Cert stopped working

Help
#1

My SSL stopped working all of a sudden today for my secure websocket server
The HTTPS server seems fine/
Clicking on the cert lock icon in Chrome shows that it expires 4/19/21
I renewed it today, it still shows that renewal

I reference the certs in the nodeJS server like this:

const server = https.createServer({
            cert: fs.readFileSync("/opt/bitnami/apache2/conf/server.crt"),
            key: fs.readFileSync("/opt/bitnami/apache2/conf/server.key")
            });

It looks like those two files are updated on the server (they have today's date)

My domain is: etal.live
My web server is (include version): Apache
The operating system my web server runs on is (include version): Debian/GNU Linux
My hosting provider, if applicable, is: AWS Lightsail
I can login to a root shell on my machine (yes or no, or I don't know): Yes
I'm using a control panel to manage my site (no, or provide the name and version of the control panel): No
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): apt-cache policy certbot | grep Installed

#2

Hi @Bferster

what's your wss port? https works, the certificate is ~~ one month old.

Did you restart your server?

1 Like
#3

Yes.
I rebuilt the site completely and installed a new cert, which seems to be working now
It seems I don't have permissions to load the crt & key files and now get this error from nodeJs:

Error: EACCES: permission denied, open '/opt/bitnami/apache/conf/server.crt'
#4

The WS port is located at 8080

#5

Fix it, that can't work.

#6

I hate to sound desperate, but I not sure how to fix it.

#7

You might want to look at a tutorial about Unix file permissions and ownership like

https://www.tutorialspoint.com/unix/unix-file-permission.htm

(that was just the first DuckDuckGo result for unix file permissions at DuckDuckGo).

A related question is what software is creating these files.

1 Like
#8

Thanks for the links.
I was able to change permissions,
but is it ok from Certbot's point of view to open this file:

/etc/letsencrypt/live/etal.live/privkey.pem

or does it need to be restricted so you can update it?

#9

You might find that newly-renewed certificates are automatically given more-restrictive permissions by Certbot again. One option to change this is with a custom --deploy-hook script. (Or you could use Bitnami's tutorial, which I think is based on lego instead of Certbot.)

1 Like