Migrating, php_admin and SSL issues

Discussion in 'Installation/Configuration' started by Turgut Kalfaoglu, Jan 4, 2025.

  1. Hello there. I'm migrating from a PLESK server.
    I migrated a single client, and it went well.
    However, restarting the web server failed because the config contained php_admin commands that existed in the previous server's config but do not exist in the new server.
    I manually deleted all such lines.
    Then the bought SSL certificate did not work, site giving SSL errors. So I manually copy/pasted the certificate from the old server to the new server's SSL page in the Site configuration. I chose SAVE as the action and clicked OK. the certificate was not saved. I toggled SSL on and off, even tried toggling Lets Encrypt box. No luck. The browser still giving "this is a self-signed certificate, I won't accept it". I re-pasted the config, selected CREATE this time. Still no luck. I eventually found the client's SSL directory and put the files there manually!
    The paid SSL certificate migration definitely has some issues.
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    From your description, your SSL issue is not directly related to the SSL certificate migration. The SSL cert not working is just a symptom of the Apache on the new system rejecting the configuration that was copied over from the old system. To avoid a complete apache failure, ISPConfig then has to roll back to the last working settings. Your old system seems to have still used mod_php while ISPConfig uses a more recent setup which does not use mod_php anymore as mod_php prevents more modern http protocols like HTTP2 from working. When your old system now has mod_php settings that are not properly wrapped in ifmod lines by Plesk, then inserting such lines on the new system must cause issues with Apache that block all further config changes.

    Where did you delete them? If you manually edit config files, then that's why the SSL cert can not be saved. Editing vhost config files is never the right solution and will not help you in solving the underlying issue. What you must do instead check the Apache directives field of the website, if the php_admin lines are in there, remove them there. Unless you do that, no changes will be saved incl. your SSL cert. If the lines are not there, then you might have accidentally enabled and selected mod_php as PHP mode for that site; your system does not support mod_php, that's why it is disabled by default. Manually enabling it will cause the wrong configuration to be used, which will cause a system failure.

    The read-before-posting post also contains instructions on your topic, see chapter 5:

    https://forum.howtoforge.com/threads/please-read-before-posting.58408/
     
    Last edited: Jan 4, 2025
    ahrasis and Turgut Kalfaoglu like this.
  3. Thank you for your reply.
    As soon as the migration is complete, httpd will not start at all since it contains the php_admin commands that were migrated.
    So I fail to see how I can avoid manually changing the config files. That's why I edited the /etc/httpd/conf/sites-available/thatsite.vhost file.
     
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    You can do that of course, but this will not solve your issue; it just blocks any changes in Apache by ISPConfig and causes your SSL problem, plus you can not use ISPConfig for this site in future. I mentioned two possibilities where the settings can be, please check if the admin_php config was inserted into the apache directives field of the website, or if the PHP mode of the site has been set to mod_php. To find a solution for the issue, the next step is that you check which of the two options is causing the problem.
     
    Turgut Kalfaoglu and ahrasis like this.
  5. Many thanks - I checked and in Web Domain -> Options there is nothing.
    As I mentioned, when I migrate a site from the old server, the php_admin commands that exist at the old server are copied to the new server. But there is no php_admin at the new server. So as soon as the migration finishes, httpd will not start.
    I'm afraid of adding the php module as the new server (a centos 9) defaults to php 8.1 and I'm worried of screwing something up. I did install several other PHP's, either manually compiling them or using remi's repository for a few versions. I added those extra php versions to ispconfig with little difficulty.
    Shall I add mod_php somehow to this server?
     
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    The php_admin settings must be somewhere when they are in the file. if the apach directives field is empty, then the php mode of the site must be mod_php. Please check that. There are no other ways that such values might be part of the generated vhost file. But to find the right solution for your issue, I must know which of the two ways to include these settings is causing this.

    No, this is not needed and should not be done, there are other ways to solve that issue.
     
