Unable to reinstall an expired let's encrypt cert

async8 2021-02-27 21:40:41 UTC #1

Keywords: WordPress - AWS - Technical issue - Secure Connections (SSL/HTTPS)
bnsupport ID: 799e9859-a6c1-78f1-5e7d-fa954b9bc8c7
Description:
Hi. I tried to renew an expired let's encrypt cert, and got an error message (unable to renew...). I ended up deleting the cert using sudo certbot delete.
Then attempted fresh install using instructions at: https://docs.bitnami.com/aws/how-to/understand-bncert/.
This approach failed, indicating path did not exist.
Then attempted this approach: https://docs.bitnami.com/aws/how-to/generate-install-lets-encrypt-ssl/#alternative-approach - followed the steps, resulted in error:

AH00526: Syntax error on line 46 of /opt/bitnami/apache2/conf/bitnami/bitnami.conf:
SSLCertificateFile: file '/opt/bitnami/apache2/conf/server.crt' does not exist or is empty
apache config test fails, aborting

I'm not sure what my next steps should be at this point. My site is deployed in
AWS Lightsail with Apache. Thank you for your help.

async8 2021-02-28 00:06:10 UTC #2

Also commented out lines 46 / 47, referring to the server.crt & key files.

Reran the bncert command. This resulted in the following error:

An error occurred when applying configurations.
The web server configuration was left unchanged. There was an error in the new 
configuration, so it was reverted.
Failed steps:
* Starting web server: Failed to start
Find more details in the log file:
/tmp/bncert-202102272357.log

That log file contains a number of errors - I've shown the first one below:

child process exited abnormally

Error running ./autoupdate-linux-x64.run --mode unattended: child process exited abnormal$
Executing /opt/bitnami/common/bin/openssl x509 -noout -text -in /opt/bitnami/letsencrypt/$
Script exit code: 0

async8 2021-02-28 17:16:07 UTC #3

Also tried the steps outlined by @marco at this url: https://community.bitnami.com/t/httpd-could-not-be-started-after-installing-ssl-certificate-making-changes-to-bitnami-conf/52713/12. Tried restarting Apache after that - still getting httpd not found.

jcarmona 2021-03-01 15:45:44 UTC #4

Hi @async8

Thanks for using Bitnami WordPress!

That log file contains a number of errors - I've shown the first one below:

Could you please share the whole content of such a file?

I have reviewed the report generated by the bnsupport-tool and found out that Apache is indeed not running. Before we deal with the reinstallation/generation of an SSL certificate, let's first try to bound that issue:

1) It seems like your apache2/conf/bitnami/bitnami.conf contains invalid configuration (which may be the cause why the service is not able to start):

You are missing closing double quotes at the end of the SSLCipherSuite directive.

Listen 443
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
- SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !P$
+ SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !P$"

2) When you followed the steps in the aforementioned guide, you should have replaced DOMAIN with your actual domain, bamXXXXX7.ca. The new certificates seem to be generated, but you need to execute the following steps, this time making sure you use the actual domain name:

sudo ln -sf /opt/bitnami/letsencrypt/certificates/bamXXXXX7.ca.key /opt/bitnami/apache2/conf/server.key
sudo ln -sf /opt/bitnami/letsencrypt/certificates/bamXXXXX7.ca.crt /opt/bitnami/apache2/conf/server.crt
sudo chown root:root /opt/bitnami/apache2/conf/server*
sudo chmod 600 /opt/bitnami/apache2/conf/server*

3) Check that the Apache syntax is OK before proceeding. You should expect the following output:

sudo apachectl -t
# Syntax OK

4) You are now ready to restart your server!

sudo /opt/bitnami/ctlscript.sh restart apache

Best regards,
Jose Antonio Carmona

Was my answer helpful? Click on

async8 2021-03-01 21:42:04 UTC #5

Thanks @jcarmona - I did use my actual domain name. I'll paste the log file shortly. I appreciate your help and suggestions.

