Renewal Problem

griffin · August 6, 2021, 6:50pm

In /private/etc/apache2/httpd.conf, remove these 3 lines:

    Alias /www.hprauto.com /Volumes/Lacie/hprauto
    Alias /hprauto.com /Volumes/Lacie/hprauto
    Alias /www.nmis.com /Volumes/Lacie

In /private/etc/apache2/httpd.conf, remove this line at the bottom:

Include /private/etc/apache2/extra/httpd-vhosts-le-ssl.conf

Replace /private/etc/apache2/extra/httpd-vhosts.conf with this file:

httpd-vhosts.conf.txt (1.2 KB)

Replace /private/etc/apache2/extra/httpd-ssl.conf with this fills:

httpd-ssl.conf.txt (6.0 KB)

Run these:

sudo rm /private/etc/apache2/extra/httpd-vhosts-le-ssl.conf

sudo apachectl -k graceful

sudo rm -rf /etc/letsencrypt/archive/hprauto.com

sudo rm -rf /etc/letsencrypt/archive/hprauto.com-0001

sudo rm -rf /etc/letsencrypt/archive/nmis.com

sudo rm -f /etc/letsencrypt/csr/*

sudo rm -f /etc/letsencrypt/keys/*

sudo rm -f /etc/letsencrypt/live/.DS_Store

sudo rm -rf /etc/letsencrypt/live/hprauto.com

sudo rm -rf /etc/letsencrypt/live/mail.hprauto.com

sudo rm -rf /etc/letsencrypt/live/nmis.com

sudo rm -f /etc/letsencrypt/renewal/*

sudo certbot certonly --apache -d "hprauto.com,www.hprauto.com" --deploy-hook "apachectl -k graceful"

sudo certbot certonly --apache -d "nmis.com,www.nmis.com" --deploy-hook "apachectl -k graceful"

In /private/etc/apache2/extra/httpd-vhosts.conf, uncomment the Redirect lines at the bottom of both VirtualHosts.

In /private/etc/apache2/extra/httpd-ssl.conf, uncomment the last 3 lines at the bottom of both VirtualHosts.

Run this:

sudo apachectl -k graceful

griffin · August 6, 2021, 6:55pm

Be certain to login to the community and see my edited instructions.

jreuben1251 · August 6, 2021, 9:56pm

I'll get on it. Can't thank you enough.

Jeff

jreuben1251 · August 7, 2021, 4:13pm

Thanks again. I followed your instructions and uncommented the last three lines in httpd-ssl-.conf. Apache configtest failed when I ran the certbot command with this error:

Error while running apachectl configtest.

AH00526: Syntax error on line 148 of /private/etc/apache2/extra/httpd-ssl.conf:
SSLCertificateFile: file '/etc/letsencrypt/live/nmis.com/fullchain.pem' does not exist or is empty

griffin · August 7, 2021, 7:07pm

Did you successfully receive a certificate for nmis.com via the preceding certbot command before uncommenting those lines?

jreuben1251 · August 7, 2021, 7:47pm

No I was never able to. I didn't pursue it because it is on a private network. I can comment out those lines in the ssl file and just run certbot for hprauto.com and www.hprauto.com or just try to obtain a certificate for nmis.com

thanks
jeff

griffin · August 7, 2021, 7:49pm

If you don't need SSL for nmis.com, you can just comment out its entire port 443 VirtualHost and comment out the Redirect line in its port 80 VirtualHost.

You did run the certbot line I gave for hprauto.com though, right? It's critical for having the correct renewal parameters.

jreuben1251 · August 7, 2021, 8:02pm

I did and got the same error regarding nmis.com. I remove the code and try again. Thank you

jreuben1251 · August 7, 2021, 8:23pm

Made the changes, ran the certbot line for hprauto.com and www.hprauto.com. Got this error:

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for www.hprauto.com
Waiting for verification...
Challenge failed for domain www.hprauto.com
http-01 challenge for www.hprauto.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:

The following errors were reported by the server:

Domain: www.hprauto.com
Type: connection
Detail: Fetching
http://www.hprauto.com/.well-known/acme-challenge/sCH8yFYZj8J6gS9mdKwfyNLu3cQjTywZ8IWX42uaZ0I:
Connection refused

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.

griffin · August 7, 2021, 8:43pm

Did you restart Apache after making the changes?