  7. I'm sorry I must be missing something. Here is a summary:
    1) The new system (with ISPCONFIG) does not have mod_php installed.
    2) I migrated a site from a PLESK site whose conf file included php_admin lines.
    3) Those lines were copied to the ISPCONFIG's mysite.vconf file.
    4) Apache will not re-start.

    IMHO: The migration tool should check if mod_php is installed, and if not, it should NOT migrate the php_admin lines.
     
  8. till

    till Super Moderator Staff Member ISPConfig Developer

    Please answer the two questions I asked you above. I can not help you without this information. Here again is the information that I need:

    1) Check the options tab of the website, is there anything in the custom Apache directives field and anything in the custom php.ini field.
    2) Which PHP mode is used by that website?

    Also, post the complete generated vhost file (without manually edits you might have made)

    This is not necessarily what happens here. But as I said, I can't help you with a solution unless you start to answer the questions.

    Btw. If you like to get help or need support for the Migration Tool, you might want to contact its support https://www.ispconfig.org/get-support/?type=migration instead of posting questions in the ISPConfig community forum.
     
    Turgut Kalfaoglu likes this.
  9. Hello. I assume you mean the configuration options at the SOURCE server. There is nothing after the migration is complete -- the custom apache directives are blank at the destination server.

    The old (source) server HAD some extra apache options:
    These are for HTTP:
    # === BEGIN Run PHP as User -==- Domain xyzteacher.com: on ===
    # === The following lines are processed by "Run PHP as User" software. Please do not touch lines from BEGIN to END tags! ===
    <IfModule itk.c>
    AssignUserId xyztea psacln
    </IfModule>
    <IfModule mod_ruid2.c>
    RMode config
    RUidGid apache apache
    RGroups apache psaserv
    RMinUidGid apache apache
    <Directory ~ "^(/var/www/vhosts/xyzteacher.com/http*docs/(?!cgi-bin/)|/usr/local/helixdev/rau/)">
    RUidGid xyztea psacln
    RGroups psacln
    </Directory>
    </IfModule>
    # === END Run PHP as User ===
    These were in the source server's HTTPS Additional directives box:

    # === BEGIN Run PHP as User -==- Domain xyzteacher.com: on ===
    # === The following lines are processed by "Run PHP as User" software. Please do not touch lines from BEGIN to END tags! ===
    <IfModule itk.c>
    AssignUserId xyztea psacln
    </IfModule>
    <IfModule mod_ruid2.c>
    RMode config
    RUidGid apache apache
    RGroups apache psaserv
    RMinUidGid apache apache
    <Directory ~ "^(/var/www/vhosts/xyzteacher.com/http*docs/(?!cgi-bin/)|/usr/local/helixdev/rau/)">
    RUidGid xyztea psacln
    RGroups psacln
    </Directory>
    </IfModule>
    # === END Run PHP as User ===
    The old server had NGINX too.. the new one doesn't -- it just adds complexity.
    This website ran on PHP 7.4.33 FPM under PLESK Obsidian before the migration.
     
  10. till

    till Super Moderator Staff Member ISPConfig Developer

    No, I meant the target server. So Apache directives are blank; this is good. It means no php_admin values have been copied from plesk into that field. What about PHP mode of the website in ISPConfig? You might have to enable all php modes under System > interface > main config > PHP Handler (Apache only) temporarily to ensure no mode is hidden when looking at the site settings.

    Besides that, please post the generated vhost file from ISPConfig before editing it, so I can see what's actually in there and at which exact place in the file which causes your issues.
     
  11. till

    till Super Moderator Staff Member ISPConfig Developer

    Ok, so please post the file /etc/httpd/conf/sites-enabled/100-drakciger.com.vhost or, better, contact the support of the Migration Tool and send it to them.
     
  12. Many thanks - yes I deleted my message and will send it to them using the link you provided. Many thanks!
     

Share This Page