async8 2021-03-01 22:49:28 UTC #6

I tried the commands as recommended, with the following results:

bitnami@ip-172-26-2-92:~$ sudo chown root:root /opt/bitnami/apache2/conf/server*
chown: cannot dereference '/opt/bitnami/apache2/conf/server.crt.back': No such file or dir
ectory
chown: cannot dereference '/opt/bitnami/apache2/conf/server.crt.old': No such file or dire
ctory
chown: cannot dereference '/opt/bitnami/apache2/conf/server.key.back': No such file or dir
ectory
chown: cannot dereference '/opt/bitnami/apache2/conf/server.key.old': No such file or dire
ctory

bitnami@ip-172-26-2-92:~$ sudo chmod 600 /opt/bitnami/apache2/conf/server*
chmod: cannot operate on dangling symlink '/opt/bitnami/apache2/conf/server.crt.back'
chmod: cannot operate on dangling symlink '/opt/bitnami/apache2/conf/server.crt.old'
chmod: cannot operate on dangling symlink '/opt/bitnami/apache2/conf/server.key.back'
chmod: cannot operate on dangling symlink '/opt/bitnami/apache2/conf/server.key.old'
bitnami@ip-172-26-2-92:~$

bitnami@ip-172-26-2-92:~$ sudo /opt/bitnami/ctlscript.sh start
/opt/bitnami/mysql/scripts/ctl.sh : mysql  (pid 1846) already running
/opt/bitnami/php/scripts/ctl.sh : php-fpm (pid 1903) already running
Syntax OK
/opt/bitnami/apache2/scripts/ctl.sh : httpd could not be started

async8 2021-03-02 00:31:47 UTC #7

Here's the tmp log file generated after re-running bncert.

