[SOLVED] Error restarting apache after upgrade due to cert/key mismatch AH02565

Discussion in 'General' started by StefanoBertoli, Jan 5, 2022.

  1. StefanoBertoli

    StefanoBertoli Member

    Trying to force ispconfig_upgrade to resolve problem wont work

    I have no way to make apache start and only error log i see is in the main domain (the one where ispconfig interface reply)

    Cheched if key and certificate match and it does

    root@hocus-02:~# openssl rsa -in /etc/letsencrypt/live/hocus-02.example.com/privkey.pem -noout -modulus
    Modulus=D50AE20C9FD3D182FB4FC3B5AF8682F609D5A9873E33A299D756649D5FD6761918405EC965A45DC829A0AEE3E34F10E09461DCE1710F9969365AD3369217CB0F364073A9E1132DC13FE715FB8F32E86A9964D085C18CFE0A1A7EFA68FE1C0D039544B4B8701158AE2C6F30A06A04FA2FB39B1A40EEA34BA1E7A00BAA2EB4DC10CB88CBE81AB69183F01FECBFE17C9C26588C1EB7E4D975AE0850640AE4BF3C637BBE347D987633DA3B072C7B05A08AB5ABFEDBAD253D1155F708F64F21D8F5617833BB1E6417ED9C3DFC9ED14FC5ED02447CA4502B5A39BB873E2982021CE9E00AAB0016F8533E18E99511A7F397631D0B780B2D41CE227796E918E86308A8C661A82C669F8DC461A0D9A13C5ED30A66F60D519E858168D70382196D5C264B1B56AA278102314DF52480D1F016FC19B77789C1DB919D071179D4CBD5F29B8330C5934DC61F9E5F7B9310038D9CD8550B8D7784FB6AAF8FE53958F895F5E5C4CD873D6BDC65AF2364F36126F4034A3E3311F5AE991D6FF3ED4B5786682858A0E046D7EDB19F60C3E72BACB25CEB8B486A7B0EBAD1775070BCCEAE06B98F0AD4980ACCE8187768B95F9F8EE90A11EE9B8B6DB14CAEC335C1E95600C11D68703C9E23DA0D48630C1C26AE5B1132C0B972F2BB6B13C479578B502E8445C0380277292F4F529117492C9AD4DF3ACE964B2A95BE0BAFFF3C4193A77993FBF55CEA7023
    root@hocus-02:~# openssl x509 -in /etc/letsencrypt/live/hocus-02.example.com/cert.pem -noout -modulus
    Modulus=D50AE20C9FD3D182FB4FC3B5AF8682F609D5A9873E33A299D756649D5FD6761918405EC965A45DC829A0AEE3E34F10E09461DCE1710F9969365AD3369217CB0F364073A9E1132DC13FE715FB8F32E86A9964D085C18CFE0A1A7EFA68FE1C0D039544B4B8701158AE2C6F30A06A04FA2FB39B1A40EEA34BA1E7A00BAA2EB4DC10CB88CBE81AB69183F01FECBFE17C9C26588C1EB7E4D975AE0850640AE4BF3C637BBE347D987633DA3B072C7B05A08AB5ABFEDBAD253D1155F708F64F21D8F5617833BB1E6417ED9C3DFC9ED14FC5ED02447CA4502B5A39BB873E2982021CE9E00AAB0016F8533E18E99511A7F397631D0B780B2D41CE227796E918E86308A8C661A82C669F8DC461A0D9A13C5ED30A66F60D519E858168D70382196D5C264B1B56AA278102314DF52480D1F016FC19B77789C1DB919D071179D4CBD5F29B8330C5934DC61F9E5F7B9310038D9CD8550B8D7784FB6AAF8FE53958F895F5E5C4CD873D6BDC65AF2364F36126F4034A3E3311F5AE991D6FF3ED4B5786682858A0E046D7EDB19F60C3E72BACB25CEB8B486A7B0EBAD1775070BCCEAE06B98F0AD4980ACCE8187768B95F9F8EE90A11EE9B8B6DB14CAEC335C1E95600C11D68703C9E23DA0D48630C1C26AE5B1132C0B972F2BB6B13C479578B502E8445C0380277292F4F529117492C9AD4DF3ACE964B2A95BE0BAFFF3C4193A77993FBF55CEA7023
    root@hocus-02:~# openssl x509 -in /etc/letsencrypt/live/hocus-02.example.com/chain.pem -noout -modulus
    Modulus=BB021528CCF6A094D30F12EC8D5592C3F882F199A67A4288A75D26AAB52BB9C54CB1AF8E6BF975C8A3D70F4794145535578C9EA8A23919F5823C42A94E6EF53BC32EDB8DC0B05CF35938E7EDCF69F05A0B1BBEC094242587FA3771B313E71CACE19BEFDBE43B45524596A9C153CE34C852EEB5AEED8FDE6070E2A554ABB66D0E97A540346B2BD3BC66EB66347CFA6B8B8F572999F830175DBA726FFB81C5ADD286583D17C7E709BBF12BF786DCC1DA715DD446E3CCAD25C188BC60677566B3F118F7A25CE653FF3A88B647A5FF1318EA9809773F9D53F9CF01E5F5A6701714AF63A4FF99B3939DDC53A706FE48851DA169AE2575BB13CC5203F5ED51A18BDB15
    root@hocus-02:~# openssl x509 -in /etc/letsencrypt/live/hocus-02.example.com/fullchain.pem -noout -modulus
    Modulus=A5F34916E6274D4896ECA503F64AC9C6291E0E7D0BE5CDD41CB197AD70178DDBAFC7820680DA80470C88B110600DE7650E0E64CBB461653CAD2A6EA83FB6AE4F47519551904D518BC7E46CD2B406E50597A49C754FB706434266851F11F087AEC81D88B8F6444B0B440EA8068AC830F3665DB0992C75E6BAFC3BE11FA90ADAA0100321041D8681519566B7DA4CF5064C43153451C2D7D33D21412008622D04A7FD5C818A9DA9B9EE483D6F359A624B8A51B640356FC1851D11712CA0FFE09EDB8FCF81EFAF5B48099A77D854EEDAB0E01A7D53893EE2251928855C3211521E11EA8F05366835065B7CFABFA357CC82944774FC1CCE005BD19736F52A24352E3D12F5E3E24011E25176924BC3B90A9288AE587678919A07459C514AE3A13BDF0C9D2C50CA22BAB67433545E8FBFC7AEE34715B872126D2B4826291540D60420C2446140A9E2FCEE3916AF72C39DBFDF1459058F4C124BF8D1FE79E529A82E5E85ACCED661CDDEFA7DBF41090FBFCBBE36F1CC187CDE9F2CC3FCD001F5A7A20BAE7BE279AD4420F2751DBAD3DCAB4C47A2C0824783B3F828836B1246BCF59AA40E790485EF1DC914429A46F488C1A16BA50EA1218338E4FD2E4AB2F09ECD63F4556C5D5DFFE752409A5280E4273C88C22BFF4E66B46D670436ACA9CAE7F1B314BD62EF4E86B32B08BE5DAC23FBD30455FEC0F8C9D9DAAFB5BE13789D785F5BBDE7

