate cert(DigiCertCA.crt).

I also loaded my site files into htdocs. My only concern is that apache is running on this Macmini port 80 and could conflict with the Bitnami App but don't really know. Port 443 is still not open yet. The document root for this site is in a different place than htdocs as you might guess. It might be better to turn off apache version installed with Macosx Catalina. The home page of this site is index.html as is the previous site in htdocs.
Please see the results of my code as it applies to the successful installation of the certificate. Thx, Ted

ted1 2020-05-27 00:54:48 UTC #30

Oops !! Apache won't start !! Don't know how to fix this. Can only be the bitnami.conf file

jota 2020-05-27 07:02:45 UTC #31

Hi @ted1,

Apache can't be started after you changed the certificates. That's probably because you didn't set the correct certificates there, can you confirm it?

tail -n 20 /opt/bitnami/apache2/logs/error_log

From this screenshot

I can see that you have the crt file (eagle400_tedmachine_info.crt) and the "privkey.pem" file. You need to use those files in the configuration. Please update them

SSLCertificateFile "/opt/bitnami/apache2/conf/eagle400_tedmachine_info.crt"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/privkey.pem"

and restart Apache

sudo /opt/bitnami/ctlscript.sh restart apache

If you still get errors, please run this command again

tail -n 20 /opt/bitnami/apache2/logs/error_log

ted1 2020-05-28 01:19:20 UTC #32

I was just about to finish the restart of apache and was prompted for a pass phrase. The only thing I could try was the password for this user. This wasn't going to work at all. More tries were possible but no idea where this comes from.

The error log seems to remember that the configuration of the key file was not done right.

Do you know the pass phrase ?? I will get this again if I try to restart apache.

jota 2020-05-28 07:10:47 UTC #33

Hi @ted1,

The passphrase is set by the digicert team. I understand you used digicert to generate your certificate, right? Please ask them to know the password of the certificate.

You can take a look at its documentation to remove the passphrase or configure Apache with the passphrase

https://knowledge.digicert.com/solution/SO14536.html

ted1 2020-05-29 02:31:45 UTC #34

When I look at the code for disabling the pass phrase I see cp server.key server.key.org
What I assume is that the privkey.pem file is what should be used in place of this file, however.
Is this correct ?? Privkey.pem appears to be the primary key file.
I called Digicert support and they said there is no passphrase for them to provide.
This must be because Digicert provides support for its certificates but not for apache, perhaps.
Do I need to use sudo in front of a command such as "openssl or chmod ??"
Thx, Ted

jota 2020-05-29 08:08:04 UTC #35

Hi @ted1,

Digicert should have provided you with the different files to configure SSL in the machine. There should be a private key (either you created that key or they provided that to you) and you need to use it to configure Apache. There should also be a crt file with the information of the certificate. Can you clarify this with Digicert so we help you when you have clear all the information?

Thanks

ted1 2020-06-01 01:24:01 UTC #36

I called support at Digicert and reinstalled the certificate under guidance.
The only private key is the one inside the keychain Macosx Catalina.

The greatest frustration he had with my question was that most people work in windows not Macosx server.

Unless I'm mistaken, privkey.pem file, is from the Bitnami app and not Macosx. I thought the CSR that was generated by the Macosx Server app would also turn out the private key. Perhaps it does. After clicking on the private key file I was unable to identify the contents as they pertain to a functional code.

Thx, Ted

jota 2020-06-01 09:07:23 UTC #37

Hi @ted1,

Did they confirm that's the private key you need to use. You will need to generate a file from that private key and store the file in the Apache's configuration folder in order to use it.

But the Digicert support team should know how to obtain the private key of your certificate in any of the operating systems.

You are right, the privkey.pem file is a private key we generate during the installation process. However, I don't know if you created a new private key to generate your certificate or if the Digicert team did that. Could you please confirm? To configure SSL on Apache, you need a private key and the public one of your certificate.

ted1 2020-06-03 15:58:22 UTC #38

I have been able to export the private key from the keychain to the apache2/conf folder where the other key files exist.

However, when I try to access the file even from a different location I'm redirected back to the keychain.
Possibly, to enter a location that needs to have access to the private key file such as this:

I also tried to use this method but the keychain wanted a file to grant access to and not a folder such apache2/conf
as you see here. Either way there should be some kind of access to the private key.
It could be I can substitute in the file path as you provided earlier in SSLCertificateFile instructions.
I don't have a great feeling this will work but it may need to be attempted.
Thx, Ted

ted1 2020-06-04 01:31:33 UTC #39

This is what bitnami.conf looks like after the private key from the keychain is added.

I tried to start apache with no success.
I don't know if this file is in a readable state or have any way of examining the contents.

jota 2020-06-04 08:45:00 UTC #40

Hi @ted1,

As I mentioned, I don't know if you generated the key file before sending the certificate to Digicert or if they did that. Please clarify this with them. Once you know where the private key file to use is, we can help you to configure Apache.

You can verify if that Certificates.p12 file is the private key of your certificate by using these command

cd /opt/bitnami/apache2/conf
openssl x509 -in eagle4000_tedmachine_info.crt -pubkey -noout -outform pem | sha256sum
openssl pkey -in Certificates.p12 -pubout -outform pem | sha256sum

If they both don't match it's because that's not the private key. More info here

https://docs.bitnami.com/general/apps/roundcube/administration/check-ssl-certificate/

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!