# Enhance redirect fails
**URL:** https://community.letsencrypt.org/t/enhance-redirect-fails/96504
**Category:** Help
**Created:** [June 25, 2019, 3:34am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504 "2019-06-25T03:34:29Z")
**Posts on this page:** 15
**Page:** 1
### Author:  [@rein](https://community.letsencrypt.org/u/rein)
#### Post date: [June 25, 2019, 3:34am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/1 "2019-06-25T03:34:29Z")
Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. [https://crt.sh/?q=example.com](https://crt.sh/?q=example.com)), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
My domain is: [reica.no-ip.org](http://reica.no-ip.org)
I ran this command:[https://reica.no-ip.org](https://reica.no-ip.org)
It produced this output: no output
My web server is (include version): apache2 version 2.4.29
The operating system my web server runs on is (include version): armhf ubuntu 18.04
My hosting provider, if applicable, is: localhost ([reica.no-ip.org](http://reica.no-ip.org))
I can login to a root shell on my machine (yes or no, or I don’t know): yes
I’m using a control panel to manage my site (no, or provide the name and version of the control panel): n/a
The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): 0.31.0-1
Installation of certificate all Ok
How do I set virtual host to respond to https ? [https://reica.no-ip.org](https://reica.no-ip.org) does not work. I tried “certbot enhance --redirect” but it failed.
Can anyone help?
BTW http works fine. Apache2 is working Ok.
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [June 25, 2019, 6:37am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/2 "2019-06-25T06:37:36Z")
Hi @rein
> [@rein](#):
>
> My domain is: [reica.no-ip.org](http://reica.no-ip.org)
>
> I ran this command:[https://reica.no-ip.org](https://reica.no-ip.org)
you have created two identical certificates ( [https://check-your-website.server-daten.de/?q=reica.no-ip.org#ct-logs](https://check-your-website.server-daten.de/?q=reica.no-ip.org#ct-logs) ):
| CertSpotter-Id | Issuer | not before | not after | Domain names | LE-Duplicate | next LE |
| --- | --- | --- | --- | --- | --- | --- |
| [984654465](https://check-your-website.server-daten.de/queries/q_get_certificatefile/certfile-certspotter-984654465.pem?certspotter_id=984654465) | CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US | 2019-06-24 21:14:18 | 2019-09-22 21:14:18 | [reica.no-ip.org](http://reica.no-ip.org) - 1 entries | duplicate nr. 2 | |
| [981181481](https://check-your-website.server-daten.de/queries/q_get_certificatefile/certfile-certspotter-981181481.pem?certspotter_id=981181481) | CN=Let's Encrypt Authority X3, O=Let's Encrypt, C=US | 2019-06-22 22:46:03 | 2019-09-20 22:46:03 | [reica.no-ip.org](http://reica.no-ip.org) - 1 entries | duplicate nr. 1 | |
So the certificate creation part has worked.
But your domain is invisible:
| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://reica.no-ip.org/](http://reica.no-ip.org/) | | | | |
| 120.154.158.177 | -14 | | 10.030 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [https://reica.no-ip.org/](https://reica.no-ip.org/) | | | | |
| 120.154.158.177 | -14 | | 10.027 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [http://reica.no-ip.org/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://reica.no-ip.org/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 120.154.158.177 | -14 | | 10.030 | T |
| Timeout - The operation has timed out | | | | |
| Visible Content: | | | | |
Only timeouts. Which command had you used to create these certificates?
What says
```nohighlight
certbot certificates
```
---
### Author:  [@rein](https://community.letsencrypt.org/u/rein)
#### Post date: [June 25, 2019, 8:04am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/3 "2019-06-25T08:04:02Z")
Hi Juergen. You may have tried [reica.no-ip.org](http://reica.no-ip.org) while it was off line while I was trying to solve the [problem. The cert with id 981181481 was lost and I started again on another SD card and a new certificate using certbot.
There must be a configuration problem somewhere that prevents the system to listen on port 443. I am not new to linux but not very savvy of ssl stuff. My site (family stuff, photos and family trees) has been running for years as an http site. I am trying to make it more secure with ssl encryption. Maybe you can give me a few pointers in the right direction to solve the problem.