Right now, www.hprauto.com is unreachable.

griffin · August 7, 2021, 8:49pm

What is the current output of:

sudo apachectl -S

jreuben1251 · August 7, 2021, 10:01pm

Yes it is unreachable. I tried to restart Apache and uncomment the alias line in httpd.conf. Here is the result of sudo apachectl -S:

VirtualHost configuration:
*:80 is a NameVirtualHost
default server www.hprauto.com (/private/etc/apache2/extra/httpd-vhosts.conf:17)
port 80 namevhost www.hprauto.com (/private/etc/apache2/extra/httpd-vhosts.conf:17)
alias hprauto.com
port 80 namevhost www.nmis.com (/private/etc/apache2/extra/httpd-vhosts.conf:30)
alias nmis.com
*:443 www.hprauto.com (/private/etc/apache2/extra/httpd-ssl.conf:120)
ServerRoot: "/usr"
Main DocumentRoot: "/Volumes/Lacie"
Main ErrorLog: "/private/var/log/apache2/error_log"
Mutex ssl-stapling-refresh: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/private/var/run/" mechanism=default
Mutex mpm-accept: using_defaults
PidFile: "/private/var/run/httpd.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
Define: MODPERL2
User: name="_www" id=70
Group: name="_www" id=70

rg305 · August 7, 2021, 10:03pm

The config is now better; but, yes, it is still unreachable via port 80 from the Internet

curl -Iki 96.68.102.17
curl: (56) Recv failure: Connection reset by peer

curl -Iki https://96.68.102.17
curl: (7) Failed to connect to 96.68.102.17 port 443: Connection refused

jreuben1251 · August 8, 2021, 2:15am

Got www.hprauto.com and hprauto.com to appear. Both insecure. Doesn't appear that the certificates have been created.

rg305 · August 8, 2021, 2:20am

Maybe they haven't been used, but many were created:
crt.sh | hprauto.com

griffin · August 8, 2021, 3:25am

I have a strong feeling that maybe you didn't perform all the instructions I gave because hprauto is currently serving an old, expired certificate that should have been deleted.

griffin · August 8, 2021, 3:29am

What are the current outputs of:

sudo certbot certificates
sudo ls -lRa /etc/letsencrypt
sudo ls -lRa /private/etc/apache2
sudo cat /private/etc/apache2/extra/httpd-vhosts.conf
sudo cat /private/etc/apache2/extra/httpd-ssl.conf

Please put 3 backticks above and below each output, like this:

```
output
```

jreuben1251 · August 8, 2021, 12:13pm

Correct and the only certificate I see that appears to be associated with hprauto is located in /private/etc/certificates:

hprauto.com.4E1364820AA4264C444A3FA4C22FBD1D9E0A6BB2.cert.pem
hprauto.com.4E1364820AA4264C444A3FA4C22FBD1D9E0A6BB2.chain.pem

I do see newly created files in the /private/etc/letsencrypt/csr and /private/etc/letsencrypt/keys directories.

Here are the results of you next request:

Saving debug log to /var/log/letsencrypt/letsencrypt.log

No certs found.

drwxr-xr-x  11 root     wheel   352 Aug  8 06:56 .
drwxr-xr-x  98 root     wheel  3136 Jul 11 19:03 ..
-rw-r--r--   1 root     wheel    64 May  1 06:34 .updated-options-ssl-apache-conf-digest.txt
drwxr-xr-x   3 root     wheel    96 May  1 06:34 accounts
drwx------+  3 root     wheel    96 Aug  7 06:41 archive
drwxr-xr-x   5 root     wheel   160 Aug  7 21:08 csr
drwx------+  5 root     wheel   160 Aug  7 21:08 keys
drwx------+  3 root     wheel    96 Aug  7 06:45 live
-rw-r--r--@  1 jreuben  staff  1620 May  2 10:44 options-ssl-apache.conf
drwxr-xr-x   2 root     wheel    64 Aug  7 06:46 renewal
drwxr-xr-x   5 root     wheel   160 Apr 28 18:03 renewal-hooks

/etc/letsencrypt/accounts:
total 0
drwxr-xr-x   3 root  wheel   96 May  1 06:34 .
drwxr-xr-x  11 root  wheel  352 Aug  8 06:56 ..
drwxr-xr-x   3 root  wheel   96 May  1 06:34 acme-v02.api.letsencrypt.org

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org:
total 0
drwxr-xr-x  3 root  wheel  96 May  1 06:34 .
drwxr-xr-x  3 root  wheel  96 May  1 06:34 ..
drwx------  3 root  wheel  96 May  1 06:34 directory