1 Log started 03/01/2021 at 23:06:36 
2Preferred installation mode : text 
  3 Trying to init installer in mode text 
  4 Mode text successfully initialized 
  5 Executing /opt/bitnami/apache2/bin/apachectl configtest 
  6 Script exit code: 0 
  7
  8 Script output:
  9
 10
 11 Script stderr:
 12  Syntax OK 
 13
 14 Executing ./autoupdate-linux-x64.run --mode unattended  
 15 Script exit code: 1 
 16
 17 Script output:
 18
 19
 20 Script stderr:
 21  child process exited abnormally
 22
 23 Error running ./autoupdate-linux-x64.run --mode unattended: child process exited abnor
 24 Executing /opt/bitnami/common/bin/openssl x509 -noout -text -in /opt/bitnami/letsencry
 25 Script exit code: 0 
 26
 27 Script output:
 28  Certificate: 
 29  Data:  
 30Version: 3 (0x2)  
 31Serial Number: 
 32 04:99:e3:d3:df:da:52:5d:c6:e8:06:8d:af:a0:dc:89:45:21
 33Signature Algorithm: sha256WithRSAEncryption 
 34Issuer: C = US, O = Let's Encrypt, CN = R3
 35Validity 
 36 Not Before: Feb 27 21:55:15 2021 GMT  
 37 Not After : May 28 21:55:15 2021 GMT  
 38Subject: CN = www.bamxxxxx7.ca  
 39Subject Public Key Info:
 40 Public Key Algorithm: id-ecPublicKey  
 41  Public-Key: (256 bit) 
 42  pub:  
4304:0e:4e:bf:31:b5:66:30:d0:5b:11:cd:aa:3a:f5:
 4457:ab:99:89:ab:5a:06:b3:41:fd:c8:4b:9f:69:5b:
 4576:cd:1e:24:9c:fe:dc:41:36:3b:c5:6c:49:8b:2b:
 4694:b4:99:86:34:36:x2:x4:32:0x:xx:xx:72:77:c6:
 474c:41:4b:72:9b 
 48  ASN1 OID: prime256v1  
 49  NIST CURVE: P-256  
 50X509v3 extensions:
 51 X509v3 Key Usage: critical
 52  Digital Signature  
 53 X509v3 Extended Key Usage:
 54  TLS Web Server Authentication, TLS Web Client Authentication 
 55 X509v3 Basic Constraints: critical 
 56  CA:FALSE  
 57 X509v3 Subject Key Identifier:  
 58  EF:25:AC:74:8E:27:AD:76:BC:32:17:96:XX:8D:05:AD:5A:16:D1:E1  
 59 X509v3 Authority Key Identifier:
 60  keyid:14:2E:B3:17:B7:58:56:CB:AE:50:09:40:X6:1X:XX:9D:8B:14:C2:C6  
 61
 62 Authority Information Access:
 63  OCSP - URI:http://r3.o.lencr.org  
 64  CA Issuers - URI:http://r3.i.lencr.org/ 
 65 
 66 X509v3 Subject Alternative Name:
 67  DNS:bamxxxxx7.ca, DNS:www.bamxxxxx7.ca
 68 X509v3 Certificate Policies: 
 69  Policy: 2.23.140.1.2.1
 70  Policy: 1.3.6.1.4.1.44947.1.1.1
 71 CPS: http://cps.letsencrypt.org 
 72
 73 CT Precertificate SCTs:
 74  Signed Certificate Timestamp:  
 75Version: v1 (0x0) 
 76Log ID : 5C:DC:43:92:FE:E6:AB:45:44:B1:5X:9X:X4:56:X6:10:
 7737:FB:D5:FA:47:DC:A1:73:94:B2:5E:X6:F6:C7:0E:CA 
 78Timestamp : Feb 27 22:55:15.709 2021 GMT  
 79Extensions: none  
 80Signature : ecdsa-with-SHA256 
 8130:44:02:20:14:CE:75:69:31:39:C5:55:X5:97:5X:XX:
 82CE:FE:3F:84:29:CC:D7:15:5B:CE:25:1B:6C:6F:X1:1B:
 83E4:44:44:18:02:20:49:5B:A3:95:B8:1A:6C:24:83:XX:
 8484:62:A0:75:59:0A:CF:14:3B:CA:FD:D1:F1:B3:27:XX:
 8524:A7:45:D9:D2:8B 
 86  Signed Certificate Timestamp:  
 87Version: v1 (0x0)
88Log ID : F6:5C:94:2F:D1:77:30:22:14:54:18:08:30:94:56:8X:
 89E3:4D:13:19:33:BF:DF:0C:2F:20:0B:CC:4E:X1:64:X3 
 90Timestamp : Feb 27 22:55:15.685 2021 GMT  
 91Extensions: none  
 92Signature : ecdsa-with-SHA256 
 9330:45:02:20:34:4C:0D:94:39:2F:83:C5:56:09:3X:X5:
 948E:6A:3D:AE:6F:C9:F6:3D:9F:3E:71:CF:B0:1A:4X:4F:
 950E:8F:DA:0C:02:21:00:FE:FD:94:AF:AA:E7:F4:XX:7B:
 96DE:CE:C8:4D:03:84:80:D3:0C:63:02:57:E7:C9:9B:6F:
 9764:2D:20:42:92:B3:FC 
 98  Signature Algorithm: sha256WithRSAEncryption  
 99 43:35:f3:40:85:9b:73:ba:8f:72:95:9a:e4:d1:47:d4:cb:e9:  
100 84:f7:3e:7e:f9:40:26:ff:e0:8b:71:35:3c:a6:x5:x7:6x:59:  
101 f9:20:a0:b4:38:2f:c5:f5:4e:d7:1f:5x:01:57:19:97:88:70:  
102 26:de:2e:d7:42:b6:2a:f4:39:8c:40:48:bb:c5:38:2c:2a:4f:  
103 e7:ff:9d:07:96:d1:36:a9:0f:32:fe:f5:c8:90:df:c8:99:79:  
104 99:bd:8a:06:e4:cc:54:82:b9:77:ae:fa:53:9a:43:8f:4f:85:  
