1

I am trying to configure a Wordpress instance hosted on Google cloud to use https instead of http

I am trying to set it up as per these instructions:

https://jamescoote.co.uk/add-letsencrypt-ssl-certificate-to-wordpress/

to use letsencrypt

I've added installed the certificates as per those instructions. I also sylinked ssl.conf and ssl.load into mod-enabled.

I added the cert paths into the default-ssl.conf and symlinked that into sites-enabled but whenever I do this I can't get apache to restart. I get this message:

apache2.serviceJob for apache2.service failed. See 'systemctl status apa che2.service' and 'journalctl -xn' for details.

but when I try those commands it doesn't give me enough information to solve the problem.

The contents of the default-ssl.conf look like this (I've changed the hostname but the rest is as is):

ServerAdmin webmaster@localhost

    DocumentRoot /var/www/html

    # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
    # error, crit, alert, emerg.
    # It is also possible to configure the loglevel for particular
    # modules, e.g.
    #LogLevel info ssl:warn

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    # For most configuration files from conf-available/, which are
    # enabled or disabled at a global level, it is possible to
    # include a line for only one particular virtual host. For example the
    # following line enables the CGI configuration for this host only
    # after it has been globally disabled with "a2disconf".
    #Include conf-available/serve-cgi-bin.conf

    #   SSL Engine Switch:
    #   Enable/Disable SSL for this virtual host.
    SSLEngine on

    #   A self-signed (snakeoil) certificate can be created by installing
    #   the ssl-cert package. See
    #   /usr/share/doc/apache2/README.Debian.gz for more info.
    #   If both key and certificate are stored in the same file, only the
    #   SSLCertificateFile directive is needed.
    # SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
    # SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

    SSLCertificate /etc/letsencrypt/live/hostname/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/hostname/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/hostname/fullchain.pem

    #   Server Certificate Chain:
    #   Point SSLCertificateChainFile at a file containing the
    #   concatenation of PEM encoded CA certificates which form the
    #   certificate chain for the server certificate. Alternatively
    #   the referenced file can be the same as SSLCertificateFile
    #   when the CA certificates are directly appended to the server
    #   certificate for convinience.
    #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt

    #   Certificate Authority (CA):
    #   Set the CA certificate verification path where to find CA
    #   certificates for client authentication or alternatively one
    #   huge file containing all of them (file must be PEM encoded)
    #   Note: Inside SSLCACertificatePath you need hash symlinks
    #        to point to the certificate files. Use the provided
    #        Makefile to update the hash symlinks after changes.
    #SSLCACertificatePath /etc/ssl/certs/
    #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt

    #   Certificate Revocation Lists (CRL):
    #   Set the CA revocation path where to find CA CRLs for client
    #   authentication or alternatively one huge file containing all
    #   of them (file must be PEM encoded)
    #   Note: Inside SSLCARevocationPath you need hash symlinks
    #        to point to the certificate files. Use the provided
    #        Makefile to update the hash symlinks after changes.
    #SSLCARevocationPath /etc/apache2/ssl.crl/
    #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl

    #   Client Authentication (Type):
    #   Client certificate verification type and depth.  Types are
    #   none, optional, require and optional_no_ca.  Depth is a
    #   number which specifies how deeply to verify the certificate
    #   issuer chain before deciding the certificate is not valid.
    #SSLVerifyClient require
    #SSLVerifyDepth  10

    #   SSL Engine Options:
    #   Set various options for the SSL engine.
    #   o FakeBasicAuth:
    #    Translate the client X.509 into a Basic Authorisation.  This means that
    #    the standard Auth/DBMAuth methods can be used for access control.  The
    #    user name is the `one line' version of the client's X.509 certificate.
    #    Note that no password is obtained from the user. Every entry in the user
    #    file needs this password: `xxj31ZMTZzkVA'.
    #   o ExportCertData:
    #    This exports two additional environment variables: SSL_CLIENT_CERT and
    #    SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
    #    server (always existing) and the client (only existing when client
    #    authentication is used). This can be used to import the certificates
    #    into CGI scripts.
    #   o StdEnvVars:
    #    This exports the standard SSL/TLS related `SSL_*' environment variables.
    #    Per default this exportation is switched off for performance reasons,
    #    because the extraction step is an expensive operation and is usually
    #    useless for serving static content. So one usually enables the
    #    exportation for CGI and SSI requests only.
    #   o OptRenegotiate:
    #    This enables optimized SSL connection renegotiation handling when SSL
    #    directives are used in per-directory context.
    #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
            SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
            SSLOptions +StdEnvVars
    </Directory>