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory:
total 0
drwx------  3 root  wheel   96 May  1 06:34 .
drwxr-xr-x  3 root  wheel   96 May  1 06:34 ..
drwx------  5 root  wheel  160 May  1 06:34 cdfec566876812a377fe54483a583abb

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/cdfec566876812a377fe54483a583abb:
total 24
drwx------  5 root  wheel   160 May  1 06:34 .
drwx------  3 root  wheel    96 May  1 06:34 ..
-rw-r--r--  1 root  wheel    79 May  1 06:34 meta.json
-r--------  1 root  wheel  1632 May  1 06:34 private_key.json
-rw-r--r--  1 root  wheel    79 May  1 06:34 regr.json

/etc/letsencrypt/archive:
total 0
drwx------+  3 root  wheel   96 Aug  7 06:41 .
drwxr-xr-x  11 root  wheel  352 Aug  8 06:56 ..
drwxr-xr-x   6 root  wheel  192 May  3 23:19 hprauto.com-0001

/etc/letsencrypt/archive/hprauto.com-0001:
total 32
drwxr-xr-x  6 root  wheel   192 May  3 23:19 .
drwx------+ 3 root  wheel    96 Aug  7 06:41 ..
-rw-r--r--  1 root  wheel  1834 May  3 23:19 cert1.pem
-rw-r--r--  1 root  wheel  1586 May  3 23:19 chain1.pem
-rw-r--r--  1 root  wheel  3420 May  3 23:19 fullchain1.pem
-rw-------  1 root  wheel  1704 May  3 23:19 privkey1.pem

/etc/letsencrypt/csr:
total 24
drwxr-xr-x   5 root  wheel  160 Aug  7 21:08 .
drwxr-xr-x  11 root  wheel  352 Aug  8 06:56 ..
-rw-r--r--   1 root  wheel  944 Aug  7 15:07 0000_csr-certbot.pem
-rw-r--r--   1 root  wheel  944 Aug  7 21:04 0001_csr-certbot.pem
-rw-r--r--   1 root  wheel  944 Aug  7 21:08 0002_csr-certbot.pem

/etc/letsencrypt/keys:
total 24
drwx------+  5 root  wheel   160 Aug  7 21:08 .
drwxr-xr-x  11 root  wheel   352 Aug  8 06:56 ..
-rw-------   1 root  wheel  1704 Aug  7 15:07 0000_key-certbot.pem
-rw-------   1 root  wheel  1704 Aug  7 21:04 0001_key-certbot.pem
-rw-------   1 root  wheel  1704 Aug  7 21:08 0002_key-certbot.pem

/etc/letsencrypt/live:
total 8
drwx------+  3 root  wheel   96 Aug  7 06:45 .
drwxr-xr-x  11 root  wheel  352 Aug  8 06:56 ..
-rw-r--r--   1 root  wheel  740 May  2 10:24 README

/etc/letsencrypt/renewal:
total 0
drwxr-xr-x   2 root  wheel   64 Aug  7 06:46 .
drwxr-xr-x  11 root  wheel  352 Aug  8 06:56 ..

/etc/letsencrypt/renewal-hooks:
total 0
drwxr-xr-x   5 root  wheel  160 Apr 28 18:03 .
drwxr-xr-x  11 root  wheel  352 Aug  8 06:56 ..
drwxr-xr-x   2 root  wheel   64 Apr 28 18:03 deploy
drwxr-xr-x   2 root  wheel   64 Apr 28 18:03 post
drwxr-xr-x   2 root  wheel   64 Apr 28 18:03 pre

/etc/letsencrypt/renewal-hooks/deploy:
total 0
drwxr-xr-x  2 root  wheel   64 Apr 28 18:03 .
drwxr-xr-x  5 root  wheel  160 Apr 28 18:03 ..

/etc/letsencrypt/renewal-hooks/post:
total 0
drwxr-xr-x  2 root  wheel   64 Apr 28 18:03 .
drwxr-xr-x  5 root  wheel  160 Apr 28 18:03 ..