    The error I get is:
    [Wed Jan 05 14:04:07.422663 2022] [ssl:emerg] [pid 3269] AH02565: Certificate and private key hocus-02.example.com:443:0 from /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.crt and /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.key do not match

    Thanks for any idea on it
     
    StefanoBertoli, Jan 5, 2022
    #1
  2. StefanoBertoli

    StefanoBertoli Member

    the .vhost file section:
    <IfModule mod_ssl.c>
    SSLEngine on
    SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    # SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES$
    SSLHonorCipherOrder on
    # <IfModule mod_headers.c>
    # Header always add Strict-Transport-Security "max-age=15768000"
    # </IfModule>
    SSLCertificateFile /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.crt
    SSLCertificateKeyFile /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.key
    SSLUseStapling on
    SSLStaplingResponderTimeout 5
    SSLStaplingReturnResponderErrors off
    </IfModule>
     
    StefanoBertoli, Jan 5, 2022
    #2
  3. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    @Croydon wrote a script to find the real problem:
    To start the script, run the following command as root user on your server:
    Code:
    curl https://gitplace.net/pixcept/ispconfig-tools/-/raw/stable/cert_check.sh | sh
    Share the output here in code blocks please (insert -> code).
     
    Th0m, Jan 5, 2022
    #3
  4. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    What does this return:
    Code:
    ls -l /var/www/clients/client0/web1/ssl/
ls -l /etc/letsencrypt/*/hocus-02.example.com
ls -l /usr/local/ispconfig/interface/ssl/
     
    Jesse Norell, Jan 5, 2022
    #4
  5. StefanoBertoli

    StefanoBertoli Member

    Code:
    Checking /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.crt OK
Checking /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.key OK
Checking that key and certificate match FAILED!
    All the others vhost are ok
     
    StefanoBertoli, Jan 6, 2022
    #5
  6. StefanoBertoli

    StefanoBertoli Member

    Maybe something... look at the date of the element 23... chain and fullchain have 10 december, cert and key have 4 january

    Looks strange, any idea to solve it?

