Problem updating ACME TLS-SNI-01 to alternative validation method

Help
41

My webapp in production runs fine (so far)
For example:
https://www.kreator.ch/carol/servlet/Main/TCDrizia

42

Please show:
top

1 Like
43

2525 www-data 20 0 849184 10348 5216 S 0.7 0.5 0:06.53 apache2
478 tomcat7 20 0 2027764 251612 16560 S 0.3 12.3 1:08.46 java
7335 root 20 0 25852 2876 2388 R 0.3 0.1 0:00.04 top
1 root 20 0 28612 4844 3048 S 0.0 0.2 0:01.05 systemd
2 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kthreadd
3 root 20 0 0 0 0 S 0.0 0.0 0:00.17 ksoftirqd/0
5 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kworker/0:0H
6 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kworker/u2:0
7 root 20 0 0 0 0 S 0.0 0.0 0:04.90 rcu_sched
8 root 20 0 0 0 0 S 0.0 0.0 0:00.00 rcu_bh
9 root rt 0 0 0 0 S 0.0 0.0 0:00.00 migration/0
10 root rt 0 0 0 0 S 0.0 0.0 0:00.04 watchdog/0
11 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 khelper
12 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kdevtmpfs
13 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 netns
14 root 20 0 0 0 0 S 0.0 0.0 0:00.00 xenwatch
15 root 20 0 0 0 0 S 0.0 0.0 0:00.00 xenbus
16 root 20 0 0 0 0 S 0.0 0.0 0:00.00 khungtaskd
17 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 writeback
18 root 25 5 0 0 0 S 0.0 0.0 0:00.00 ksmd
19 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 crypto
20 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kintegrityd
21 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 bioset
22 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kblockd
24 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kswapd0
25 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 vmstat
26 root 20 0 0 0 0 S 0.0 0.0 0:00.00 fsnotify_mark
32 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 kthrotld
33 root 20 0 0 0 0 S 0.0 0.0 0:00.00 khvcd
34 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 ipv6_addrconf
35 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 deferwq
36 root 20 0 0 0 0 S 0.0 0.0 0:00.10 kworker/u2:1
71 root 0 -20 0 0 0 S 0.0 0.0 0:00.21 kworker/0:1H
87 root 20 0 0 0 0 S 0.0 0.0 0:00.13 jbd2/xvda-8
88 root 0 -20 0 0 0 S 0.0 0.0 0:00.00 ext4-rsv-conver
122 root 20 0 0 0 0 S 0.0 0.0 0:00.00 kauditd
130 root 20 0 29900 2992 2696 S 0.0 0.1 0:00.18 systemd-journal
134 root 20 0 40816 3220 2684 S 0.0 0.2 0:00.04 systemd-udevd
229 root 16 -4 48320 3008 2628 S 0.0 0.1 0:00.02 auditd
377 root 20 0 55188 5196 4528 S 0.0 0.3 0:00.01 sshd
378 daemon 20 0 19024 1760 1588 S 0.0 0.1 0:00.00 atd
380 root 20 0 27592 2648 2356 S 0.0 0.1 0:00.03 cron
382 root 20 0 28268 2976 2656 S 0.0 0.1 0:00.03 systemd-logind
405 message+ 20 0 42248 3348 2960 S 0.0 0.2 0:00.03 dbus-daemon
426 root 20 0 258668 3104 2616 S 0.0 0.2 0:00.02 rsyslogd
428 root 20 0 7392 1220 1100 S 0.0 0.1 0:00.30 gpm
432 root 20 0 4388 1736 1488 S 0.0 0.1 0:00.00 acpid
452 root 20 0 12844 1936 1780 S 0.0 0.1 0:00.00 agetty
453 root 20 0 14352 2128 1976 S 0.0 0.1 0:00.00 agetty
488 root 20 0 20064 2852 2576 S 0.0 0.1 0:00.21 xe-daemon
546 postgres 20 0 234968 21592 20100 S 0.0 1.1 0:00.89 postgres
571 root 20 0 92268 8812 6508 S 0.0 0.4 0:00.47 apache2
634 postgres 20 0 235092 7676 6124 S 0.0 0.4 0:00.01 postgres

44

Does it also show task, CPU, SWAP, etc. ?
Like:
image

1 Like
45

top - 20:20:45 up 2:17, 2 users, load average: 0.00, 0.01, 0.00
Tasks: 81 total, 1 running, 80 sleeping, 0 stopped, 0 zombie
%Cpu(s): 0.0 us, 0.0 sy, 0.0 ni,100.0 id, 0.0 wa, 0.0 hi, 0.0 si, 0.0 st
KiB Mem: 2050396 total, 741324 used, 1309072 free, 66700 buffers
KiB Swap: 2097148 total, 0 used, 2097148 free. 296032 cached Mem

46

Well that look fine (actually finer than just fine).
So that’s not part of the problem…

1 Like
47

Thanks.
So where is the problem ?

48

I’m leaning towards the system doesn’t like files with no extensions.
Try creating a “test.txt” or “test.html” file in that folder:
/var/www/kreator.ch/public_html/.well-known/acme-challenge/

1 Like
49

Created.
Initially 1234 file was 1234.html
Could not be reache neither.

50

Then what about access rights to that file/path.
Maybe apache isn’t allowed to read it?
How do you normally add content to any of the site(s)?

chown
chgrp

1 Like
51

Done chmod -R 777 .well-known

52

What’s that?

Checking

https://www.kreator.ch/

It works !

If you're seeing this page via a web browser, it means you've setup Tomcat successfully. Congratulations!

This is the default Tomcat home page. It can be found on the local filesystem at: /var/lib/tomcat7/webapps/ROOT/index.html

There is no Apache, there is a Tomcat with

/var/lib/tomcat7/webapps/ROOT/

as root.

53

I do have Tomcat7 for servlets. But I have Apache as well which produces logs etc.

54

root@vserv2200.swisslink.ch:/var/log/apache2# ls -al
total 17832
drwxr-x— 2 root adm 4096 Jan 29 18:33 .
drwxr-xr-x 14 root root 4096 Jan 29 07:35 …
-rw-r----- 1 root adm 4141424 Jan 29 20:47 access.log
-rw-r----- 1 root adm 7302079 Jan 29 07:35 access.log.1
-rw-r----- 1 root adm 527214 Jan 20 07:34 access.log.10.gz
-rw-r----- 1 root adm 417270 Jan 19 07:34 access.log.11.gz
-rw-r----- 1 root adm 488246 Jan 18 07:34 access.log.12.gz
-rw-r----- 1 root adm 444493 Jan 17 07:34 access.log.13.gz
-rw-r----- 1 root adm 494040 Jan 16 07:35 access.log.14.gz
-rw-r----- 1 root adm 572484 Jan 28 07:35 access.log.2.gz
-rw-r----- 1 root adm 558223 Jan 27 07:35 access.log.3.gz
-rw-r----- 1 root adm 484536 Jan 26 07:34 access.log.4.gz
-rw-r----- 1 root adm 461740 Jan 25 07:35 access.log.5.gz

55

What do you see there?

Your Tomcat answers, if Letsencrypt checks /.well-known/acme-challenge, not your Apache.

So your Tomcat webroot is relevant.

56

So what should I do ?

57

Read my first answer and use your tomcat webroot.

58

Dear Juergen,
I know I took a lot of your time due to my incompetance. Sorry about that.
I went through yours answers and do not see which one points out what to do.

59
1 Like
60

So I have to manage certificates for tomcat ?
I just followed the procedure sent to me by email.
Arrived to certbot-auto --apache certonly
which should be changed in somteing else. Is it correct ?