[SOLVED] Error restarting apache after upgrade due to cert/key mismatch AH02565

Discussion in 'General' started by StefanoBertoli, Jan 5, 2022.

  1. Trying to force ispconfig_upgrade to resolve problem wont work

    I have no way to make apache start and only error log i see is in the main domain (the one where ispconfig interface reply)

    Cheched if key and certificate match and it does

    [email protected]:~# openssl rsa -in /etc/letsencrypt/live/hocus-02.example.com/privkey.pem -noout -modulus
    Modulus=D50AE20C9FD3D182FB4FC3B5AF8682F609D5A9873E33A299D756649D5FD6761918405EC965A45DC829A0AEE3E34F10E09461DCE1710F9969365AD3369217CB0F364073A9E1132DC13FE715FB8F32E86A9964D085C18CFE0A1A7EFA68FE1C0D039544B4B8701158AE2C6F30A06A04FA2FB39B1A40EEA34BA1E7A00BAA2EB4DC10CB88CBE81AB69183F01FECBFE17C9C26588C1EB7E4D975AE0850640AE4BF3C637BBE347D987633DA3B072C7B05A08AB5ABFEDBAD253D1155F708F64F21D8F5617833BB1E6417ED9C3DFC9ED14FC5ED02447CA4502B5A39BB873E2982021CE9E00AAB0016F8533E18E99511A7F397631D0B780B2D41CE227796E918E86308A8C661A82C669F8DC461A0D9A13C5ED30A66F60D519E858168D70382196D5C264B1B56AA278102314DF52480D1F016FC19B77789C1DB919D071179D4CBD5F29B8330C5934DC61F9E5F7B9310038D9CD8550B8D7784FB6AAF8FE53958F895F5E5C4CD873D6BDC65AF2364F36126F4034A3E3311F5AE991D6FF3ED4B5786682858A0E046D7EDB19F60C3E72BACB25CEB8B486A7B0EBAD1775070BCCEAE06B98F0AD4980ACCE8187768B95F9F8EE90A11EE9B8B6DB14CAEC335C1E95600C11D68703C9E23DA0D48630C1C26AE5B1132C0B972F2BB6B13C479578B502E8445C0380277292F4F529117492C9AD4DF3ACE964B2A95BE0BAFFF3C4193A77993FBF55CEA7023
    [email protected]:~# openssl x509 -in /etc/letsencrypt/live/hocus-02.example.com/cert.pem -noout -modulus
    Modulus=D50AE20C9FD3D182FB4FC3B5AF8682F609D5A9873E33A299D756649D5FD6761918405EC965A45DC829A0AEE3E34F10E09461DCE1710F9969365AD3369217CB0F364073A9E1132DC13FE715FB8F32E86A9964D085C18CFE0A1A7EFA68FE1C0D039544B4B8701158AE2C6F30A06A04FA2FB39B1A40EEA34BA1E7A00BAA2EB4DC10CB88CBE81AB69183F01FECBFE17C9C26588C1EB7E4D975AE0850640AE4BF3C637BBE347D987633DA3B072C7B05A08AB5ABFEDBAD253D1155F708F64F21D8F5617833BB1E6417ED9C3DFC9ED14FC5ED02447CA4502B5A39BB873E2982021CE9E00AAB0016F8533E18E99511A7F397631D0B780B2D41CE227796E918E86308A8C661A82C669F8DC461A0D9A13C5ED30A66F60D519E858168D70382196D5C264B1B56AA278102314DF52480D1F016FC19B77789C1DB919D071179D4CBD5F29B8330C5934DC61F9E5F7B9310038D9CD8550B8D7784FB6AAF8FE53958F895F5E5C4CD873D6BDC65AF2364F36126F4034A3E3311F5AE991D6FF3ED4B5786682858A0E046D7EDB19F60C3E72BACB25CEB8B486A7B0EBAD1775070BCCEAE06B98F0AD4980ACCE8187768B95F9F8EE90A11EE9B8B6DB14CAEC335C1E95600C11D68703C9E23DA0D48630C1C26AE5B1132C0B972F2BB6B13C479578B502E8445C0380277292F4F529117492C9AD4DF3ACE964B2A95BE0BAFFF3C4193A77993FBF55CEA7023
    [email protected]:~# openssl x509 -in /etc/letsencrypt/live/hocus-02.example.com/chain.pem -noout -modulus
    Modulus=BB021528CCF6A094D30F12EC8D5592C3F882F199A67A4288A75D26AAB52BB9C54CB1AF8E6BF975C8A3D70F4794145535578C9EA8A23919F5823C42A94E6EF53BC32EDB8DC0B05CF35938E7EDCF69F05A0B1BBEC094242587FA3771B313E71CACE19BEFDBE43B45524596A9C153CE34C852EEB5AEED8FDE6070E2A554ABB66D0E97A540346B2BD3BC66EB66347CFA6B8B8F572999F830175DBA726FFB81C5ADD286583D17C7E709BBF12BF786DCC1DA715DD446E3CCAD25C188BC60677566B3F118F7A25CE653FF3A88B647A5FF1318EA9809773F9D53F9CF01E5F5A6701714AF63A4FF99B3939DDC53A706FE48851DA169AE2575BB13CC5203F5ED51A18BDB15
    [email protected]:~# openssl x509 -in /etc/letsencrypt/live/hocus-02.example.com/fullchain.pem -noout -modulus
    Modulus=A5F34916E6274D4896ECA503F64AC9C6291E0E7D0BE5CDD41CB197AD70178DDBAFC7820680DA80470C88B110600DE7650E0E64CBB461653CAD2A6EA83FB6AE4F47519551904D518BC7E46CD2B406E50597A49C754FB706434266851F11F087AEC81D88B8F6444B0B440EA8068AC830F3665DB0992C75E6BAFC3BE11FA90ADAA0100321041D8681519566B7DA4CF5064C43153451C2D7D33D21412008622D04A7FD5C818A9DA9B9EE483D6F359A624B8A51B640356FC1851D11712CA0FFE09EDB8FCF81EFAF5B48099A77D854EEDAB0E01A7D53893EE2251928855C3211521E11EA8F05366835065B7CFABFA357CC82944774FC1CCE005BD19736F52A24352E3D12F5E3E24011E25176924BC3B90A9288AE587678919A07459C514AE3A13BDF0C9D2C50CA22BAB67433545E8FBFC7AEE34715B872126D2B4826291540D60420C2446140A9E2FCEE3916AF72C39DBFDF1459058F4C124BF8D1FE79E529A82E5E85ACCED661CDDEFA7DBF41090FBFCBBE36F1CC187CDE9F2CC3FCD001F5A7A20BAE7BE279AD4420F2751DBAD3DCAB4C47A2C0824783B3F828836B1246BCF59AA40E790485EF1DC914429A46F488C1A16BA50EA1218338E4FD2E4AB2F09ECD63F4556C5D5DFFE752409A5280E4273C88C22BFF4E66B46D670436ACA9CAE7F1B314BD62EF4E86B32B08BE5DAC23FBD30455FEC0F8C9D9DAAFB5BE13789D785F5BBDE7