/etc/letsencrypt/renewal-hooks/pre:
total 0
drwxr-xr-x  2 root  wheel   64 Apr 28 18:03 .
drwxr-xr-x  5 root  wheel  160 Apr 28 18:03 ..

drwxr-xr-x  11 root     wheel    352 Aug  7 21:04 .
drwxr-xr-x  98 root     wheel   3136 Jul 11 19:03 ..
drwxr-xr-x   8 root     wheel    256 Aug  5 13:06 backup
-rw-------   1 root     wheel     81 Aug  7 20:59 env.plist
drwxr-xr-x  15 root     wheel    480 Aug  7 21:04 extra
-rw-r--r--@  1 jreuben  staff  21919 Aug  7 20:34 httpd.conf
-rw-r--r--   1 root     wheel  13077 Oct  9  2017 magic
-rw-r--r--   1 root     wheel  61118 Jan 17  2018 mime.types
drwxr-xr-x   4 root     wheel    128 Aug  5 13:06 original
drwxr-xr-x   3 root     wheel     96 Aug  7 21:04 other
drwxr-xr-x   3 root     wheel     96 May 12 09:14 users

/private/etc/apache2/backup:
total 264
drwxr-xr-x   8 root     wheel    256 Aug  5 13:06 .
drwxr-xr-x  11 root     wheel    352 Aug  7 21:04 ..
-rw-r--r--@  1 jreuben  wheel  21084 Mar  7  2018 httpd1.conf
-rw-r--r--   1 root     wheel  21150 Apr  4  2018 httpd2.conf
-rw-r--r--@  1 jreuben  staff  21703 Oct  7  2018 httpd3.conf
-rw-r--r--@  1 jreuben  staff  21703 Oct  7  2018 httpd4.conf
-rw-r--r--@  1 jreuben  wheel  21934 May  6  2019 httpd6.conf
-rw-r--r--@  1 root     wheel  21979 Aug  5 13:06 httpd7.conf

/private/etc/apache2/extra:
total 72
drwxr-xr-x  15 root     wheel    480 Aug  7 21:04 .
drwxr-xr-x  11 root     wheel    352 Aug  7 21:04 ..
-rw-r--r--   1 root     wheel   2877 Oct  9  2017 httpd-autoindex.conf
-rw-r--r--   1 root     wheel   1747 Oct  9  2017 httpd-dav.conf
-rw-r--r--   1 root     wheel   2942 Oct  9  2017 httpd-default.conf
-rw-r--r--   1 root     wheel   1119 Oct  9  2017 httpd-info.conf
-rw-r--r--   1 root     wheel   5078 Oct  9  2017 httpd-languages.conf
-rw-r--r--   1 root     wheel   1419 Oct  9  2017 httpd-manual.conf
-rw-r--r--   1 root     wheel   4456 Oct  9  2017 httpd-mpm.conf
-rw-r--r--   1 root     wheel   2216 Oct  9  2017 httpd-multilang-errordoc.conf
-rw-r--r--@  1 jreuben  staff   5560 Aug  7 15:04 httpd-ssl.conf
-rw-r--r--   1 root     wheel    607 Oct  9  2017 httpd-userdir.conf
-rw-r--r--@  1 jreuben  staff   1265 Aug  7 15:05 httpd-vhosts.conf
-rw-r--r--@  1 jreuben  wheel  21830 Apr 19  2019 httpd.conf
-rw-r--r--   1 root     wheel   3161 Oct  9  2017 proxy-html.conf

/private/etc/apache2/original:
total 24
drwxr-xr-x   4 root  wheel    128 Aug  5 13:06 .
drwxr-xr-x  11 root  wheel    352 Aug  7 21:04 ..
drwxr-xr-x  14 root  wheel    448 Oct  9  2017 extra
-rw-r--r--   1 root  wheel  21084 Oct  9  2017 httpd.conf

/private/etc/apache2/original/extra:
total 16
drwxr-xr-x  14 root  wheel    448 Oct  9  2017 .
drwxr-xr-x   4 root  wheel    128 Aug  5 13:06 ..
-rw-r--r--   1 root  wheel   2877 Oct  9  2017 httpd-autoindex.conf
-rw-r--r--   1 root  wheel   1747 Oct  9  2017 httpd-dav.conf
-rw-r--r--   1 root  wheel   2942 Oct  9  2017 httpd-default.conf
-rw-r--r--   1 root  wheel   1119 Oct  9  2017 httpd-info.conf
-rw-r--r--   1 root  wheel   5078 Oct  9  2017 httpd-languages.conf
-rw-r--r--   1 root  wheel   1419 Oct  9  2017 httpd-manual.conf
-rw-r--r--   1 root  wheel   4456 Oct  9  2017 httpd-mpm.conf
-rw-r--r--   1 root  wheel   2216 Oct  9  2017 httpd-multilang-errordoc.conf
-rw-r--r--   1 root  wheel  13325 Oct  9  2017 httpd-ssl.conf
-rw-r--r--   1 root  wheel    607 Oct  9  2017 httpd-userdir.conf
-rw-r--r--   1 root  wheel   1519 Oct  9  2017 httpd-vhosts.conf
-rw-r--r--   1 root  wheel   3161 Oct  9  2017 proxy-html.conf