    Code:
    -rw-r--r-- 1 root root 2277 ott 19  2019 cert10.pem
-rw-r--r-- 1 root root 2277 dic 19  2019 cert11.pem
-rw-r--r-- 1 root root 2277 feb 17  2020 cert12.pem
-rw-r--r-- 1 root root 2277 apr 17  2020 cert13.pem
-rw-r--r-- 1 root root 2277 giu 16  2020 cert14.pem
-rw-r--r-- 1 root root 2277 ago 15  2020 cert15.pem
-rw-r--r-- 1 root root 2277 ott 14  2020 cert16.pem
-rw-r--r-- 1 root root 2208 dic 14  2020 cert17.pem
-rw-r--r-- 1 root root 2208 feb 12  2021 cert18.pem
-rw-r--r-- 1 root root 2208 apr 13  2021 cert19.pem
-rw-r--r-- 1 root root 2516 apr 27  2018 cert1.pem
-rw-r--r-- 1 root root 2208 giu 12  2021 cert20.pem
-rw-r--r-- 1 root root 2208 ago 11 21:44 cert21.pem
-rw-r--r-- 1 root root 2208 ott 11 03:00 cert22.pem
-rw-r--r-- 1 root root 1923 gen  4 17:00 cert23.pem
-rw-r--r-- 1 root root 2520 giu 26  2018 cert2.pem
-rw-r--r-- 1 root root 2516 ago 25  2018 cert3.pem
-rw-r--r-- 1 root root 2516 ott 24  2018 cert4.pem
-rw-r--r-- 1 root root 2277 dic 23  2018 cert5.pem
-rw-r--r-- 1 root root 2277 feb 21  2019 cert6.pem
-rw-r--r-- 1 root root 2277 apr 22  2019 cert7.pem
-rw-r--r-- 1 root root 2277 giu 21  2019 cert8.pem
-rw-r--r-- 1 root root 2273 ago 20  2019 cert9.pem
-rw-r--r-- 1 root root 1647 ott 19  2019 chain10.pem
-rw-r--r-- 1 root root 1647 dic 19  2019 chain11.pem
-rw-r--r-- 1 root root 1647 feb 17  2020 chain12.pem
-rw-r--r-- 1 root root 1647 apr 17  2020 chain13.pem
-rw-r--r-- 1 root root 1647 giu 16  2020 chain14.pem
-rw-r--r-- 1 root root 1647 ago 15  2020 chain15.pem
-rw-r--r-- 1 root root 1647 ott 14  2020 chain16.pem
-rw-r--r-- 1 root root 1586 dic 14  2020 chain17.pem
-rw-r--r-- 1 root root 1586 feb 12  2021 chain18.pem
-rw-r--r-- 1 root root 1586 apr 13  2021 chain19.pem
-rw-r--r-- 1 root root 1647 apr 27  2018 chain1.pem
-rw-r--r-- 1 root root 3750 giu 12  2021 chain20.pem
-rw-r--r-- 1 root root 3750 ago 11 21:44 chain21.pem
-rw-r--r-- 1 root root 3750 ott 11 03:00 chain22.pem
-rw-r--r-- 1 root root 3750 dic 10 03:00 chain23.pem
-rw-r--r-- 1 root root 1647 giu 26  2018 chain2.pem
-rw-r--r-- 1 root root 1647 ago 25  2018 chain3.pem
-rw-r--r-- 1 root root 1647 ott 24  2018 chain4.pem
-rw-r--r-- 1 root root 1647 dic 23  2018 chain5.pem
-rw-r--r-- 1 root root 1647 feb 21  2019 chain6.pem
-rw-r--r-- 1 root root 1647 apr 22  2019 chain7.pem
-rw-r--r-- 1 root root 1647 giu 21  2019 chain8.pem
-rw-r--r-- 1 root root 1647 ago 20  2019 chain9.pem
-rw-r--r-- 1 root root 3924 ott 19  2019 fullchain10.pem
-rw-r--r-- 1 root root 3924 dic 19  2019 fullchain11.pem
-rw-r--r-- 1 root root 3924 feb 17  2020 fullchain12.pem
-rw-r--r-- 1 root root 3924 apr 17  2020 fullchain13.pem
-rw-r--r-- 1 root root 3924 giu 16  2020 fullchain14.pem
-rw-r--r-- 1 root root 3924 ago 15  2020 fullchain15.pem
-rw-r--r-- 1 root root 3924 ott 14  2020 fullchain16.pem
-rw-r--r-- 1 root root 3794 dic 14  2020 fullchain17.pem
-rw-r--r-- 1 root root 3794 feb 12  2021 fullchain18.pem
-rw-r--r-- 1 root root 3794 apr 13  2021 fullchain19.pem
-rw-r--r-- 1 root root 4163 apr 27  2018 fullchain1.pem
-rw-r--r-- 1 root root 5958 giu 12  2021 fullchain20.pem
-rw-r--r-- 1 root root 5958 ago 11 21:44 fullchain21.pem
-rw-r--r-- 1 root root 5958 ott 11 03:00 fullchain22.pem
-rw-r--r-- 1 root root 5958 dic 10 03:00 fullchain23.pem
-rw-r--r-- 1 root root 4167 giu 26  2018 fullchain2.pem
-rw-r--r-- 1 root root 4163 ago 25  2018 fullchain3.pem
-rw-r--r-- 1 root root 4163 ott 24  2018 fullchain4.pem
-rw-r--r-- 1 root root 3924 dic 23  2018 fullchain5.pem
-rw-r--r-- 1 root root 3924 feb 21  2019 fullchain6.pem
-rw-r--r-- 1 root root 3924 apr 22  2019 fullchain7.pem
-rw-r--r-- 1 root root 3924 giu 21  2019 fullchain8.pem
-rw-r--r-- 1 root root 3920 ago 20  2019 fullchain9.pem
-rw-r--r-- 1 root root 3272 ott 19  2019 privkey10.pem
-rw-r--r-- 1 root root 3272 dic 19  2019 privkey11.pem
-rw-r--r-- 1 root root 3272 feb 17  2020 privkey12.pem
-rw-r--r-- 1 root root 3272 apr 17  2020 privkey13.pem
-rw-r--r-- 1 root root 3272 giu 16  2020 privkey14.pem
-rw-r--r-- 1 root root 3268 ago 15  2020 privkey15.pem
-rw-r--r-- 1 root root 3268 ott 14  2020 privkey16.pem
-rw-r--r-- 1 root root 3272 dic 14  2020 privkey17.pem
-rw-r--r-- 1 root root 3272 feb 12  2021 privkey18.pem
-rw-r--r-- 1 root root 3272 apr 13  2021 privkey19.pem
-rw-r--r-- 1 root root 3272 apr 27  2018 privkey1.pem
-rw-r--r-- 1 root root 3272 giu 12  2021 privkey20.pem
-rw-r--r-- 1 root root 3272 ago 11 21:44 privkey21.pem
-rw-r--r-- 1 root root 3272 ott 11 03:00 privkey22.pem
-rw-r--r-- 1 root root 3272 gen  4 17:00 privkey23.pem
-rw-r--r-- 1 root root 3268 giu 26  2018 privkey2.pem
-rw-r--r-- 1 root root 3272 ago 25  2018 privkey3.pem
-rw-r--r-- 1 root root 3272 ott 24  2018 privkey4.pem
-rw-r--r-- 1 root root 3272 dic 23  2018 privkey5.pem
-rw-r--r-- 1 root root 3272 feb 21  2019 privkey6.pem
-rw-r--r-- 1 root root 3272 apr 22  2019 privkey7.pem
-rw-r--r-- 1 root root 3272 giu 21  2019 privkey8.pem
-rw-r--r-- 1 root root 3272 ago 20  2019 privkey9.pem
     