105 73:d2:27:8d:f9:3d:cc:51:36:69:a3:4f:26:a7:f5:9c:68:82:  
106 c5:d3:ce:a5:d6:f1:db:a5:b6:29:80:10:e5:6e:a5:07:62:90:  
107 9c:0d:59:2a:1f:bf:e1:09:5d:c7:87:3b:09:3e:e1:f9:ca:57:  
108 0b:93:f0:01:9d:c5:a7:0b:98:e4:6x:9x:9f:3f:23:36:06:c4:  
109 0a:4f:b9:a2:f6:22:2e:8c:5f:fa:f8:d5:0c:db:8c:89:2d:3b:  
110 e9:8c:a0:6f:c2:75:13:c0:3c:74:01:91:11:a6:f8:3f:99:c3:  
111 c3:08:ba:17:46:52:1a:09:94:f2:ac:73:ef:0f:f0:d2:0b:86:  
112 54:79:fa:e2:ac:b0:de:e9:fe:d2:9c:65:dd:ff:51:11:77:95:  
113 4d:8b:d7:b6
114
115 Script stderr:
116
117
118 Validating domain 'www.bamxxxxx7.ca' 
119 Determining machine public IP address 
120 [23:07:00] Detected public IP address: 'X.96.X.23'
121 Executing getent hosts www.bamxxxxx7.ca 
122 Script exit code: 0 
123
124 Script output:
125  3.96.7.23 bamxxxxx7.ca www.bamxxxxx7.ca  
126
127 Script stderr: 
128
129
130 Validating domain 'bamxxxxx7.ca'  
131 Executing getent hosts bamxxxxx7.ca  
132 Script exit code: 0 
133
134 Script output:
135  3.96.7.23 bamxxxxx7.ca  
136
137 Script stderr:
138
139
140 Validating domain 'www.bamxxxxx7.ca' 
141 Executing getent hosts www.bamxxxxx7.ca 
142 Script exit code: 0 
143
144 Script output:
145  3.96.7.23 bamxxx7.ca www.bamxxxxx7.ca  
146
147 Script stderr:
148 
149
150 Validating domain 'bamxxxxx7.ca'  
151 Executing getent hosts bamxxxxx7.ca  
152 Script exit code: 0 
153
154 Script output:
155  3.96.7.23 bamxxxxx7.ca  
156
157 Script stderr:
158
159
160 Stopping web server 
161 Executing /opt/bitnami/ctlscript.sh stop apache > /dev/null 2> /dev/null  
162 Script exit code: 0 
163
164 Script output:
165
166
167 Script stderr:
168
169
170 Executing /opt/bitnami/letsencrypt/lego --version  
171 Script exit code: 0 
172
173 Script output:
174  lego version 4.2.0 linux/amd64 
175
176 Script stderr:
177
178
179 Configuring Let's Encrypt certificates
180 Executing /opt/bitnami/letsencrypt/lego --path /opt/bitnami/letsencrypt --email="horac
181 Script exit code: 0 
182
183 Script output:
184  2021/03/01 23:07:30 [www.bamxxxxx7.ca] The certificate expires in 87 days, the number o
185
186 Script stderr:
187
188
189 Executing chown -R bitnami /opt/bitnami/letsencrypt  
190 Script exit code: 0 
191
192 Script output:
193
194
195 Script stderr:
196
197
198 Executing chown -R bitnami /opt/bitnami/apps/letsencrypt
199 Script exit code: 0 
200
201 Script output:
202
203
204 Script stderr:
205
206
207 Executing find /opt/bitnami/apps/letsencrypt-type f  -print0 | xargs -0 chmod 664  
208 Script exit code: 0 
209
210 Script output:  
211
212
213 Script stderr:
214
215
216 Executing find /opt/bitnami/apps/letsencrypt-type d  -print0 | xargs -0 chmod 775  
217 Script exit code: 0 
218
219 Script output:
220
221
222 Script stderr:
223
224
225 Executing crontab -u bitnami -l 
226 Script exit code: 0 
227
228 Script output:
229
230 0 0 * * * sudo /opt/bitnami/letsencrypt/lego --path /opt/bitnami/letsencrypt --email="
231  
232 Script stderr:
233
234
235 Executing crontab -u bitnami /tmp/cron20210301230734 
236 Script exit code: 0 
237
238 Script output:
239
240
241 Script stderr:
242
243
244 Executing crontab -u bitnami -l 
245 Script exit code: 0 
246
247 Script output:
248
249
250 Script stderr:
251
252
253 Executing crontab -u bitnami /tmp/cron20210301230735 
254 Script exit code: 0 
255
256 Script output:
257
258
259 Script stderr:
260
261
262 Configuring server name
263 Executing /opt/bitnami/apps/wordpress/bnconfig.disabled --machine_hostname www.bamxxxxx7
264 Script exit code: 0 
265
266 Script output:
267
268
269 Script stderr:
270
271
272 [23:07:40] Removing redirections and patches in web server configuration from previous
273 Enabling HTTP to HTTPS redirection 