/private/etc/apache2/other:
total 0
drwxr-xr-x   3 root  wheel   96 Aug  7 21:04 .
drwxr-xr-x  11 root  wheel  352 Aug  7 21:04 ..
-r--r--r--   1 root  wheel  194 Oct  9  2017 php7.conf

/private/etc/apache2/users:
total 8
drwxr-xr-x   3 root  wheel   96 May 12 09:14 .
drwxr-xr-x  11 root  wheel  352 Aug  7 21:04 ..
-rw-r--r--   1 root  wheel   96 May 12 09:14 Guest.conf

# Virtual Hosts
#
# Required modules: mod_log_config

# If you want to maintain multiple domains/hostnames on your
# machine you can setup VirtualHost containers for them. Most configurations
# use only name-based virtual hosts so the server doesn't need to worry about
# IP addresses. This is indicated by the asterisks in the directives below.
#
# Please see the documentation at 
# <URL:http://httpd.apache.org/docs/2.4/vhosts/>
# for further details before you try to setup virtual hosts.
#
# You may use the command line option '-S' to verify your virtual host
# configuration.

<VirtualHost *:80>
    ServerAdmin jreuben1251@gmail.com
    ServerName www.hprauto.com
    ServerAlias hprauto.com

    DocumentRoot "/Volumes/Lacie/hprauto"

    ErrorLog "/private/var/log/apache2/hprauto_error_log"
    CustomLog "/private/var/log/apache2/hprauto_access_log" common

    Redirect permanent / https://www.hprauto.com/
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin jreuben1251@gmail.com
    ServerName www.nmis.com
    ServerAlias nmis.com

    DocumentRoot "/Volumes/Lacie"

    ErrorLog "/private/var/log/apache2/nmis_error_log"
    CustomLog "/private/var/log/apache2/nmis_access_log" common

    #Redirect permanent / https://www.nmis.com/
</VirtualHost>

# Virtual Hosts
#
# Required modules: mod_log_config

# If you want to maintain multiple domains/hostnames on your
# machine you can setup VirtualHost containers for them. Most configurations
# use only name-based virtual hosts so the server doesn't need to worry about
# IP addresses. This is indicated by the asterisks in the directives below.
#
# Please see the documentation at 
# <URL:http://httpd.apache.org/docs/2.4/vhosts/>
# for further details before you try to setup virtual hosts.
#
# You may use the command line option '-S' to verify your virtual host
# configuration.

<VirtualHost *:80>
    ServerAdmin jreuben1251@gmail.com
    ServerName www.hprauto.com
    ServerAlias hprauto.com

    DocumentRoot "/Volumes/Lacie/hprauto"

    ErrorLog "/private/var/log/apache2/hprauto_error_log"
    CustomLog "/private/var/log/apache2/hprauto_access_log" common

    Redirect permanent / https://www.hprauto.com/
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin jreuben1251@gmail.com
    ServerName www.nmis.com
    ServerAlias nmis.com

    DocumentRoot "/Volumes/Lacie"

    ErrorLog "/private/var/log/apache2/nmis_error_log"
    CustomLog "/private/var/log/apache2/nmis_access_log" common

    #Redirect permanent / https://www.nmis.com/
</VirtualHost>

Jeffreys-Mac-Pro:Lacie jreuben$ sudo cat /private/etc/apache2/extra/httpd-ssl.conf

# This is the Apache server configuration file providing SSL support.
# It contains the configuration directives to instruct the server how to
# serve pages over an https connection. For detailed information about these 
# directives see <URL:http://httpd.apache.org/docs/2.4/mod/mod_ssl.html>
# 
# Do NOT simply read the instructions in here without understanding
# what they do.  They're here only as hints or reminders.  If you are unsure
# consult the online docs. You have been warned.  
#
# Required modules: mod_log_config, mod_setenvif, mod_ssl,
#          socache_shmcb_module (for default value of SSLSessionCache)