    The error I get is:
    [Wed Jan 05 14:04:07.422663 2022] [ssl:emerg] [pid 3269] AH02565: Certificate and private key hocus-02.example.com:443:0 from /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.crt and /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.key do not match

    Thanks for any idea on it
     
  2. the .vhost file section:
    <IfModule mod_ssl.c>
    SSLEngine on
    SSLProtocol All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
    # SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES$
    SSLHonorCipherOrder on
    # <IfModule mod_headers.c>
    # Header always add Strict-Transport-Security "max-age=15768000"
    # </IfModule>
    SSLCertificateFile /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.crt
    SSLCertificateKeyFile /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.key
    SSLUseStapling on
    SSLStaplingResponderTimeout 5
    SSLStaplingReturnResponderErrors off
    </IfModule>
     
  3. Th0m

    Th0m ISPConfig Developer Staff Member ISPConfig Developer

    @Croydon wrote a script to find the real problem:
    To start the script, run the following command as root user on your server:
    Code:
    curl https://gitplace.net/pixcept/ispconfig-tools/-/raw/stable/cert_check.sh | sh
    Share the output here in code blocks please (insert -> code).
     
  4. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    What does this return:
    Code:
    ls -l /var/www/clients/client0/web1/ssl/
    ls -l /etc/letsencrypt/*/hocus-02.example.com
    ls -l /usr/local/ispconfig/interface/ssl/
    
     
  5. Code:
    Checking /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.crt OK
    Checking /var/www/clients/client0/web1/ssl/hocus-02.example.com-le.key OK
    Checking that key and certificate match FAILED!
    All the others vhost are ok
     
  6. Maybe something... look at the date of the element 23... chain and fullchain have 10 december, cert and key have 4 january

    Looks strange, any idea to solve it?