274 [23:07:41] Enabling HTTPS redirection 
275 Enabling non-www to www redirection
276 [23:07:41] Enabling non-www to www redirection 
277 Testing web server configuration
278 Executing /opt/bitnami/apache2/bin/apachectl configtest 
279 Script exit code: 0 
280
281 Script output:
282
283
284 Script stderr:
285  Syntax OK 
286
287 Starting web server 
288 Executing /opt/bitnami/ctlscript.sh stop apache > /dev/null 2> /dev/null  
289 Script exit code: 0 
290
291 Script output:
292
293
294 Script stderr: 
295
296
297 Executing /opt/bitnami/ctlscript.sh start apache > /dev/null 2> /dev/null 
298 Script exit code: 3 
299
300 Script output:
301
302
303 Script stderr:
304  child process exited abnormally
305
306 Error running /opt/bitnami/ctlscript.sh start apache > /dev/null 2> /dev/null: child p
307 Executing /opt/bitnami/ctlscript.sh status apache 
308 Script exit code: 0 
309
310 Script output:
311  apache not running 
312
313 Script stderr:
314
315
316 Checking web server started 
317 Restoring web server configuration 
318 [23:08:14] Restoring configuration file /opt/bitnami/apache2/conf/httpd.conf from /opt
319 Setting variable diff from diff -uw /opt/bitnami/apache2/conf/httpd.conf /opt/bitnami/
320 Script exit code: 1 
321
322 Script output:
323  --- /opt/bitnami/apache2/conf/httpd.conf2021-03-01 23:07:36.189309242 +0000 
324 +++ /opt/bitnami/apache2/conf/httpd.conf.back.202103012306  2020-08-11 16:16:18.000000
325 @@ -199,7 +199,7 @@ 
326  #
327  # If your host doesn't have a registered DNS name, enter its IP address here.  
328  #
329 -ServerName www.bamxxxxx7.ca:80
330 +ServerName localhost:80  
331
332  #
333  # Deny access to the entirety of your server's filesystem. You must
334
335 Script stderr:
336  child process exited abnormally
337 
338 Error running diff -uw /opt/bitnami/apache2/conf/httpd.conf /opt/bitnami/apache2/conf/
339 [23:08:14] Restoring configuration file /opt/bitnami/apache2/conf/bitnami/bitnami-apps
340 Setting variable diff from diff -uw /opt/bitnami/apache2/conf/bitnami/bitnami-apps-pre
341 Script exit code: 1 
342
343 Script output:
344  --- /opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf 2021-03-01 23:07:30.38
345 +++ /opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf.back.202103012306 20
346 @@ -1,5 +1,4 @@  
347  # Bitnami applications installed in a prefix URL 
348  Include "/opt/bitnami/apps/wordpress/conf/httpd-prefix.conf" 
349 Include "/opt/bitnami/apps/phpmyadmin/conf/httpd-prefix.conf" 
350 -  Include "/opt/bitnami/apps/letsencrypt/conf/httpd-prefix.conf"
351
352 \ No newline at end of file  
353
354 Script stderr:
355  child process exited abnormally
356  
357 Error running diff -uw /opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf /opt
358 [23:08:15] Restoring configuration file /opt/bitnami/apache2/conf/bitnami/bitnami.conf
359 Setting variable diff from diff -uw /opt/bitnami/apache2/conf/bitnami/bitnami.conf /op
360 Script exit code: 1 
361
362 Script output:
363  --- /opt/bitnami/apache2/conf/bitnami/bitnami.conf 2021-03-01 23:07:41.593205322 +000
364 +++ /opt/bitnami/apache2/conf/bitnami/bitnami.conf.back.202103012306 2021-03-01 22:
365 @@ -7,26 +7,6 @@ 
366
367  <VirtualHost _default_:80>  
368 DocumentRoot "/opt/bitnami/apache2/htdocs"  
369 -  # BEGIN: Support domain renewal when using mod_proxy without Location  
370 -  <IfModule mod_proxy.c> 
371 - ProxyPass /.well-known !
372 -  </IfModule>
373 -  # END: Support domain renewal when using mod_proxy without Location 
374 -  # BEGIN: Enable HTTP to HTTPS redirection
375 -  RewriteEngine On 
376 -  RewriteCond %{HTTPS} !=on 
377 -  RewriteCond %{HTTP_HOST} !^localhost  
378 -  RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