    StefanoBertoli, Jan 6, 2022
    #6
  7. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Perhaps some files got overwritten with an errant openssl command? I would either try to renew from cli (I think "certbot renew --cert-name hocus-02.example.com --force-renewal" to force), or disable LetsEncrypt on the site, manually delete the certificate, then enable again.
     
    Jesse Norell, Jan 6, 2022
    #7
  8. StefanoBertoli

    StefanoBertoli Member

    Solved by moving the vhost certs archive folder, request new certificate and change symbolic links in live folder.
    Code:
    mv /etc/letsencrypt/archive/hocus-02.example.com /etc/letsencrypt/archive/hocus-02.example.com-bak

certbot certonly .........

mv /etc/letsencrypt/archive/hocus-02.example.com-0001 /etc/letsencrypt/archive/hocus-02.example.com

cd /etc/letsencrypt/live/hocus-02.example.com/
ls -sf ../../archive/hocus-02.example.com/cert1.pem cert.pem
ls -sf ../../archive/hocus-02.example.com/chain1.pem chain.pem
ls -sf ../../archive/hocus-02.example.com/fullchain1.pem fullchain.pem
ls -sf ../../archive/hocus-02.example.com/privkey1.pem privkey.pem

systemctl start apache2
     
    StefanoBertoli, Jan 6, 2022
    #8
    till likes this.

Share This Page