Apache cache old SSL certificate

Discussion in 'ISPConfig 3 Priority Support' started by Petar, Sep 17, 2024.

  1. Petar

    Petar Member HowtoForge Supporter

    Strange problem that Outlook cant connect to the mail server domain because of expired domain SSL when the certificate is renewed. New ispc 3.2.12 + Apache + Acme.sh on Debian 12.
    lets say the domain name (its a vhost on the server, not the main server domain) is mail.xsrver.com
    The domain is created in ISPC
    The SSL and LE are created, and the expiration date is today 17.09 at 10 o'clock.
    Outlook doesn't want to connect to expired SSL domain on the 17.09.
    ---
    We delete the ssl from ISPC
    we manualy rewoke domain with acme.sh --revoke -d mail.xsrver.com
    we remove the domain from /root/.acme.sh/mail.xsrver.com
    we remove the SSL from /var/www/clients/client1/web1/ssl/*

    we restart dovecot, postfix, apache2 (we even restarted the server)

    We create the ssl and LE from ISPC
    We check /root/.acme.sh/ and /var/www/clients/client1/web1/ssl/ and everything is ok and all the new certs are in place.
    If we open https://mail.xsrver.com it shows the new certificate and the connection is secured
    if from shell i try: curl -I https://mail.xsrver.com
    it gives the old expiration date, the same that outlook sees when connecting to it:
    ----
    HTTP/2 200
    expires: Tue, 17 Sep 2024 05:42:49 GMT
    cache-control: private, no-cache, no-store, must-revalidate, post-check=0, pre-check=0
    pragma: no-cache
    x-frame-options: sameorigin
    content-language: en
    set-cookie: roundcube_sessid=hu94pnhlk9j5qdsf2rubk06ho0; path=/; secure; HttpOnly
    last-modified: Tue, 17 Sep 2024 05:42:49 GMT
    x-robots-tag: noindex, nofollow
    content-type: text/html; charset=UTF-8
    date: Tue, 17 Sep 2024 05:42:49 GMT
    server: Apache
    ---

    WHERE IN HELL IS IT CACHING IT?
    Does roundcube maybe has its own ssl cache or header cache or something?
    I cannot think this out...
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Most likely, nothing is cached; you just have copies of the old cert. If not, everything is symlinked properly in your manual SSL certs setup. The certificate for postfix is normally the one from ISPConfig and not a website cert. You might want to compare your setup with the instructions from here to avoid cert renewal problems:

    https://www.howtoforge.com/securing...server-with-a-valid-lets-encrypt-certificate/
     

Share This Page