PHP Application SSL Issue with EKS

Help
1

Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.

My domain is: temp.mevofit.com

I ran this command: Setup SSL with K8s Setup

It produced this output:

image
image1343×369 40.2 KB

My web server is (include version): Nginx

The operating system my web server runs on is (include version): AWS EKS

2

When we are using AWS ACM Certificate, there is no Issue but only if we are using letsencrypt

4

Hi @Muthiah131998, and welcome to the LE community forum :slight_smile:

Are both certs of the same type [RSA]?
What version of OpenSSL is that?

2 Likes
5

@rg305 How I can confirm ,Is there any way to check that?
image

6

image

7

You're trying to connect to secureservice.mevofit.com. That hostname does NOT provide a Let's Encrypt certificate, but is presenting a self-signed "Kubernetes Ingress Controller Fake Certificate" cert. At least, when I used an online tool https://ssltool.com/index.php?action=sslCheckRawCertsOpenSSL. My browser seems to connect just fine. Maybe PHP doesn't support SNI? Does PHP provide more debugging information somehow? Which PHP version are we talking about anyway? Maybe your PHP can't deal with the "long chain"?

3 Likes
8

Hello @Osiris Thankyou for your Reply..
image
Actually we tried AWS LB with ACM Certificate , there is no issue from application side, but when we Integrating with LetsEncrypt , getting this Issue
image

9

Can you explain more about this? And, why is the ACM cert in ELB not suitable?

Because I see requests to mevofit.com using an Amazon cert (the Load Balancer).

Requests to domain secureservice.mevofit.com are using a Let's Encrypt cert but it is not the wildcard you just showed. It just has that explicit name in it.

Requests to domain test.mevofit.com are using that Let's Encrypt wildcard cert

On the machine you are running that php app, what does this do

curl -v https://secureservice.mevofit.com
3 Likes
10

Hi @MikeMcQ We tried that approach we dont need LB for this Application so thats why we setup letsencrypt Setup [13:45] Karamjit Singh

when cakephp code try to send any curl request from temp.mevofit.com to secureservice.mevofit.com we got openssl issue

image
image731×545 51.1 KB

image
image657×516 40.8 KB

11

The curl request looks fine. So, is it only the php request that fails? Might need to check how php http requests are configured.

See if any php fopen works even to https://google.com

3 Likes
12

Hello, Once we Updated Cakephp Code to latest version ,issue was resolved

Thankyou for your Respsone, it was really helpful for this issue

3 Likes
13

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.