1

We'll likely need to upgrade a Lightsail Bitnami WordPress Multisite instance in the future, so I'm testing doing it.

After I take a snapshot and then create a new, lager instance from it, then switch the static IP over to it, then the sites fail to load due to:

Your connection is not private
Attackers might be trying to steal your information from (etc..)
NET::ERR_CERT_AUTHORITY_INVALID
Subject: www.example.com
Issuer: www.example.com
Expires on: 7 Nov 2030
Current date: 18 Nov 2020
PEM encoded chain:
-----BEGIN CERTIFICATE-----
(cert details etc...)

Note the www.example.com and expiry date in 2030.

Do the SSL certificates (made with The Bitnami HTTPS Configuration Tool) only work on the original instance, even if the new instance are an exact copy? I'm guessing they do.

Is the only solution to create new certificates on the new instance using the same Bitnami tool?

Thanks

Improve this question

2 Answers 2

Reset to default
1

Bitnami Engineer here

Do the SSL certificates (made with The Bitnami HTTPS Configuration Tool) only work on the original instance, even if the new instance are an exact copy? I'm guessing they do.

Yes, the SSL configuration is also copied to the new instance as you created a snapshot from the first instance. You can confirm this by checking the SSL certificates Apache is using

sudo cat /opt/bitnami/apache2/conf/bitnami/bitnami.conf | grep SSLCertificate

Note: If you created a custom virtual host, you will need to use that file instead of the bitnami.conf file For example sudo cat /opt/bitnami/apps/wordpress/conf/httpd-vhosts.conf | grep SSLCertificate

Those certificates must be the ones the Bitnami HTTPS configuration tool generated and they should exist in the instance

sudo ls -la /path/to/the/certificate
Improve this answer
4
  • Thanks! I'm a bit confused: Q: Do the SSL certificates only work on the original instance? You replied: Yes. But you also say the SSL config is copied from the first instance. The same certs are present in /opt/bitnami/apache2/conf/ but the SSL definitely won't work on the new instance!
    – Ralpharama
    Nov 18, 2020 at 11:09
  • Essentially it would be good to know if I have to reissue certs, or if they should work on the copied instance as they are.
    – Ralpharama
    Nov 18, 2020 at 11:22
  • Sorry for not being clear but I confirmed your guess. The SSL certificates work the same way in the original instance and the new one as they are copied when creating the snapshot. So if you pointed your domain to the new instance, the connection should be fully secure. You shouldn't need to reissue the certificates unless you change your domain. Before accessing the new instance, please confirm your domain is properly configured, there is an online tool here that will help you.
    – Jota Martos
    Nov 19, 2020 at 7:45
  • Thanks for the clarification @jota-martos, Okay so the cert should work. But when I switch the static IP to the new instance I see no certificate - it says www.example.com when you examine the invalid cert in the browser's site info. I checked DNS and it is pointing to the correct static IP that works for the other instance fine!
    – Ralpharama
    Nov 19, 2020 at 8:32
0

The snapshot I was given to use didn't contain the certificates after all. When I created a new instance based on yesterday's backup it worked fine. I'm not sure where the LetsEncrypt certs are stored for a Lightsail Bitnami WordPresss Multisite, but I sure can't find them!

Improve this answer
1
  • 1
    The certificates are stored inside the /opt/bitnami/letsencrypt/ folder. The Let's Encrypt client (lego) is configured to use that folder when creating all the Let's Encrypt related info (account, certificate, ...). Once the tool generates those certificates, we generate symbolic links inside the Apache's conf folder (/opt/bitnami/apache2/conf) to use them in Apache
    – Jota Martos
    Nov 19, 2020 at 8:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .