Domain: rejushiiplotter.ru
Command: ./certbot-auto run
Output:
/root/.local/share/letsencrypt/lib/python2.6/site-packages/cryptography/init.py:26: DeprecationWarning: Python 2.6 is no longer supported by the Python core team, please upgrade your Python. A future version of cryptography will drop support for Python 2.6
DeprecationWarning
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Which names would you like to activate HTTPS for?
…
Obtaining a new certificate
/root/.local/share/letsencrypt/lib/python2.6/site-packages/acme/jose/jwa.py:110: DeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead.
signer = key.signer(self.padding, self.hash)
Performing the following challenges:
tls-sni-01 challenge for rejushiiplotter.ru
Waiting for verification…
Cleaning up challenges
Failed authorization procedure. rejushiiplotter.ru (tls-sni-01): urn:acme:error:malformed :: The request message was malformed :: Server only speaks HTTP, not TLS
IMPORTANT NOTES:
The following errors were reported by the server:
Domain: rejushiiplotter.ru
Type: malformed
Detail: Server only speaks HTTP, not TLS
To fix these errors, please make sure that you did not provide any
invalid information to the client, and try running Certbot again.
OS: centos-release-6-9.el6.12.3.x86_64
Server version: Apache/2.2.15 (Unix)
netstat -nlp shows that the only service that uses 443 is httpd. ssh uses another port.
And that part with
"Failed authorization procedure. rejushiiplotter.ru (tls-sni-01): urn:acme:error:malformed :: The request message was malformed :: Server only speaks HTTP, not TLS"
is already solved. At least I do not receive any warnings and everything looks OK. The site just won't open.
If it's smth that I must setup in apache config, please, tell me what it is. I've tried a lot of variants already.
About 80% of the time, this is a result of having a different Apache configuration file (not the one related to your Let's Encrypt certificate) that tells Apache to listen on port 443, but does not include the SSLEngine and other TLS-related directives.
I would suggest checking with
grep -r 443 /etc/apache2
to see if you can find an inappropriate non-HTTPS-related configuration listening to port 443.
This issue has been solved yesterday. At least I receive no warnings on that.
Yes, mod_ssl is installed and loaded by Apache. phpinfo() and httpd -M |grep ssl_module report it.
As for 443: grep -r 443 /etc/httpd shows that Listen 443 is only added in ssl.conf.
Here's the full result:
Yes. One of our subdomains.
But the cert was intended not for this domain but for rejushiiplotter.ru and I can’t find any traces for this subdomain in apache confs.
How can I make certificate for this domain with cerbot? And thank you.
The port is open netstat -tulpn tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1023/httpd tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 1023/httpd
and iptables is set.
OK, stuck. Donno what else to do.
It looks like you’re stlil getting HTTP instead of HTTPS on port 443.
While I don’t see anything immediately wrong with your ssl.conf, I wonder if you could first look in your Apache error log to see if Apache encountered any errors in parsing it, and in any case temporarily disable its use by causing it not to be included, to see if that clears up the problem somehow.
