0

In typing this question I found this:

Apache seems to be using old expired certificate even though new one is installed

His issue is mine to a T, and all things he tried more or less I did too. The difference was his was solved because he had nginx running. In my case I have no such reverse proxy server. So I just cannot get Apache to see the new certs I got using certbot (that was a whole other issue, certbot auto renew didn't work gave errors and so I did a certbot cert only apache and pointed appach ssl-certs in etc/httpd/extra to there.

Tried everything else like he did. Moved the folder the /etc/httpd/extra/ssl-certs and ssl-certs-proxy were pointing to to /tmp, and had those files point to the new .pem location:

SSLCertificateFile /etc/letsencrypt/live/www.apo.nmsu.edu/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.apo.nmsu.edu/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/www.apo.nmsu.edu/chain.pem
Include /etc/letsencrypt/options-ssl-apache.conf

cert.pem -> ../../archive/www.apo.nmsu.edu/cert2.pem
chain.pem -> ../../archive/www.apo.nmsu.edu/chain2.pem
fullchain.pem -> ../../archive/www.apo.nmsu.edu/fullchain2.pem
privkey.pem -> ../../archive/www.apo.nmsu.edu/privkey2.pem

Alas nothing, no change, websites still report the expired ticket. Which was in another folder /live/apo.nmsu.edu-0004 which I moved to tmp. So not sure how apache is still picking all that up.

Did an apachectl stop apachectl start and even a restart and also reset the vm this is all running on.

Same issues. Completely out of ideas, even checked using openssl the new .pem files and they do expire correctly in 90 days (they are from letsencrypt).

also:

[root@web-server extra]# apachectl -v
Server version: Apache/2.4.6 (Scientific Linux)
Server built:   Jul 29 2019 10:53:12
1

I guess you should check what certificates you have in the files pointed to in your Apache configuration, especially that you seem to have some symbolic links involved.

The command:

# openssl x509 -noout -text -in <path to cert file from config>

or

# openssl x509 -noout -startdate -enddate -in <path to cert file from config>

should be helpfull. Please make sure certificate dates are as you would expect.

  • I found out that I was on the wrong server (I need to close this ticket).... nginx wasn't infront of my server, but there was another VM that was a firewall somehow everything was going through, a script I found updated the certs just fine. Shrug now to dig into all this old data and work the others did before me to figure out WHY that worked. Leaving this here though in case others might have a similar issue to prompt them to look elsewhere, and openssl is just a helpful command here too. – Codejoy Sep 4 at 18:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.