Home / server / Questions / 981732
Accepted
Codejoy
Asked: 2019-09-04 08:36:09 +0800 CST

apache does not see my new certs, still has expired certs

  • 772

In typing this question I found this:

Apache seems to be using old expired certificate even though new one is installed

His issue is mine to a T, and all things he tried more or less I did too. The difference was his was solved because he had nginx running. In my case I have no such reverse proxy server. So I just cannot get Apache to see the new certs I got using certbot (that was a whole other issue, certbot auto renew didn't work gave errors and so I did a certbot cert only apache and pointed appach ssl-certs in etc/httpd/extra to there.

Tried everything else like he did. Moved the folder the /etc/httpd/extra/ssl-certs and ssl-certs-proxy were pointing to to /tmp, and had those files point to the new .pem location:

SSLCertificateFile /etc/letsencrypt/live/www.apo.nmsu.edu/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.apo.nmsu.edu/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/www.apo.nmsu.edu/chain.pem
Include /etc/letsencrypt/options-ssl-apache.conf

cert.pem -> ../../archive/www.apo.nmsu.edu/cert2.pem
chain.pem -> ../../archive/www.apo.nmsu.edu/chain2.pem
fullchain.pem -> ../../archive/www.apo.nmsu.edu/fullchain2.pem
privkey.pem -> ../../archive/www.apo.nmsu.edu/privkey2.pem

Alas nothing, no change, websites still report the expired ticket. Which was in another folder /live/apo.nmsu.edu-0004 which I moved to tmp. So not sure how apache is still picking all that up.

Did an apachectl stop apachectl start and even a restart and also reset the vm this is all running on.

Same issues. Completely out of ideas, even checked using openssl the new .pem files and they do expire correctly in 90 days (they are from letsencrypt).

also:

[root@web-server extra]# apachectl -v
Server version: Apache/2.4.6 (Scientific Linux)
Server built:   Jul 29 2019 10:53:12
apache-2.4

1 Answers

  1. Best Answer

    I guess you should check what certificates you have in the files pointed to in your Apache configuration, especially that you seem to have some symbolic links involved.

    The command:

    # openssl x509 -noout -text -in <path to cert file from config>

    or

    # openssl x509 -noout -startdate -enddate -in <path to cert file from config>

    should be helpfull. Please make sure certificate dates are as you would expect.

    • 1