Koozali.org: home of the SME Server
  1. Koozali.org: home of the SME Server
  2. Obsolete Releases
  3. SME Server 9.x
  4. Topic: letsencrypt and server-manager
« previous next »
Pages: 1 [2]  All   Go Down

letsencrypt and server-manager

  • 24 Replies
  • 5422 Views

Offline ElFroggio

  • *
  • 262
  • +0/-0
Re: letsencrypt and server-manager
« Reply #15 on: February 07, 2017, 05:11:30 PM »
Quote from: Stefano on February 07, 2017, 04:58:26 PM
ok..
Code: [Select]
config show modSSL

Code: [Select]
[root@ethelbert ~]# config show modSSL
modSSL=service
    CertificateChainFile=/etc/dehydrated/certs/911networks.com/chain.pem
    CommonName=ethelbert.911networks.com
    TCPPort=443
    access=public
    crt=/etc/dehydrated/certs/911networks.com/cert.pem
    key=/etc/dehydrated/certs/911networks.com/privkey.pem
    status=enabled
[root@ethelbert ~]#


Quote from: Stefano on February 07, 2017, 04:58:26 PM
about logs: /var/log/http/*admin* are the files to check

Code: [Select]
View log files
Log file "httpd-admin/current" is empty!

and looking at /var/log/httpd/access_log

All are status code: 200: ok except for this line that is 307 redirect, but no other error.

Code: [Select]
911networks.com 192.168.1.71 - - [07/Feb/2017:08:02:54 -0800] "GET /server-manager HTTP/1.1" 307 308 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.2; Trident/7.0; rv:11.0) like Gecko"
911networks.com 192.168.1.71 - - [07/Feb/2017:08:02:54 -0800] "GET //server-common/cgi-bin/login?back=https%3a%2f%2f192.168.1.14%2fserver-manager HTTP/1.1" 200 468 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.2; Trident/7.0; rv:11.0) like Gecko"
911networks.com 192.168.1.71 - - [07/Feb/2017:08:02:54 -0800] "GET /favicon.ico HTTP/1.1" 200 601 "https://192.168.1.14//server-common/cgi-bin/login?back=https%3a%2f%2f192.168.1.14%2fserver-manager" "Mozilla/5.0 (Windows; U; Windows NT 5.2; Trident/7.0; rv:11.0) like Geck
Logged

Offline Jean-Philippe Pialasse

  • *
  • 2,764
  • +11/-0
  • aka Unnilennium
    • http://smeserver.pialasse.com
Re: letsencrypt and server-manager
« Reply #16 on: February 07, 2017, 05:13:35 PM »
Quote from: ElFroggio on February 07, 2017, 05:11:30 PM

and looking at /var/log/httpd/access_log

All are status code: 200: ok except for this line that is 307 redirect, but no other error.

Code: [Select]
911networks.com 192.168.1.71 - - [07/Feb/2017:08:02:54 -0800] "GET /server-manager HTTP/1.1" 307 308 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.2; Trident/7.0; rv:11.0) like Gecko"
911networks.com 192.168.1.71 - - [07/Feb/2017:08:02:54 -0800] "GET //server-common/cgi-bin/login?back=https%3a%2f%2f192.168.1.14%2fserver-manager HTTP/1.1" 200 468 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.2; Trident/7.0; rv:11.0) like Gecko"
911networks.com 192.168.1.71 - - [07/Feb/2017:08:02:54 -0800] "GET /favicon.ico HTTP/1.1" 200 601 "https://192.168.1.14//server-common/cgi-bin/login?back=https%3a%2f%2f192.168.1.14%2fserver-manager" "Mozilla/5.0 (Windows; U; Windows NT 5.2; Trident/7.0; rv:11.0) like Geck

you need to look at the admin_error_log and admin_access_log
Logged

Offline ElFroggio

  • *
  • 262
  • +0/-0
Re: letsencrypt and server-manager
« Reply #17 on: February 07, 2017, 05:23:01 PM »
Quote from: Jean-Philippe Pialasse on February 07, 2017, 05:13:35 PM
you need to look at the admin_error_log and admin_access_log

No error that I can see:

/var/log/httpd/admin_access_log:

Code: [Select]
127.0.0.1 - - [07/Feb/2017:08:02:28 -0800] "GET /server-manager HTTP/1.1" 307 334
127.0.0.1 - - [07/Feb/2017:08:02:28 -0800] "GET /server-common/cgi-bin/login?back=https%3a%2f%2fethelbert.911networks.com%2fserver-manager HTTP/1.1" 200 481
127.0.0.1 - - [07/Feb/2017:08:02:29 -0800] "GET /server-common/cgi-bin/login?redirect=1&back=https%3A%2F%2Fethelbert.911networks.com%2Fserver-manager HTTP/1.1" 200 1522
127.0.0.1 - - [07/Feb/2017:08:02:29 -0800] "GET /server-common/css/tkt.css HTTP/1.1" 200 674
127.0.0.1 - - [07/Feb/2017:08:02:29 -0800] "GET /server-common/smeserver_logo.jpg HTTP/1.1" 200 6447
127.0.0.1 - - [07/Feb/2017:08:02:29 -0800] "GET /server-common/btn_donateCC_LG.gif HTTP/1.1" 200 3592
127.0.0.1 - - [07/Feb/2017:08:02:34 -0800] "POST /server-common/cgi-bin/login HTTP/1.1" 200 440
127.0.0.1 - - [07/Feb/2017:08:02:44 -0800] "POST /server-common/cgi-bin/login HTTP/1.1" 200 440
127.0.0.1 - - [07/Feb/2017:08:02:49 -0800] "POST /server-common/cgi-bin/login HTTP/1.1" 200 440
127.0.0.1 - - [07/Feb/2017:08:02:54 -0800] "GET /server-manager HTTP/1.1" 307 308

and

/var/log/httpd/admin_error_log: Viewed at Tue 07 Feb 2017 08:21:45 AM PST.
Code: [Select]
[Thu Feb 02 07:14:01 2017] [notice] Digest: generating secret for digest authentication ...
[Thu Feb 02 07:14:01 2017] [notice] Digest: done
[Thu Feb 02 07:14:01 2017] [notice] Apache/2.2.15 (Unix) mod_auth_tkt/2.1.0 configured -- resuming normal operations
[Thu Feb 02 07:14:15 2017] [notice] caught SIGTERM, shutting down
[Thu Feb 02 07:16:06 2017] [notice] Digest: generating secret for digest authentication ...
[Thu Feb 02 07:16:06 2017] [notice] Digest: done
[Thu Feb 02 07:16:07 2017] [notice] Apache/2.2.15 (Unix) mod_auth_tkt/2.1.0 configured -- resuming normal operations
Logged

Offline michelandre

  • *
  • 261
  • +0/-0
Re: letsencrypt and server-manager
« Reply #18 on: February 07, 2017, 09:33:26 PM »
Hi ElFroggio,

https://www.ethelbert.911networks.com/
WARNING: This site is trying to identify itself with invalid informations. (my translation)

Alternative names for the certificate:
Non critique
Nom DNS: 911networks.com
Nom DNS: ethelbert.911networks.com
Nom DNS: ethelbert.sritch.com
Nom DNS: mail.911networks.com
Nom DNS: mail.sritch.com
Nom DNS: www.sritch.com

Try to use a TEST cerficate (so you will not overun the 5/7 limit) and add a www.ethelbert.911networks.com in the file /etc/dehydrated/domains.txt

I will also check the definition of domain ethelbert.911networks.com in Server Manager of both servers. How did ethelbert.911networks.com answered the challenge? There is a redirection somewhere because he is local?

My 2 cents

Michel-Andeé
Logged

Offline Stefano

  • *
  • 10,839
  • +2/-0
Re: letsencrypt and server-manager
« Reply #19 on: February 07, 2017, 09:43:20 PM »
michelandre, seeing the modSSL setup I'd guess that ElFroggio is using smeserver-letsencrypt contrib, not the dehydrated script alone..

using the domains.txt file, AFAIK, will result in many certs, one for each domain (and its hosts)

so, ElFroggio, please tell us how are you using dehydrated/letsencrypt and hod did you install it

thank you
Logged

Offline michelandre

  • *
  • 261
  • +0/-0
Re: letsencrypt and server-manager
« Reply #20 on: February 07, 2017, 09:55:00 PM »
Hi Stefano,

I will issue only one certificate if the domains are all in one line only and separated by space. Limit is around 100 domains +/-.
I will issue one certificate for each line if the domains are all on different lines.

I do not know the contrib but my Let's Encrypt client uses the same path as above.

Michel-André
Logged

Offline Stefano

  • *
  • 10,839
  • +2/-0
Re: letsencrypt and server-manager
« Reply #21 on: February 07, 2017, 09:55:42 PM »
doh, I learned something new, my bad :-)
thank you
Logged

Offline ElFroggio

  • *
  • 262
  • +0/-0
Re: letsencrypt and server-manager
« Reply #22 on: February 07, 2017, 10:39:37 PM »
Quote from: michelandre on February 07, 2017, 09:33:26 PM
https://www.ethelbert.911networks.com/
WARNING: This site is trying to identify itself with invalid informations. (my translation)

There is no www.ethlebert.911networks.com, just ethelbert.911networks.com

Quote from: michelandre on February 07, 2017, 09:33:26 PM
I will also check the definition of domain ethelbert.911networks.com in Server Manager of both servers. How did ethelbert.911networks.com answered the challenge? There is a redirection somewhere because he is local?

There's a redirection but not on 911networks.com, just on sritch.com

Thanks

Syv
Logged

Offline ElFroggio

  • *
  • 262
  • +0/-0
Re: letsencrypt and server-manager
« Reply #23 on: February 07, 2017, 10:42:17 PM »
Quote from: Stefano on February 07, 2017, 09:43:20 PM
michelandre, seeing the modSSL setup I'd guess that ElFroggio is using smeserver-letsencrypt contrib, not the dehydrated script alone..

using the domains.txt file, AFAIK, will result in many certs, one for each domain (and its hosts)

so, ElFroggio, please tell us how are you using dehydrated/letsencrypt and hod did you install it

I used dehydrated and not the contrib. It's not even installed. I just followed https://wiki.contribs.org/Letsencrypt part 3 and 4.
Logged

Offline michelandre

  • *
  • 261
  • +0/-0
Re: letsencrypt and server-manager
« Reply #24 on: February 08, 2017, 05:46:52 AM »
Hi ElFroggio,

As a last hope I would try this.
Using Reverse Rroxy on the main server to redirect Internet traffic to the local server.

At your Register, add a CNAME record for ethelbert that point to the public IP of 911networks.com

In Server Manager on local server, create domain: ethelbert.911networks.com with the DNS Servers: from the Internet.

Configuration of the main server 911networks.com as a Reverse Proxy
Code: [Select]
# db domains set ethelbert.911networks.com domain
# db domains setprop ethelbert.911networks.com Nameservers internet
# db domains setprop ethelbert.911networks.comt ProxyPassTarget http://LOCAL_IP_OF_ethelbert.911networks.com
# db domains setprop ethelbert.911networks.com TemplatePath ProxyPassVirtualHosts
# signal-event domain-create micronator-101.ddns.net
On main server, check with Server Manager and the domain ethelbert.911networks.com should be there.

Code: [Select]
# db domains show
...
ethelbert.911networks.com=domain
    Nameservers=internet
    ProxyPassTarget=http://LOCAL_IP_OF_ethelbert.911networks.com/
    TemplatePath=ProxyPassVirtualHosts
...
Code: [Select]
# ping -c 2 ethelbert.911networks.com
INSTALL "TOR" AND GOTO: https://www.ethelbert.911networks.com

Install Let's Encrypt on the local machine and ask for a TEST certificate.
Let's Encrypt will send the challenge to ethelbert.911networks.com and the local server will answer.

*** UNINSTALLING ***
On main server: 911networks.com
Code: [Select]
# db domains delete ethelbert.911networks.com
# signal-event domain-modify
# db domains show | grep ethelbert.911networks.com
I tried this scenario before on a local server to test certificate from Let's Encrypt and it worked.

Michel-André
Logged
Pages: 1 [2]  All   Go Up
« previous next »
  1. Koozali.org: home of the SME Server
  2. Obsolete Releases
  3. SME Server 9.x
  4. Topic: letsencrypt and server-manager