#
# Pseudo Random Number Generator (PRNG):
# Configure one or more sources to seed the PRNG of the SSL library.
# The seed data should be of good random quality.
# WARNING! On some platforms /dev/random blocks if not enough entropy
# is available. This means you then cannot use the /dev/random device
# because it would lead to very long connection times (as long as
# it requires to make more entropy available). But usually those
# platforms additionally provide a /dev/urandom device which doesn't
# block. So, if available, use this one instead. Read the mod_ssl User
# Manual for more details.
#
#SSLRandomSeed startup file:/dev/random  512
#SSLRandomSeed startup file:/dev/urandom 512
#SSLRandomSeed connect file:/dev/random  512
#SSLRandomSeed connect file:/dev/urandom 512


#
# When we also provide SSL we have to listen to the 
# standard HTTP port (see above) and to the HTTPS port
#
Listen 443

##
##  SSL Global Context
##
##  All SSL configuration in this context applies both to
##  the main server and all SSL-enabled virtual hosts.
##

#   SSL Cipher Suite:
#   List the ciphers that the client is permitted to negotiate,
#   and that httpd will negotiate as the client of a proxied server.
#   See the OpenSSL documentation for a complete list of ciphers, and
#   ensure these follow appropriate best practices for this deployment.
#   httpd 2.2.30, 2.4.13 and later force-disable aNULL, eNULL and EXP ciphers,
#   while OpenSSL disabled these by default in 0.9.8zf/1.0.0r/1.0.1m/1.0.2a.
SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES
SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4:!3DES

#  By the end of 2016, only TLSv1.2 ciphers should remain in use.
#  Older ciphers should be disallowed as soon as possible, while the
#  kRSA ciphers do not offer forward secrecy.  These changes inhibit
#  older clients (such as IE6 SP2 or IE8 on Windows XP, or other legacy
#  non-browser tooling) from successfully connecting.  
#
#  To restrict mod_ssl to use only TLSv1.2 ciphers, and disable
#  those protocols which do not support forward secrecy, replace
#  the SSLCipherSuite and SSLProxyCipherSuite directives above with
#  the following two directives, as soon as practical.
# SSLCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA
# SSLProxyCipherSuite HIGH:MEDIUM:!SSLv3:!kRSA

#   User agents such as web browsers are not configured for the user's
#   own preference of either security or performance, therefore this
#   must be the prerogative of the web server administrator who manages
#   cpu load versus confidentiality, so enforce the server's cipher order.
SSLHonorCipherOrder on 

#   SSL Protocol support:
#   List the protocol versions which clients are allowed to connect with.
#   Disable SSLv3 by default (cf. RFC 7525 3.1.1).  TLSv1 (1.0) should be
#   disabled as quickly as practical.  By the end of 2016, only the TLSv1.2
#   protocol or later should remain in use.
SSLProtocol all -SSLv3
SSLProxyProtocol all -SSLv3

#   Pass Phrase Dialog:
#   Configure the pass phrase gathering process.
#   The filtering dialog program ('builtin' is an internal
#   terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog  builtin

#   Inter-Process Session Cache:
#   Configure the SSL Session Cache: First the mechanism 
#   to use and second the expiring timeout (in seconds).
#SSLSessionCache         "dbm:/private/var/run/ssl_scache"
SSLSessionCache        "shmcb:/private/var/run/ssl_scache(512000)"
SSLSessionCacheTimeout  300

#   OCSP Stapling (requires OpenSSL 0.9.8h or later)
#
#   This feature is disabled by default and requires at least
#   the two directives SSLUseStapling and SSLStaplingCache.
#   Refer to the documentation on OCSP Stapling in the SSL/TLS
#   How-To for more information.
#
#   Enable stapling for all SSL-enabled servers:
#SSLUseStapling On

#   Define a relatively small cache for OCSP Stapling using
#   the same mechanism that is used for the SSL session cache
#   above.  If stapling is used with more than a few certificates,
#   the size may need to be increased.  (AH01929 will be logged.)
#SSLStaplingCache "shmcb:/private/var/run/ssl_stapling(32768)"

#   Seconds before valid OCSP responses are expired from the cache
#SSLStaplingStandardCacheTimeout 3600

#   Seconds before invalid OCSP responses are expired from the cache
#SSLStaplingErrorCacheTimeout 600

##
## SSL Virtual Host Context
##

<VirtualHost *:443>
    ServerAdmin jreuben1251@gmail.com
    ServerName www.hprauto.com
    ServerAlias hprauto.com

    DocumentRoot "/Volumes/Lacie/hprauto"

    ErrorLog "/private/var/log/apache2/hprauto_error_log"
    #CustomLog "/private/var/log/apache2/hprauto_access_log" common
    TransferLog "/private/var/log/apache2/hprauto_access_log"

    Include /etc/letsencrypt/options-ssl-apache.conf
    SSLCertificateFile /etc/letsencrypt/live/hprauto.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/hprauto.com/privkey.pem
</VirtualHost>

griffin · August 8, 2021, 5:22pm

Thanks for that. It looks very close to where it needs to be. Let's take this in bites to get there.

