Choose redirect http to https but its not working

nastypasty · October 11, 2018, 10:47am

Hey guys,

I have a problem with my certificates I generated on my server. My server runs on Centos 7 with apache. I downloaded letsencrypt and generated certificates for cnews.at and www.cnews.at everything worked fine. The problem now is I can reach my site with http and it says site is not safe!
I hope someone can help me to get this to work

Best

rg305 · October 11, 2018, 10:51am

The cert is not for both names:
https://cnews.at/
https://www.cnews.at/
only the second name is included in the cert.
https://www.ssllabs.com/ssltest/analyze.html?d=www.cnews.at
https://www.ssllabs.com/ssltest/analyze.html?d=cnews.at

nastypasty · October 11, 2018, 10:53am

But I generated the certificate for both? What I have to do now?

rg305 · October 11, 2018, 10:53am

Please show the command you used to generate the cert for both names.

nastypasty · October 11, 2018, 11:55am

I dont understand have choosen the option to redirect every http request to https?

Edit: Command was

./letsencrypt-auto --apache -d www.cnews.at -d cnews.at

When I now try to do that I get an exception

too many certificates already issued for exact set of domains: cnews.at,www.cnews.at: see https://letsencrypt.org/docs/rate-limits/

Is it maybe possible to do it with two commands? Like so:

./letsencrypt-auto --apache -d www.cnews.at
./letsencrypt-auto --apache  -d cnews.at

rg305 · October 11, 2018, 12:28pm

Two commands will create two separate certs - so no to that.

Please show:
./letsencrypt-auto --version
./letsencrypt-auto certificates

Several certs have recently been issued…
at least one cert was issued covering both names: https://crt.sh/?id=836811514

nastypasty · October 11, 2018, 12:48pm

./letsencrypt-auto --version
certbot 0.27.1

./letsencrypt-auto certificates
Found the following certs:
Certificate Name: cnews.at
Domains: cnews.at
Expiry Date: 2019-01-09 07:02:45+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/cnews.at/fullchain.pem
Private Key Path: /etc/letsencrypt/live/cnews.at/privkey.pem
Certificate Name: www.cnews.at
Domains: www.cnews.at
Expiry Date: 2019-01-08 21:02:51+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/www.cnews.at/fullchain.pem
Private Key Path: /etc/letsencrypt/live/www.cnews.at/privkey.pem

rg305 · October 11, 2018, 1:25pm

Please show the current public certs stored in:
/etc/letsencrypt/live/cnews.at/cert.pem
/etc/letsencrypt/live/www.cnews.at/cert.pem

and also show directory listings of any saved/previous certs with:
ls -l /etc/letsencrypt/archive/cnews.at/
ls -l /etc/letsencrypt/archive/www.cnews.at/

nastypasty · October 11, 2018, 1:48pm

cnews.at

www.cnews.at

Directory listings

cnews.at

cert1.pem  cert3.pem   chain2.pem  fullchain1.pem  fullchain3.pem  privkey2.pem
cert2.pem  chain1.pem  chain3.pem  fullchain2.pem  privkey1.pem    privkey3.pem

www.cnews.at

cert1.pem  chain1.pem  fullchain1.pem  privkey1.pem

nastypasty · October 11, 2018, 3:02pm

cnews.at

-rw-r--r-- 1 root root 2130 Oct 10 23:53 cert1.pem
-rw-r--r-- 1 root root 2134 Oct 11 00:16 cert2.pem
-rw-r--r-- 1 root root 2134 Oct 11 10:02 cert3.pem
-rw-r--r-- 1 root root 1647 Oct 10 23:53 chain1.pem
-rw-r--r-- 1 root root 1647 Oct 11 00:16 chain2.pem
-rw-r--r-- 1 root root 1647 Oct 11 10:02 chain3.pem
-rw-r--r-- 1 root root 3777 Oct 10 23:53 fullchain1.pem
-rw-r--r-- 1 root root 3781 Oct 11 00:16 fullchain2.pem
-rw-r--r-- 1 root root 3781 Oct 11 10:02 fullchain3.pem
-rw-r--r-- 1 root root 1704 Oct 10 23:53 privkey1.pem
-rw-r--r-- 1 root root 1708 Oct 11 00:16 privkey2.pem
-rw-r--r-- 1 root root 1704 Oct 11 10:02 privkey3.pem

www.cnews.at

-rw-r--r-- 1 root root 2147 Oct 11 00:02 cert1.pem
-rw-r--r-- 1 root root 1647 Oct 11 00:02 chain1.pem
-rw-r--r-- 1 root root 3794 Oct 11 00:02 fullchain1.pem
-rw-r--r-- 1 root root 1704 Oct 11 00:02 privkey1.pem

nastypasty · October 11, 2018, 6:30pm

No one an idea what I can do?

JuergenAuer · October 11, 2018, 6:38pm

Hi @nastypasty

you have a lot of certificates created, some with one domain name, some with two.

https://transparencyreport.google.com/https/certificates?cert_search_auth=&cert_search_cert=p:Y25ld3MuYXQ6ZmFsc2U6ZmFsc2U6OkVBRT0&cert_search=include_expired:false;include_subdomains:false;domain:cnews.at&lu=cert_search_cert

Between 2018-10-08 and today.

Where are these certificates? Certbot certificates (or letsencrypt or letsencrypt-auto or certbot-auto) should list the certificates.

nastypasty · October 11, 2018, 6:53pm

Dont know where they are if I use command Certbot certificates or letsencrypt-auto I get
command not found ? Is there any other way to check where my certs are? Sorry but I am new to letsencrypt. Should I remove everything and do a new installation of all?

JuergenAuer · October 11, 2018, 7:07pm

That doesn't reset your rate limit, same with certificate revoking.

So you have to wait a few days to create one certificate with both domain names, then use this.

nastypasty · October 11, 2018, 7:09pm

Ok thank you

rg305 · October 12, 2018, 2:56am

Please show:
/etc/letsencrypt/archive/cnews.at/cert2.pem
/etc/letsencrypt/archive/cnews.at/cert3.pem

…maybe one of those has both names in it…

nastypasty · October 12, 2018, 1:19pm

rg305 · October 12, 2018, 8:40pm

Both of those also only have one name in them.

nastypasty · October 15, 2018, 4:30pm

I ran this command ./letsencrypt-auto --apache -d cnews.at -d www.cnews.at again. Everything went smooth, but if I request http://cnews.at the site is not secured by https. Someone can help me again please I really need it it.

rg305 · October 15, 2018, 4:45pm

When you say “Everything went smooth”, did it actually say “Congratulations! …”?
Can you show the log file?