Certbot created new certificates but browsers see old one

[bruncsak]

Please provide the output of the following command:
ls -l /etc/httpd/conf*/*.conf

[rg305]

I bet it’s only the same two files.

[and the unrelated entries in the /etc/httpd/conf.modules.d/ folder]
(if any - like:)

/etc/httpd/conf.modules.d/00-base.conf
/etc/httpd/conf.modules.d/00-dav.conf
/etc/httpd/conf.modules.d/00-lua.conf
/etc/httpd/conf.modules.d/00-mpm.conf
/etc/httpd/conf.modules.d/00-proxy.conf
/etc/httpd/conf.modules.d/00-ssl.conf
/etc/httpd/conf.modules.d/00-systemd.conf
/etc/httpd/conf.modules.d/01-cgi.conf

[bruncsak]

Hopefully, yes, that must be.

[mitwess]

[rg305]

Oh oh!
new player in the game - lol “Feb 19 2018”:
/etc/httpd/conf.d/welcome.conf

Can we see what that is doing or NOT doing?

Ok let’s not assume anything and check the PHP.CONF file too!

According to this:
ServerRoot "/etc/httpd"
Include conf.d/*.conf
they will be included.

[rg305]

cat /etc/httpd/conf.d/welcome.conf

#
# This configuration file enables the default "Welcome" page if there
# is no default index page present for the root URL.  To disable the
# Welcome page, comment out all the lines below.
#
# NOTE: if this file is removed, it will be restored on upgrades.
#
<LocationMatch "^/+$">
    Options -Indexes
    ErrorDocument 403 /.noindex.html
</LocationMatch>

<Directory /usr/share/httpd/noindex>
    AllowOverride None
    Require all granted
</Directory>

Alias /.noindex.html /usr/share/httpd/noindex/index.html
Alias /noindex/css/bootstrap.min.css /usr/share/httpd/noindex/css/bootstrap.min.css
Alias /noindex/css/open-sans.css /usr/share/httpd/noindex/css/open-sans.css
Alias /images/apache_pb.gif /usr/share/httpd/noindex/images/apache_pb.gif
Alias /images/poweredby.png /usr/share/httpd/noindex/images/poweredby.png

[rg305]

And now the the really important stuff:
[You have a cert but the site security is non-existent]
"This server is vulnerable to the POODLE attack"
"This server accepts RC4 cipher"
https://www.ssllabs.com/ssltest/analyze.html?d=similarminds.com

[mitwess]

thanks for the heads up, fixed everything except forward secrecy. how important is that to fix/address?

[rg305]

@mitwess

how important is that to fix/address?

Important and easy to fix too.
But the exact "fix" depends on your systems output of:
openssl version
openssl ciphers