---
### Author:  [@rein](https://community.letsencrypt.org/u/rein)
#### Post date: [June 25, 2019, 9:46pm UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/4 "2019-06-25T21:46:11Z")
sorry, forgot to answer your query:
root@reica:/etc/apache2# certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log
* * *
Found the following certs:
Certificate Name: [reica.no-ip.org](http://reica.no-ip.org)
Domains: [reica.no-ip.org](http://reica.no-ip.org)
Expiry Date: 2019-09-22 21:14:18+00:00 (VALID: 88 days)
Certificate Path: /etc/letsencrypt/live/reica.no-ip.org/fullchain.pem
Private Key Path: /etc/letsencrypt/live/reica.no-ip.org/privkey.pem
* * *
root@reica:/etc/apache2#
---
### Author:  [@rein](https://community.letsencrypt.org/u/rein)
#### Post date: [June 25, 2019, 11:53pm UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/5 "2019-06-25T23:53:01Z")
After certbot enhance --redirect (which now works!) I get the following after [http://reica.no-ip.org](http://reica.no-ip.org) :
# Bad Request
Your browser sent a request that this server could not understand.
Reason: You’re speaking plain HTTP to an SSL-enabled server port.
Instead use the HTTPS scheme to access this URL, please.
Apache/2.4.29 (Ubuntu) Server at [reica.no-ip.org](http://reica.no-ip.org) Port 443
[https://reica.no-ip.org](https://reica.no-ip.org) times out
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [June 26, 2019, 6:59am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/6 "2019-06-26T06:59:58Z")
> [@rein](#):
>
> Apache/2.4.29 (Ubuntu) Server at [reica.no-ip.org](http://reica.no-ip.org) Port 443
Yep, now you have done something wrong ( [https://check-your-website.server-daten.de/?q=reica.no-ip.org](https://check-your-website.server-daten.de/?q=reica.no-ip.org) ):
| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://reica.no-ip.org/](http://reica.no-ip.org/) | | | | |
| 120.154.158.177 | 400 | | 0.743 | M |
| Bad Request | | | | |
| | | | | |
| • [https://reica.no-ip.org/](https://reica.no-ip.org/) | | | | |
| 120.154.158.177 | -14 | | 10.023 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [https://reica.no-ip.org:80/](https://reica.no-ip.org:80/) | | | | |
| 120.154.158.177 | 200 | | 3.913 | Q |
| • [http://reica.no-ip.org/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de](http://reica.no-ip.org/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de) | | | | |
| 120.154.158.177 | 400 | | 0.750 | M |
| Bad Request | | | | |
| Visible Content: Bad Request Your browser sent a request that this server could not understand. Reason: You're speaking plain HTTP to an SSL-enabled server port. Instead use the HTTPS scheme to access this URL, please. Apache/2.4.29 (Ubuntu) Server at [reica.no-ip.org](http://reica.no-ip.org) Port 443 | | | | |
https + port 80 has the standard Apache page:
```nohighlight
Apache2 Ubuntu Default Page It works! This is the default welcome page used to test the correct operation of the Apache2 server after installation on Ubuntu systems.
```
Do you have a wrong port forwarding? Looks like you use
port 80 extern -\> port 443 intern, because the error message shows the port 443, but port 80 is connected.
Port forwarding always:
Port 80 extern -\> port 80 intern
Port 443 extern -\> port 443 intern
No port 443 rule -\> timeout.
---
### Author:  [@rein](https://community.letsencrypt.org/u/rein)
#### Post date: [June 26, 2019, 8:44am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/7 "2019-06-26T08:44:48Z")
Hi Juergen,
Yes, **[https://reica.no-ip.org:443](https://reica.no-ip.org:443)** works fine. But of course it should not be necessary to include the port.
I checked my NBN modem: port 80 / 80 and port 443 / 443 are forwarded for http and https .
I think the problem lies somewhere in apache2.conf or in the virtual host config files.
If it is of any value I could sent you these files to have a look at them. I am keen to get this sorted before I put back the contents of my website.
Kind regards,
Rein Mann
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [June 26, 2019, 9:47am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/8 "2019-06-26T09:47:35Z")
> [@rein](#):
>
> Yes, **[https://reica.no-ip.org:443](https://reica.no-ip.org:443)** works fine. But of course it should not be necessary to include the port.