379 -  RewriteCond %{REQUEST_URI} !^/\.well-known  
380 -  RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R,L]
381 -  # END: Enable HTTP to HTTPS redirection  
382 -  # BEGIN: Enable non-www to www redirection  
383 -  RewriteCond %{HTTP_HOST} !^www\. [NC] 
384 -  RewriteCond %{HTTP_HOST} !^localhost  
385 -  RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
386 -  RewriteCond %{REQUEST_URI} !^/\.well-known  
387 -  RewriteRule ^(.*)$ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=permanent,L]  
388 -  # END: Enable non-www to www redirection 
389 <Directory "/opt/bitnami/apache2/htdocs">
390Options Indexes FollowSymLinks
391AllowOverride All 
392 @@ -44,13 +24,6 @@  
393
394 # Bitnami applications installed with a prefix URL (default)  
395 Include "/opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf"
396 -  # BEGIN: Support domain renewal when using mod_proxy within Location
397 -  <Location /.well-known>
398 - <IfModule mod_proxy.c>  
399 -ProxyPass !  
400 - </IfModule> 
401 -  </Location>
402 -  # END: Support domain renewal when using mod_proxy within Location  
403  </VirtualHost>  
404
405  # Default SSL Virtual Host configuration.  
406 @@ -70,22 +43,9 @@  
407  <VirtualHost _default_:443> 
408 DocumentRoot "/opt/bitnami/apache2/htdocs"  
409 SSLEngine on  
410 -#SSLCertificateFile "/opt/bitnami/apache2/conf/www.bamxxxxx7.ca.crt" 
411 -#SSLCertificateKeyFile "/opt/bitnami/apache2/conf/www.bamxxxxx7.ca.key" 
412 +#SSLCertificateFile "/opt/bitnami/apache2/conf/server.crt"
413 +#SSLCertificateKeyFile "/opt/bitnami/apache2/conf/server.key"
414
415 -  # BEGIN: Support domain renewal when using mod_proxy without Location  
416 -  <IfModule mod_proxy.c> 
417 - ProxyPass /.well-known !
418 -  </IfModule>
419 -  # END: Support domain renewal when using mod_proxy without Location 
420 -  # BEGIN: Enable non-www to www redirection 
421 -  RewriteEngine On 
422 -  RewriteCond %{HTTP_HOST} !^www\. [NC] 
423 -  RewriteCond %{HTTP_HOST} !^localhost  
424 -  RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
425 -  RewriteCond %{REQUEST_URI} !^/\.well-known  
426 -  RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=permanent,L] 
427 -  # END: Enable non-www to www redirection 
428 <Directory "/opt/bitnami/apache2/htdocs">
429Options Indexes FollowSymLinks
430AllowOverride All 
431 @@ -103,13 +63,6 @@ 
432
433 # Bitnami applications installed with a prefix URL (default)  
434 Include "/opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf"
435 -  # BEGIN: Support domain renewal when using mod_proxy within Location
436 -  <Location /.well-known>
437 - <IfModule mod_proxy.c>  
438 -ProxyPass !  
439 - </IfModule> 
440 -  </Location>  
441 -  # END: Support domain renewal when using mod_proxy within Location  
442  </VirtualHost>  
443
444  # Bitnami applications that uses virtual host configuration  
445
446 Script stderr:
447  child process exited abnormally
448
449 Error running diff -uw /opt/bitnami/apache2/conf/bitnami/bitnami.conf /opt/bitnami/apa
450 Stopping web server 
451 Executing /opt/bitnami/ctlscript.sh stop  > /dev/null 2> /dev/null  
452 Script exit code: 0 
453
454 Script output:
455
456
457 Script stderr:
458
459
460 Starting web server 
461 Executing /opt/bitnami/ctlscript.sh stop  > /dev/null 2> /dev/null  
462 Script exit code: 0
463
464 Script output:
465
466
467 Script stderr:
468
469
470 Executing /opt/bitnami/ctlscript.sh start  > /dev/null 2> /dev/null 
471 Script exit code: 3 
472
473 Script output:
474
475
476 Script stderr:
477  child process exited abnormally
478
479 Error running /opt/bitnami/ctlscript.sh start  > /dev/null 2> /dev/null: child process
480 Exiting with code 0 
481

