I had a fully fonctionnal website on an OVH VPS (debian, apache, SSL). I tried to migrate it to a scaleway VPS. I changed the DNS entries, I copied the apache config files and the certificate files but it did not work. Then I tried to generate a new certificate with letsencrypt, but I still get SSL_ERROR_RX_RECORD_TOO_LONG when I try to connect my website via https.
Here is my apache config file :
Listen 80
Listen 443 https
<VirtualHost mydomain.fr:80>
ServerName mydomain.fr
DocumentRoot /var/www/html
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost mydomain.fr:443>
ServerName mydomain.fr
DocumentRoot /var/www/html
SSLCertificateFile /etc/letsencrypt/live/mydomain.fr/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mydomain.fr/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
What surprises me is that the certbot script returns a success but the ssllabs.com site diagnoses a problem.
certbot certonly -d mydomain.fr
gives me
Renewing an existing certificate
Performing the following challenges:
tls-sni-01 challenge for mydomain.fr
Waiting for verification...
Cleaning up challenges
Generating key (2048 bits): /etc/letsencrypt/keys/001_key-certbot.pem
Creating CSR: /etc/letsencrypt/csr/001_csr-certbot.pem
IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at
/etc/letsencrypt/live/mydomain.fr/fullchain.pem. Your cert
will expire on 2017-11-29. To obtain a new or tweaked version of
this certificate in the future, simply run certbot again. To
non-interactively renew *all* of your certificates, run "certbot
renew"
- If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le
openssl x509 -in /etc/letsencrypt/live/mydomain.fr/fullchain.pem -noout -text
SSLEngine on
is set either in your VirtualHost block or the letsencrypt/options it includes.<VirtualHost mydomain.fr:80>
to<VirtualHost *:80>
solved the problem. But it is not reproducible...