ISPConfig interface blocked after activation of "Skip lets encrypt check" oprions.

Discussion in 'ISPConfig 3 Priority Support' started by christian.perego, May 2, 2020.

  1. christian.perego

    christian.perego Member HowtoForge Supporter

    I put a check at the option: System / Server config / Tab WEB / SSLsettings / Skip lets encrypt check.
    Since I did it all my HTTPS site are blocked and I can't access the IspConfig interface anymore (403 Forbidden), so my server is completly down.
    I do not have "lets encrypt" installed on my system. On this system I have Debian 8 and ISPConfig 3.1.15p3
    What can I do? How can I disable that function without the web interface?
    Thanks a lot.
    Christian
     
    Last edited: May 2, 2020
    christian.perego, May 2, 2020
    #1
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    Your system is not blocked because you enabled that option. Your system is blocked because the SSL check which you disabled now prevented in the past that SSL gets enabled in a site where LE refused to issue a cert, by enabling that option (which disables the check) you forced ISPConfig to enable LE in that site anyway without checking the cert and this caused your system to go down.

    So the solution is not to disable that function again. The solution is that you must find the website where you enabled LE and SSL without LE being able to issue a cert and then disable that site in the apache or Nginx sites-enabled folder and restart the web server. It's probably the site for which you disabled that function because you believed the function caused the issue but indeed, the function just prevented before that your system goes down.
     
    till, May 2, 2020
    #2
  3. christian.perego

    christian.perego Member HowtoForge Supporter

    I'm sorry could you explain better this solution:
    ".....The solution is that you must find the website where you enabled LE and SSL without LE being able to issue a cert and then disable that site in the apache or Nginx sites-enabled folder and restart the web server."
    Do I have to delete the sym link from the apache2 site-enabled directory for the sites where I try to enable LE and SSL before checking the option:"System / Server config / Tab WEB / SSLsettings / Skip lets encrypt check"?
     
    christian.perego, May 2, 2020
    #3
  4. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes, delete the symlink and restart apache or nginx.
     
    till, May 2, 2020
    #4
  5. christian.perego

    christian.perego Member HowtoForge Supporter

    Ok, but it didn't solve my problem. But I thank you very much because you put me to the right way to understand it. The problem was that ALL "Order" directives in the configuration files (the ISPCONFIG config and vhost too) of any sites hosted under apache2 was changed to "Require all granted" blocking the access to the sites. I put manually "Order allow,deny" and "Allow from all" where necessary and everything started again.
    Probably this issue is due to my apache2 version that do not understand the new keys that ISPCONFIG uses to apply configurations to the server.
    Thanks a lot for you precious help. I will suggest my customer (I'm just a consultant) to plan a new fresh installation for this server ASAP ;)
     
    Last edited: May 2, 2020
    christian.perego, May 2, 2020
    #5
  6. till

    till Super Moderator Staff Member ISPConfig Developer

    ISPConfig chooses the config syntax based on the apache version, if apache is newer than 2.2, then Require all granted is used. If this causes any issues on the system of your customer, then he must have missed migrating some config files outside of ISPConfig to the new syntax because when you add a deny in old syntax outside of ispconfig, then the new grant syntax can not grant access again. So instead of changing the ispconfig vhost files, better adjust the remaining files to match the syntax requirements of the installed apache version.
     
    till, May 2, 2020
    #6
  7. christian.perego

    christian.perego Member HowtoForge Supporter

    Ok. Thank you for your help! I'll adjust the missed apache2 config options according the apache version. Thanks a lot!
     
    christian.perego, May 2, 2020
    #7

Share This Page