Run this:

sudo mv /private/etc/apache2/extra/httpd.conf /private/etc/apache2/backup/httpd5.conf

Run these:

sudo rm -rf /etc/letsencrypt/archive/hprauto.com-0001
sudo rm -f /etc/letsencrypt/csr/*
sudo rm -f /etc/letsencrypt/keys/*

In /private/etc/apache2/extra/httpd-vhosts.conf, comment out this line:

Redirect permanent / https://www.hprauto.com/

In /private/etc/apache2/extra/httpd-ssl.conf, comment out these 3 lines:

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/hprauto.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/hprauto.com/privkey.pem

Run this:

sudo apachectl -k graceful

What are the current outputs of:

sudo apachectl -S
sudo ls -lRa /etc/letsencrypt
sudo certbot certonly --apache -d "hprauto.com,www.hprauto.com" --dry-run

Please put 3 backticks above and below each output, like this:

```
output
```

jreuben1251 · August 8, 2021, 7:02pm

Here is the output you requested. Seems like it is failing the well-known and acme-challenge test. When I first created the certificate, I had to add a text file to the domain name record. Does that need to be altered. Do you want the directory listing from .well-known?

Virtual Host configuration:
*:80                   is a NameVirtualHost
         default server www.hprauto.com (/private/etc/apache2/extra/httpd-vhosts.conf:17)
         port 80 namevhost www.hprauto.com (/private/etc/apache2/extra/httpd-vhosts.conf:17)
                 alias hprauto.com
         port 80 namevhost www.nmis.com (/private/etc/apache2/extra/httpd-vhosts.conf:30)
                 alias nmis.com
*:443                  www.hprauto.com (/private/etc/apache2/extra/httpd-ssl.conf:120)
ServerRoot: "/usr"
Main DocumentRoot: "/Volumes/Lacie"
Main ErrorLog: "/private/var/log/apache2/error_log"
Mutex ssl-stapling-refresh: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/private/var/run/" mechanism=default 
Mutex mpm-accept: using_defaults
PidFile: "/private/var/run/httpd.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
Define: MODPERL2
User: name="_www" id=70
Group: name="_www" id=70

total 16
drwxr-xr-x  11 root     wheel   352 Aug  8 07:11 .
drwxr-xr-x  98 root     wheel  3136 Jul 11 19:03 ..
-rw-r--r--   1 root     wheel    64 May  1 06:34 .updated-options-ssl-apache-conf-digest.txt
drwxr-xr-x   3 root     wheel    96 May  1 06:34 accounts
drwx------+  2 root     wheel    64 Aug  8 13:34 archive
drwxr-xr-x   2 root     wheel    64 Aug  8 13:35 csr
drwx------+  2 root     wheel    64 Aug  8 13:35 keys
drwx------+  3 root     wheel    96 Aug  7 06:45 live
-rw-r--r--@  1 jreuben  staff  1620 May  2 10:44 options-ssl-apache.conf
drwxr-xr-x   2 root     wheel    64 Aug  7 06:46 renewal
drwxr-xr-x   5 root     wheel   160 Apr 28 18:03 renewal-hooks

/etc/letsencrypt/accounts:
total 0
drwxr-xr-x   3 root  wheel   96 May  1 06:34 .
drwxr-xr-x  11 root  wheel  352 Aug  8 07:11 ..
drwxr-xr-x   3 root  wheel   96 May  1 06:34 acme-v02.api.letsencrypt.org

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org:
total 0
drwxr-xr-x  3 root  wheel  96 May  1 06:34 .
drwxr-xr-x  3 root  wheel  96 May  1 06:34 ..
drwx------  3 root  wheel  96 May  1 06:34 directory

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory:
total 0
drwx------  3 root  wheel   96 May  1 06:34 .
drwxr-xr-x  3 root  wheel   96 May  1 06:34 ..
drwx------  5 root  wheel  160 May  1 06:34 cdfec566876812a377fe54483a583abb

