Since 01/15/23, I changed my server and move all the certificates from a 2012 MacMini to a 2020 M1 MacMini (±180).
I host apache 2.5.54 on a MacMini M1, all works but a Chrome issue (macOS/Windows) (and Firefox sometime on windows perhaps, not seen by myself)
When I type in Chrome the first letters of the domain, it takes the first certificate of the server instead of the good one and says NET::ERR_CERT_COMMON_NAME_INVALID. When I reload the page, it takes the good one ! Sometimes, I have to quit and relaunch Chrome 3 ou 4 times to see the error, sometimes it works well the first time On Windows, it seems to be systematic.
On macOS, i see that only on Chrome (never on Safari, Brave, Firefox, Edge, Opera on macOS)
As a workaround, I put all the certificates in the first one, it works but limited to 100 domains so certains as ophtalink.com continues to have the issue
I thank it was an issue of Apple Apache M1 or Certbot but I finally have the same issue in my old server intel too, on Homebrew Apache version too.
I śaw that Chrome update last day but the issue is still there.
All the website SSL checkers says domain security is OK and I don't find anything about this issue on the web
Yeah, I thought they use LibreSSL 2.8.3 (Apple). Guess that's why I didn't think macOS; my bad.
So 3.3.6 seem kind of newer; not as new as what OpenBSD uses.
Perhaps, I could use some better ssl software / library / version with homebrew ? I'm not a senior admin system so I don't know so much SSL mechanism, I thank it could be a server SSL cache issue but not much.
What do you think about when you reload the page, it works well and sometime on macOS, I have to relaunch 3 times chrome before seeing the issue ?
Other domains, as a workaround, I put maximum of certificates in the first one so Chrome works well, the issue is that it takes the first one instead the right one (1 times over 3 or 4) when I launch chrome
I would like to do the same with ophtalink.com but I reach the 100 limit of domains into a single certificate...
I follow the advice of Apache config generator but always the same issue
I had these lines in the main config
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:EC$
SSLHonorCipherOrder off
SSLSessionTickets off
SSLUseStapling On
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"
I remove these lines that are not in the config generator
#SSLSessionCache "dbm:/usr/local/apache/logs/ssl_gcache_data" #SSLSessionCache "shmcb:/usr/local/apache/logs/ssl_gcache_data(512000)" #SSLStrictSNIVHostCheck on #SSLVerifyDepth 10 #SSLOptions +StrictRequire
I remove from each vHost
#SSLProtocol all -SSLv2 -SSLv3 #SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:E$ #SSLHonorCipherOrder off #SSLCompression off
I noticed an internal error in letsencrypt.log but with no GUI notice :
2023-02-12 22:31:37,552:DEBUG:certbot_apache._internal.configurator:[Errno 2] No such file or directory: '/etc/apache2/libexec/apache2/mod_ssl.so'
Traceback (most recent call last):
File "/opt/homebrew/Cellar/certbot/2.2.0/libexec/lib/python3.11/site-packages/certbot_apache/_internal/configurator.py", line 297, in _open_module_file
with open(ssl_module_location, mode="rb") as f:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/etc/apache2/libexec/apache2/mod_ssl.so'
2023-02-12 22:31:37,554:WARNING:certbot_apache._internal.configurator:Unable to read ssl_module file; not disabling session tickets.
On Windows, it seems to be systematic.