    Code:
    -rw-r--r-- 1 root root 2277 ott 19  2019 cert10.pem
    -rw-r--r-- 1 root root 2277 dic 19  2019 cert11.pem
    -rw-r--r-- 1 root root 2277 feb 17  2020 cert12.pem
    -rw-r--r-- 1 root root 2277 apr 17  2020 cert13.pem
    -rw-r--r-- 1 root root 2277 giu 16  2020 cert14.pem
    -rw-r--r-- 1 root root 2277 ago 15  2020 cert15.pem
    -rw-r--r-- 1 root root 2277 ott 14  2020 cert16.pem
    -rw-r--r-- 1 root root 2208 dic 14  2020 cert17.pem
    -rw-r--r-- 1 root root 2208 feb 12  2021 cert18.pem
    -rw-r--r-- 1 root root 2208 apr 13  2021 cert19.pem
    -rw-r--r-- 1 root root 2516 apr 27  2018 cert1.pem
    -rw-r--r-- 1 root root 2208 giu 12  2021 cert20.pem
    -rw-r--r-- 1 root root 2208 ago 11 21:44 cert21.pem
    -rw-r--r-- 1 root root 2208 ott 11 03:00 cert22.pem
    -rw-r--r-- 1 root root 1923 gen  4 17:00 cert23.pem
    -rw-r--r-- 1 root root 2520 giu 26  2018 cert2.pem
    -rw-r--r-- 1 root root 2516 ago 25  2018 cert3.pem
    -rw-r--r-- 1 root root 2516 ott 24  2018 cert4.pem
    -rw-r--r-- 1 root root 2277 dic 23  2018 cert5.pem
    -rw-r--r-- 1 root root 2277 feb 21  2019 cert6.pem
    -rw-r--r-- 1 root root 2277 apr 22  2019 cert7.pem
    -rw-r--r-- 1 root root 2277 giu 21  2019 cert8.pem
    -rw-r--r-- 1 root root 2273 ago 20  2019 cert9.pem
    -rw-r--r-- 1 root root 1647 ott 19  2019 chain10.pem
    -rw-r--r-- 1 root root 1647 dic 19  2019 chain11.pem
    -rw-r--r-- 1 root root 1647 feb 17  2020 chain12.pem
    -rw-r--r-- 1 root root 1647 apr 17  2020 chain13.pem
    -rw-r--r-- 1 root root 1647 giu 16  2020 chain14.pem
    -rw-r--r-- 1 root root 1647 ago 15  2020 chain15.pem
    -rw-r--r-- 1 root root 1647 ott 14  2020 chain16.pem
    -rw-r--r-- 1 root root 1586 dic 14  2020 chain17.pem
    -rw-r--r-- 1 root root 1586 feb 12  2021 chain18.pem
    -rw-r--r-- 1 root root 1586 apr 13  2021 chain19.pem
    -rw-r--r-- 1 root root 1647 apr 27  2018 chain1.pem
    -rw-r--r-- 1 root root 3750 giu 12  2021 chain20.pem
    -rw-r--r-- 1 root root 3750 ago 11 21:44 chain21.pem
    -rw-r--r-- 1 root root 3750 ott 11 03:00 chain22.pem
    -rw-r--r-- 1 root root 3750 dic 10 03:00 chain23.pem
    -rw-r--r-- 1 root root 1647 giu 26  2018 chain2.pem
    -rw-r--r-- 1 root root 1647 ago 25  2018 chain3.pem
    -rw-r--r-- 1 root root 1647 ott 24  2018 chain4.pem
    -rw-r--r-- 1 root root 1647 dic 23  2018 chain5.pem
    -rw-r--r-- 1 root root 1647 feb 21  2019 chain6.pem
    -rw-r--r-- 1 root root 1647 apr 22  2019 chain7.pem
    -rw-r--r-- 1 root root 1647 giu 21  2019 chain8.pem
    -rw-r--r-- 1 root root 1647 ago 20  2019 chain9.pem
    -rw-r--r-- 1 root root 3924 ott 19  2019 fullchain10.pem
    -rw-r--r-- 1 root root 3924 dic 19  2019 fullchain11.pem
    -rw-r--r-- 1 root root 3924 feb 17  2020 fullchain12.pem
    -rw-r--r-- 1 root root 3924 apr 17  2020 fullchain13.pem
    -rw-r--r-- 1 root root 3924 giu 16  2020 fullchain14.pem
    -rw-r--r-- 1 root root 3924 ago 15  2020 fullchain15.pem
    -rw-r--r-- 1 root root 3924 ott 14  2020 fullchain16.pem
    -rw-r--r-- 1 root root 3794 dic 14  2020 fullchain17.pem
    -rw-r--r-- 1 root root 3794 feb 12  2021 fullchain18.pem
    -rw-r--r-- 1 root root 3794 apr 13  2021 fullchain19.pem
    -rw-r--r-- 1 root root 4163 apr 27  2018 fullchain1.pem