/etc/letsencrypt/accounts/acme-v02.api.letsencrypt.org/directory/cdfec566876812a377fe54483a583abb:
total 24
drwx------  5 root  wheel   160 May  1 06:34 .
drwx------  3 root  wheel    96 May  1 06:34 ..
-rw-r--r--  1 root  wheel    79 May  1 06:34 meta.json
-r--------  1 root  wheel  1632 May  1 06:34 private_key.json
-rw-r--r--  1 root  wheel    79 May  1 06:34 regr.json

/etc/letsencrypt/archive:
total 0
drwx------+  2 root  wheel   64 Aug  8 13:34 .
drwxr-xr-x  11 root  wheel  352 Aug  8 07:11 ..

/etc/letsencrypt/csr:
total 0
drwxr-xr-x   2 root  wheel   64 Aug  8 13:35 .
drwxr-xr-x  11 root  wheel  352 Aug  8 07:11 ..

/etc/letsencrypt/keys:
total 0
drwx------+  2 root  wheel   64 Aug  8 13:35 .
drwxr-xr-x  11 root  wheel  352 Aug  8 07:11 ..

/etc/letsencrypt/live:
total 8
drwx------+  3 root  wheel   96 Aug  7 06:45 .
drwxr-xr-x  11 root  wheel  352 Aug  8 07:11 ..
-rw-r--r--   1 root  wheel  740 May  2 10:24 README

/etc/letsencrypt/renewal:
total 0
drwxr-xr-x   2 root  wheel   64 Aug  7 06:46 .
drwxr-xr-x  11 root  wheel  352 Aug  8 07:11 ..

/etc/letsencrypt/renewal-hooks:
total 0
drwxr-xr-x   5 root  wheel  160 Apr 28 18:03 .
drwxr-xr-x  11 root  wheel  352 Aug  8 07:11 ..
drwxr-xr-x   2 root  wheel   64 Apr 28 18:03 deploy
drwxr-xr-x   2 root  wheel   64 Apr 28 18:03 post
drwxr-xr-x   2 root  wheel   64 Apr 28 18:03 pre

/etc/letsencrypt/renewal-hooks/deploy:
total 0
drwxr-xr-x  2 root  wheel   64 Apr 28 18:03 .
drwxr-xr-x  5 root  wheel  160 Apr 28 18:03 ..

/etc/letsencrypt/renewal-hooks/post:
total 0
drwxr-xr-x  2 root  wheel   64 Apr 28 18:03 .
drwxr-xr-x  5 root  wheel  160 Apr 28 18:03 ..

/etc/letsencrypt/renewal-hooks/pre:
total 0
drwxr-xr-x  2 root  wheel   64 Apr 28 18:03 .
drwxr-xr-x  5 root  wheel  160 Apr 28 18:03 ..

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for hprauto.com
http-01 challenge for www.hprauto.com
Waiting for verification...
Challenge failed for domain hprauto.com
Challenge failed for domain www.hprauto.com
http-01 challenge for hprauto.com
http-01 challenge for www.hprauto.com
Cleaning up challenges
Some challenges have failed.

IMPORTANT NOTES:
 - The following errors were reported by the server:

   Domain: hprauto.com
   Type:   unauthorized
   Detail: Invalid response from
   https://hprauto.com/.well-known/acme-challenge/rXYWxhKZERRBwYQMg5hArvzRtahkO368Tg2pIaedTFs
   [96.68.102.17]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
   2.0//EN\">\n<html><head>\n<title>404 Not
   Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"

   Domain: www.hprauto.com
   Type:   unauthorized
   Detail: Invalid response from
   https://www.hprauto.com/.well-known/acme-challenge/FFiyaMKu0O7uYW8ykbYSZ5PGdzbOK54r9lFfwczK5fw
   [96.68.102.17]: "<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML
   2.0//EN\">\n<html><head>\n<title>404 Not
   Found</title>\n</head><body>\n<h1>Not Found</h1>\n<p"

   To fix these errors, please make sure that your domain name was
   entered correctly and the DNS A/AAAA record(s) for that domain
   contain(s) the right IP address.
 - Your account credentials have been saved in your Certbot
   configuration directory at /etc/letsencrypt. You should make a
   secure backup of this folder now. This configuration directory will
   also contain certificates and private keys obtained by Certbot so
   making regular backups of this folder is ideal.