jcarmona 2021-03-02 13:10:58 UTC #8

Hi @async8

Thanks for the output! However, I am missing the output of this command here, which will shed some light on the possible misconfigurations of your server.

sudo apachectl -t
# Syntax OK

Also, could you please execute the following one? It will show if the symlinks were correctly created:

ls -la /opt/bitnami/apache2/conf

Best regards,
Jose Antonio Carmona

Was my answer helpful? Click on

async8 2021-03-03 14:35:18 UTC #9

bitnami@ip-172-26-2-92:~$ sudo apachectl -t
Syntax OK

bitnami@ip-172-26-2-92:~$ ls -la /opt/bitnami/apache2/conf
total 392
drwxr-xr-x  5 bitnami root   4096 Mar  1 23:08 .
drwxr-xr-x 14 root    root   4096 Feb 19  2020 ..
lrwxrwxrwx  1 root    root     52 Feb 27 22:59 bam*****boo7.ca.crt -> /opt/bitnami/letsencrypt/
certificates/bam*****v7.ca.crt
lrwxrwxrwx  1 root    root     52 Feb 27 22:59 bam*****7.ca.key -> /opt/bitnami/letsencrypt/
certificates/bam*****7.ca.key
drwxr-xr-x  2 bitnami root   4096 Mar  1 23:08 bitnami
-rw-r--r--  1 bitnami root    289 Feb 19  2020 deflate.conf
drwxr-xr-x  2 bitnami root   4096 Feb 19  2020 extra
-rw-r--r--  1 root    root  20112 Aug 11  2020 httpd.conf
-rw-r--r--  1 root    root  20112 Aug 11  2020 httpd.conf.back.202102272251
-rw-r--r--  1 root    root  20112 Aug 11  2020 httpd.conf.back.202102272258
-rw-r--r--  1 root    root  20112 Aug 11  2020 httpd.conf.back.202102272357
-rw-r--r--  1 root    root  20112 Aug 11  2020 httpd.conf.back.202103012306
-rw-r--r--  1 bitnami root  13064 Feb  7  2020 magic
-rw-r--r--  1 bitnami root  60847 Feb  7  2020 mime.types
-rw-------  1 bitnami root   8440 Dec  4  2018 modsecurity.conf
drwxr-xr-x  3 bitnami root   4096 Feb 19  2020 original
-rw-r--r--  1 bitnami root  17597 Feb 19  2020 pagespeed.conf
-rw-r--r--  1 bitnami root 141034 Feb 19  2020 pagespeed_libraries.conf
-rw-r--r--  1 bitnami root    199 Feb 19  2020 php-fpm-apache.conf
-rw-------  1 bitnami root   1854 Mar 28  2020 privkey.pem
lrwxrwxrwx  1 root    root     52 Mar  1 22:44 server.crt -> /opt/bitnami/letsencrypt/cert
ificates/bam*****7.ca.crt
lrwxrwxrwx  1 root    root     48 Feb 27 21:22 server.crt.back -> /opt/bitnami/letsencrypt
/certificates/DOMAIN.crt
lrwxrwxrwx  1 root    root     46 Aug 24  2020 server.crt.old -> /etc/letsencrypt/live/bam
*****7.ca/fullchain.pem
-rw-------  1 root    root    891 Feb 28 17:13 server.csr
-rw-------  1 root    root    985 Mar 28  2020 server.csr.old
lrwxrwxrwx  1 root    root     52 Mar  1 22:43 server.key -> /opt/bitnami/letsencrypt/cert
ificates/bam*****7.ca.key
lrwxrwxrwx  1 root    root     48 Feb 27 21:22 server.key.back -> /opt/bitnami/letsencrypt
/certificates/DOMAIN.key
lrwxrwxrwx  1 root    root     44 Aug 24  2020 server.key.old -> /etc/letsencrypt/live/bam
*****7.ca/privkey.pem
-rw-r--r--  1 bitnami root    203 Feb 19  2020 ssi.conf
lrwxrwxrwx  1 root    root     56 Mar  1 23:07 www.bam*****7.ca.crt -> /opt/bitnami/letsencr
ypt/certificates/www.bam*****7.ca.crt
lrwxrwxrwx  1 root    root     56 Mar  1 23:07 www.bam*****7.ca.key -> /opt/bitnami/letsencr
ypt/certificates/www.bam*****7.ca.key

jcarmona 2021-03-04 10:59:36 UTC #10

Hi @async8

Thanks for sharing the output of the commands.

bitnami@ip-172-26-2-92:~$ sudo apachectl -t
Syntax OK

Apache is reporting that the syntax of the configuration files is OK, so let's now check that the certificates exist.