    #   SSL Protocol Adjustments:
    #   The safe and default but still SSL/TLS standard compliant shutdown
    #   approach is that mod_ssl sends the close notify alert but doesn't wait for
    #   the close notify alert from client. When you need a different shutdown
    #   approach you can use one of the following variables:
    #   o ssl-unclean-shutdown:
    #    This forces an unclean shutdown when the connection is closed, i.e. no
    #    SSL close notify alert is send or allowed to received.  This violates
    #    the SSL/TLS standard but is needed for some brain-dead browsers. Use
    #    this when you receive I/O errors because of the standard approach where
    #    mod_ssl sends the close notify alert.
    #   o ssl-accurate-shutdown:
    #    This forces an accurate shutdown when the connection is closed, i.e. a
    #    SSL close notify alert is send and mod_ssl waits for the close notify
    #    alert of the client. This is 100% SSL/TLS standard compliant, but in
    #    practice often causes hanging connections with brain-dead browsers. Use
    #    this only for browsers where you know that their SSL implementation
    #    works correctly.
    #   Notice: Most problems of broken clients are also related to the HTTP
    #   keep-alive facility, so you usually additionally want to disable
    #   keep-alive for those clients, too. Use variable "nokeepalive" for this.
    #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
    #   their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
    #   "force-response-1.0" for this.
    BrowserMatch "MSIE [2-6]" \
            nokeepalive ssl-unclean-shutdown \
            downgrade-1.0 force-response-1.0
    # MSIE 7 and newer should be able to use keepalive
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

</VirtualHost>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

when I checked to see if the certificates had been granted successfully they had. I guess there's some apache config that I haven't applied somewhere but I can't figure out what it is, any pointers would be appreciated.

Thanks

More details as requested:

This is the contents of the error log from apache:

[Thu Feb 23 06:46:55.153392 2017] [mpm_prefork:notice] [pid 1215] AH00163: Apache/2.4.10 (Debian) configured -- resuming normal operations [Thu Feb 23 06:46:55.153424 2017] [core:notice] [pid 1215] AH00094: Command line: '/usr/sbin/apache2' [Thu Feb 23 06:51:40.656914 2017] [authz_core:error] [pid 12411] [client 146.148.7.38:50713] AH01630: client denied by server configuration: /var/www/html/wp-config.old, referer: hostname/wp-config.old [Thu Feb 23 07:42:52.938926 2017] [authz_core:error] [pid 12408] [client 146.148.7.38:51000] AH01630: client denied by server configuration: /var/www/html/wp-config.old, referer: hostname/wp-config.old [Thu Feb 23 11:09:56.509913 2017] [mpm_prefork:notice] [pid 1215] AH00169: caught SIGTERM, shutting down [Thu Feb 23 11:13:34.728029 2017] [mpm_prefork:notice] [pid 17535] AH00163: Apache/2.4.10 (Debian) configured -- resuming normal operations [Thu Feb 23 11:13:34.728083 2017] [core:notice] [pid 17535] AH00094: Command line: '/usr/sbin/apache2'

Which doesn't strike me as being related to the issue but maybe I should remove that file anyway (although it starts ok when I removed the 443 section from the virtual host file)

This is the message from systemctl:

Failed to get D-Bus connection: No such file or directory - I got that having added the virtualHost section to my wordpress.conf to listen on 443, which what I had originally tried when starting to do this.

  • What information DOES systemctl status apache2.service and journalctl -xn give you? Also, post the relevant lines of your apache error log. – Gerald Schneider Feb 20 '17 at 11:16
  • This is the message from systemctl: Failed to get D-Bus connection: No such file or directory - I got that having added the virtualHost section to my wordpress.conf to listen on 443, which what I had originally tried when starting to do this. – Tim Campbell Feb 23 '17 at 11:11
1

It turns out the problem was this:

SSLCertificate

should have been

SSLCertificateFile

0

Those certificates should be added to your VirtualHost file and not to your default-ssl.conf file.

<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on

    SSLCertificate /etc/letsencrypt/live/hostname/cert.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/hostname/privkey.pem
    SSLCertificateChainFile /etc/letsencrypt/live/hostname/fullchain.pem
</VirtualHost>

It also would be good to post the results of the erros logs as mentioned above.

  • There is nothing wrong with doing this in the default-ssl.conf if it is the only virtualhost on the host. Without the actual error message why apache doesn't start this is just blind guessing. – Gerald Schneider Feb 20 '17 at 14:45
  • I've edited my original question to include additional information – Tim Campbell Feb 23 '17 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.