Let's Encrypt, Apache and Varnish - the right way?

Help
1

My domain is: wearesunday.com

I ran this command: sudo certbot --apache

It produced this output: (all good)

My web server is (include version): Apache 2.4.29

The operating system my web server runs on is (include version): Ubuntu 18.04.3

My hosting provider, if applicable, is: AWS

I can login to a root shell on my machine (yes or no, or I don’t know): yes

I’m using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you’re using Certbot): 0.31.0

Is there a recommended way to have Apache listening on 443 using a LE certificate, proxying to Varnish on port 80 and have that cache content it retrieves from Apache on port 8080?

We have this running, having initially (when setting up the server) generated the SSL certficate using certbot’s Apache plugin. However, now that Varnish is on port 80 certbot’s automated renewal doesn’t work. Does anyone know how I should have set this up so that the renewals do work?

2

Hi @tobym

that's not a general problem, but --apache can't work.

Your main configuration is good - https://check-your-website.server-daten.de/?q=wearesunday.com

Domainname Http-Status redirect Sec. G
• http://wearesunday.com/
54.171.138.166 301 https://wearesunday.com/ 0.073 A
• http://www.wearesunday.com/
54.171.138.166 301 https://www.wearesunday.com/ 0.074 A
• https://www.wearesunday.com/
54.171.138.166 301 https://wearesunday.com/ 3.307 N
Certificate error: RemoteCertificateNameMismatch
• https://wearesunday.com/
54.171.138.166 200 3.427 I
• http://wearesunday.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
54.171.138.166 301 https://wearesunday.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.077 A
Visible Content:
• http://www.wearesunday.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de
54.171.138.166 301 https://www.wearesunday.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 0.074 A
Visible Content:
• https://www.wearesunday.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 301 https://wearesunday.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 3.267 N
Certificate error: RemoteCertificateNameMismatch
Visible Content:
• https://wearesunday.com/.well-known/acme-challenge/check-your-website-dot-server-daten-dot-de 404 3.337 A
Not Found

http + /.well-known/acme-challenge is redirected to https, there is the expected result http status 404 - Not Found, that's good.

So find the webroot of your https vHost and use that.

certbot run -a webroot -i apache -w yourHttpsWebroot -d wearesunday.com -d www.wearesunday.com

Check

https://certbot.eff.org/docs/using.html

But your current certificate has only one domain name:

CN=wearesunday.com
	07.06.2019
	05.09.2019
expires in 3 days	wearesunday.com - 1 entry

So your defined www version isn't secure.

So create one certificate with both domain names.

PS: And you have some content errors:

srcset
https://wearesunday.com/wp-content/uploads/2015/02/Petplan-listimage.gif 273w, https://wearesunday.com/wp-content/uploads/2015/02/Petplan-listimage.gif 273w, https://wearesunday.com/wp-content/uploads/2015/02/Petplan-listimage.gif 273w

is wrong, one srcset attribute with more then one 273w. Every w definition must be unique.

3 Likes
3

That was disconcertingly easy - thanks very much, that certainly allowed me to renew the certificate (and apply it to the www subdomain)!

Would anything further need to be done to have automatic renewal work in the future?

Thanks again.

1 Like
4

What says

certbot certificates

You may have two certificates, the new you use and your old. You can delete the old (certbot delete certname). If your cron job uses renew, that should work.

Recheck your domain with the online tool in 60 - 70 days. Then you see if there is a new certificate created (CT-log part) and used (connection-part).

2 Likes
5

I only seem to have the new certificate - thanks for your help with this, I really appreciate it!

1 Like
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.