Now your https works (without the port):
| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://reica.no-ip.org/](http://reica.no-ip.org/) | | | | |
| 120.154.158.177 | 400 | | 0.733 | M |
| Bad Request | | | | |
| | | | | |
| • [https://reica.no-ip.org/](https://reica.no-ip.org/) | | | | |
| 120.154.158.177 | 200 | | 3.666 | B |
| | | | | |
| • [https://reica.no-ip.org:80/](https://reica.no-ip.org:80/) | | | | |
| 120.154.158.177 | 200 | | 3.140 | Q |
But your http is wrong, port 80 sends https content, not http content.
Maybe a problem creating the next certificate. What says
```nohighlight
apachectl -S
```
---
### Author:  [@rein](https://community.letsencrypt.org/u/rein)
#### Post date: [June 26, 2019, 10:28am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/9 "2019-06-26T10:28:02Z")
root@reica:~# apache2ctl -S
VirtualHost configuration:
\*:443 [reica.no-ip.org](http://reica.no-ip.org) (/etc/apache2/sites-enabled/reica.no-ip.org-le-ssl.conf:2)
\*:80 is a NameVirtualHost
default server [reica.no-ip.org](http://reica.no-ip.org) (/etc/apache2/sites-enabled/reica.no-ip.org-le-ssl.conf:2)
port 80 namevhost [reica.no-ip.org](http://reica.no-ip.org) (/etc/apache2/sites-enabled/reica.no-ip.org-le-ssl.conf:2)
port 80 namevhost [reica.no-ip.org](http://reica.no-ip.org) (/etc/apache2/sites-enabled/reica.no-ip.org.conf:1)
ServerRoot: “/etc/apache2”
Main DocumentRoot: “/var/www/html”
Main ErrorLog: “/var/log/apache2/error.log”
Mutex default: dir="/var/run/apache2/" mechanism=default
Mutex mpm-accept: using\_defaults
Mutex watchdog-callback: using\_defaults
Mutex rewrite-map: using\_defaults
Mutex ssl-stapling-refresh: using\_defaults
Mutex ssl-stapling: using\_defaults
Mutex ssl-cache: using\_defaults
PidFile: “/var/run/apache2/apache2.pid”
Define: DUMP\_VHOSTS
Define: DUMP\_RUN\_CFG
User: name=“www-data” id=33
Group: name=“www-data” id=33
root@reica:~#
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [June 26, 2019, 1:24pm UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/10 "2019-06-26T13:24:38Z")
There you see the problem.
> [@rein](#):
>
> port 80 namevhost [reica.no-ip.org](http://reica.no-ip.org) (/etc/apache2/sites-enabled/reica.no-ip.org-le-ssl.conf:2)
> port 80 namevhost [reica.no-ip.org](http://reica.no-ip.org) (/etc/apache2/sites-enabled/reica.no-ip.org.conf:1)
You have two identical combinations port 80 and domain name, one is in your ssl-config file. Remove that entry.
Every combination of port and domain name should be unique.
---
### Author:  [@rein](https://community.letsencrypt.org/u/rein)
#### Post date: [June 27, 2019, 12:44am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/11 "2019-06-27T00:44:39Z")
Hi Juergen, Many thanks for your help ! Seems to work perfectly now.
The fault was indeed in reica’s SSL vhost config.
Was \
Now \
Kind regards,
Rein
---
### Author:  [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)
#### Post date: [June 27, 2019, 7:42am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/12 "2019-06-27T07:42:50Z")
> [@rein](#):
>
> Was \
Yep, that's bad. Then https is preferred, so the server sends https over port 80.
---
### Author:  [@rein](https://community.letsencrypt.org/u/rein)
#### Post date: [June 27, 2019, 10:57pm UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/13 "2019-06-27T22:57:44Z")
Juergen,
One more question: If I upgrade my OS, can I just lift out the ssl cert and key files and put them in the new system ? Or do I somehow have to renew the certificate ?
Rein.
---
### Author:  [@mnordhoff](https://community.letsencrypt.org/u/mnordhoff)
#### Post date: [June 28, 2019, 12:58am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/14 "2019-06-28T00:58:04Z")
You can just copy over `/etc/letsencrypt/` – taking care to use a way that preserves permissions and symlinks – and install Certbot.
But you should make sure everything is configured correctly and automatic renewal is working on the new server.
Starting over may be a good option, instead of copying everything and testing it. But it’s up to you.
---
### Author:  [@system](https://community.letsencrypt.org/u/system)
#### Post date: [July 28, 2019, 12:58am UTC](https://community.letsencrypt.org/t/enhance-redirect-fails/96504/15 "2019-07-28T00:58:22Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.