net::ERR_CERT_AUTHORITY_INVALID ( new certificate install )

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: bakerspercentage.com

I ran this command: Tried to pull up https://bakerspercentage.com

It produced this output:
This server could not prove that it is www.bakerspercentage.com ; its security certificate is not trusted by your computer's operating system. This may be caused by a misconfiguration or an attacker intercepting your connection.

My web server is (include version): Apache 2.4.62

The operating system my web server runs on is (include version): Debian 12 ( PHP 8 Bitnami image )

My hosting provider, if applicable, is: AWS lightsail

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): Certbot 2.1.0

Additional notes:
Previously there was another Let's Encrypt certificate for bakerspercentage.com running successfully on another AWS Lightsail instance that became completely unresponsive and that instance was destroyed. A new Lightsail instance was stood up for bakerspercentage.com and certbot was ran and all indications point to a successful cert being installed.

Tried running letdebug.net against the domain and it returned an OK response and nothing wrong.

Screenshot attached of "Show Certificate" from Safari. For some reason shows "example.com" (?!)

Hello @julianc, welcome to the Let's Encrypt community. :slightly_smiling_face:

Here is a list of issued certificates https://crt.sh/?q=bakerspercentage.com
However neither are serving any of those certificates

1 Like

Apparently, your Apache isn't configured properly. Unfortunately you didn't mention how Certbot was run when you got the new certificate.

Can you show the output of the command:

sudo apachectl -t -D DUMP_VHOSTS

Also, is your website supposed to say just "Howdy!"?

3 Likes

I just replaced the index.html page with one that was much more simple. ( Howdy! )

bitnami@ip-172-26-8-60:~/htdocs$ sudo apachectl -t -D DUMP_VHOSTS
VirtualHost configuration:
127.0.0.1:80 status.localhost (/opt/bitnami/apache/conf/vhosts/00_status-vhost.co
nf:1)
*:80 www.example.com (/opt/bitnami/apache/conf/bitnami/bitnami.conf:6)
*:443 www.example.com (/opt/bitnami/apache/conf/bitnami/bitnami-ssl.conf:1
5)

I think I'm starting tho see the issue here... Apache needs better config.

1 Like

You seem to be using Bitnami. Certbot usually doesn't work very well with Bitnami. What command did you use?

You might want to use a Bitnami specific method.

2 Likes

I am inclined to agree since this is my first time trying this with a bitnami image. Every other time, not a problem. If nothing else here I learned a lot about debugging this and I appreciate your and @Bruce5051 . I'll try this again using a method I've done before. Thanks so much again guys!

2 Likes

I think this is the current AWS docs for that. They have it as a "workflow" now: Launch and configure a WordPress instance on Lightsail - Amazon Lightsail

An earlier version recommended bncert with bitnami although also showed a Certbot method that required manual intervention for cert renewal: Secure your Lightsail WordPress instance with free Let's Encrypt SSL certificates - Amazon Lightsail

But, if you have a tried and true method that sounds good too :slight_smile:

2 Likes

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.