    -rw-r--r-- 1 root root 5958 giu 12  2021 fullchain20.pem
    -rw-r--r-- 1 root root 5958 ago 11 21:44 fullchain21.pem
    -rw-r--r-- 1 root root 5958 ott 11 03:00 fullchain22.pem
    -rw-r--r-- 1 root root 5958 dic 10 03:00 fullchain23.pem
    -rw-r--r-- 1 root root 4167 giu 26  2018 fullchain2.pem
    -rw-r--r-- 1 root root 4163 ago 25  2018 fullchain3.pem
    -rw-r--r-- 1 root root 4163 ott 24  2018 fullchain4.pem
    -rw-r--r-- 1 root root 3924 dic 23  2018 fullchain5.pem
    -rw-r--r-- 1 root root 3924 feb 21  2019 fullchain6.pem
    -rw-r--r-- 1 root root 3924 apr 22  2019 fullchain7.pem
    -rw-r--r-- 1 root root 3924 giu 21  2019 fullchain8.pem
    -rw-r--r-- 1 root root 3920 ago 20  2019 fullchain9.pem
    -rw-r--r-- 1 root root 3272 ott 19  2019 privkey10.pem
    -rw-r--r-- 1 root root 3272 dic 19  2019 privkey11.pem
    -rw-r--r-- 1 root root 3272 feb 17  2020 privkey12.pem
    -rw-r--r-- 1 root root 3272 apr 17  2020 privkey13.pem
    -rw-r--r-- 1 root root 3272 giu 16  2020 privkey14.pem
    -rw-r--r-- 1 root root 3268 ago 15  2020 privkey15.pem
    -rw-r--r-- 1 root root 3268 ott 14  2020 privkey16.pem
    -rw-r--r-- 1 root root 3272 dic 14  2020 privkey17.pem
    -rw-r--r-- 1 root root 3272 feb 12  2021 privkey18.pem
    -rw-r--r-- 1 root root 3272 apr 13  2021 privkey19.pem
    -rw-r--r-- 1 root root 3272 apr 27  2018 privkey1.pem
    -rw-r--r-- 1 root root 3272 giu 12  2021 privkey20.pem
    -rw-r--r-- 1 root root 3272 ago 11 21:44 privkey21.pem
    -rw-r--r-- 1 root root 3272 ott 11 03:00 privkey22.pem
    -rw-r--r-- 1 root root 3272 gen  4 17:00 privkey23.pem
    -rw-r--r-- 1 root root 3268 giu 26  2018 privkey2.pem
    -rw-r--r-- 1 root root 3272 ago 25  2018 privkey3.pem
    -rw-r--r-- 1 root root 3272 ott 24  2018 privkey4.pem
    -rw-r--r-- 1 root root 3272 dic 23  2018 privkey5.pem
    -rw-r--r-- 1 root root 3272 feb 21  2019 privkey6.pem
    -rw-r--r-- 1 root root 3272 apr 22  2019 privkey7.pem
    -rw-r--r-- 1 root root 3272 giu 21  2019 privkey8.pem
    -rw-r--r-- 1 root root 3272 ago 20  2019 privkey9.pem
     
  7. Jesse Norell

    Jesse Norell ISPConfig Developer Staff Member ISPConfig Developer

    Perhaps some files got overwritten with an errant openssl command? I would either try to renew from cli (I think "certbot renew --cert-name hocus-02.example.com --force-renewal" to force), or disable LetsEncrypt on the site, manually delete the certificate, then enable again.
     
  8. Solved by moving the vhost certs archive folder, request new certificate and change symbolic links in live folder.
    Code:
    mv /etc/letsencrypt/archive/hocus-02.example.com /etc/letsencrypt/archive/hocus-02.example.com-bak
    
    certbot certonly .........
    
    mv /etc/letsencrypt/archive/hocus-02.example.com-0001 /etc/letsencrypt/archive/hocus-02.example.com
    
    cd /etc/letsencrypt/live/hocus-02.example.com/
    ls -sf ../../archive/hocus-02.example.com/cert1.pem cert.pem
    ls -sf ../../archive/hocus-02.example.com/chain1.pem chain.pem
    ls -sf ../../archive/hocus-02.example.com/fullchain1.pem fullchain.pem
    ls -sf ../../archive/hocus-02.example.com/privkey1.pem privkey.pem
    
    systemctl start apache2
     
    till likes this.

Share This Page