From your second command, I can see that the server.crt and server.key files are symbolic links referencing to the actual location of them:

bitnami@ip-172-26-2-92:~$ ls -la /opt/bitnami/apache2/conf
...
lrwxrwxrwx  1 root    root     52 Mar  1 22:44 server.crt -> /opt/bitnami/letsencrypt/certificates/bam*****7.ca.crt
lrwxrwxrwx  1 root    root     52 Mar  1 22:43 server.key -> /opt/bitnami/letsencrypt/certificates/bam*****7.ca.key

Could you please execute the following command (using the rightmost part of the arrow, which is the real location of the file)

ls -la /opt/bitnami/letsencrypt/certificates/bam*****7.ca.crt
ls -la /opt/bitnami/letsencrypt/certificates/bam*****7.ca.key

If the output IS NOT No such file or dir we are good to go.

You should be able to start your apache server:

sudo /opt/bitnami/ctlscript.sh restart apache

If the issue is still present, could you please share the content of apache's error_log?

$ tail -n 40 /opt/bitnami/apache2/logs/error_log

Also, it would be nice if you could execute the bnsupport-tool again, so that I am able to see the whole picture.

Best regards,
Jose Antonio Carmona

Was my answer helpful? Click on

async8 2021-03-04 15:27:22 UTC #11

Still no luck. I'll send the log file shortly.

Last login: Wed Mar  3 14:03:26 2021 from 52.xx.xx.xx
bitnami@ip-172-xx-x-xx:~$ ls -la /opt/bitnami/letsencrypt/certificates/bamxxxxx7.ca.crt
-rw------- 1 bitnami root 3201 Feb 27 21:18 /opt/bitnami/letsencrypt/certificates/bamxxxxx7.
ca.crt
bitnami@ip-172-XX-X-xx:~$ ls -la /opt/bitnami/letsencrypt/certificates/bamxxxxx7.ca.key
-rw------- 1 bitnami root 288 Feb 27 21:18 /opt/bitnami/letsencrypt/certificates/bamxxxxx7.c
a.key
bitnami@ip-172-XX-X-xx:~$ sudo /opt/bitnami/ctlscript.sh restart apache
Unmonitored apache
Syntax OK
/opt/bitnami/apache2/scripts/ctl.sh : apache not running
Syntax OK
/opt/bitnami/apache2/scripts/ctl.sh : httpd could not be started
Monitored apache
bitnami@ip-172-XX-X-xx:~$

async8 2021-03-04 18:37:07 UTC #12

Here's my new bn-support reference: 9acc74b8-d7af-b7e5-8a66-c55482c95017
The Apache log repeats the same information over and over. Here is an excerpt.

[Thu Mar 04 15:31:03.100240 2021] [ssl:emerg] [pid 23886:tid 140113964185344] AH02572: Failed to configure at le$
[Thu Mar 04 15:31:03.100314 2021] [ssl:emerg] [pid 23886:tid 140113964185344] SSL Library Error: error:140A80B1:$
[Thu Mar 04 15:31:03.100319 2021] [ssl:emerg] [pid 23886:tid 140113964185344] AH02312: Fatal error initialising $
AH00016: Configuration Failed

jcarmona 2021-03-05 11:51:03 UTC #13

Hi @async8

I have checked your Apache configuration again and it seems there still are some misconfiguration:

apache2/conf/bitnami/bitnami.conf

...
- SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !P$"
+ SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !EDH !RC4"
...
<VirtualHost _default_:443>
  DocumentRoot "/opt/bitnami/apache2/htdocs"
  SSLEngine on
- #SSLCertificateFile "/opt/bitnami/apache2/conf/server.crt"
- #SSLCertificateKeyFile "/opt/bitnami/apache2/conf/server.key"
+ SSLCertificateFile "/opt/bitnami/apache2/conf/server.crt"
+ SSLCertificateKeyFile "/opt/bitnami/apache2/conf/server.key"

Regarding the SSLCipherSuite directive, I have checked and I highly doubt there is a cipher suite named P$, instead, I have suggested you use the original configuration.

The SSLCertificateFile and SSLCertificateKeyFile were commented out, that is why apache was failing to start.

As usual, check that the Apache syntax is OK before proceeding and then proceed to restart your server.

Best regards,
Jose Antonio Carmona

Was my answer helpful? Click on

async8 2021-03-06 07:37:06 UTC #14

Thank you @jcarmona. That worked perfectly. I had commented out the cert files during my troubleshooting. Your catch on the SSLCipherSuitwas bang on. I'm a little puzzled as to why that context (!P$) was inserted though. Thank you for all your help in getting me back up and running.

Bitnami provides free all-in-one installers, virtual machines and cloud images for popular open source applications. Get them now!