Old cert was revoked by Let's Encrypt, so I revoked in Bitnami server, then renewed my cert no problem. But when browsing to domain it is still hitting the old cert - which has been revoked. I have restarted the apache server but makes no difference.
When browsing to site the cert is still showing old cert details, old expiry data and that is has been revoked
My web server is (include version): Apache/2.4.41 (Unix)
The operating system my web server runs on is (include version): Bitnami
My hosting provider, if applicable, is: AWS Lightsail
I can login to a root shell on my machine (yes or no, or I don't know): Yes
The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 0.31.0
Yes my was revoked by lets encrypt, I thought all I had to do was renew and get a new cert, which I did prior to the revoke - but looks like that isnt the answer. I can go the bncert tool instead if that is the answer.
I just went through this and it looks like it took - Learn about the Bitnami HTTPS Configuration Tool - but still showing revoked in the site link placed above. Do you know if it takes time to propagate?
Yes, Bitnami is nothing like the rest.
It can't directly use the certs provided by certbot.
There are other steps to take... and forms to fill out... LOL
So, as seen by Bitnami, that process is still "incomplete".
You may have renewed the cert, but Bitnami knows nothing about it.
Thus, the revolutionary invention of the bncert tool.
Oh no, it doesn't eliminate the problem; It does soooo much more!
It single-handedly takes all those countless (unnecessary) Bitnami required steps for you.
It's like.. imagine building a machine that can take bread slices out of their bag and place them into the toaster, turn on the toaster and butter them for you when they pop up!
Yes! It's that good and taste just as sweet.
NOTE: In case anyone missed the blatant sarcastic humor - Bitnami can't be used like "normal programs" (99.9% of the Internet). Don't try to fix that broken wheel, just follow their instructions and use their tool.
I do not know Lightsail / bitnami but here is some info in case this helps you.
You can view your cert history here. You got two new wildcard certs on Feb12. But, your Apache server is sending out a non-wildcard cert created on Dec17.
Did you use a different method on Dec17 to create that cert compared to your later ones?
If you just had Apache I would walk you through validating it. But, I worry any manual changes done that way would interfere with bitnami / Lightsail.
Did the bitnami config tool have you restart Apache or Lightsail instance after it got a fresh cert? If not, you could try that.
Yes I did use a different method on the Dec17 date as I couldn't get the apache server back up after shutdown so tried an alternate approach, which took and allowed me to get the apache server back (But clearly caused other issues). I did restart apache through the bitnami config tool and again after the fact just to be safe. I will try restarting the lightsail instance now. Reason I asked re Lightsail was when doing the lets encrypt method - Tutorial: Using Let’s Encrypt SSL certificates with your WordPress instance in Amazon Lightsail | Lightsail Documentation - it makes you add the _acme-challenge response as a txt record in the DNS. Something that wasnt done when using the bitnami config tool
The reboot of lightsail server didnt work either. I am wondering if I can revoke the cert that was mentioned above " But, your Apache server is sending out a non -wildcard cert created on Dec17." I have no clue why its sending that one out. When I check my certs in the Bitnami server I get the following so it looks good on that end:
Found the following certs:
Certificate Name: innovativeirrigation.ca
Domains: innovativeirrigation.ca *.innovativeirrigation.ca
Expiry Date: 2022-05-12 23:50:02+00:00 (VALID: 89 days)
Certificate Path: /etc/letsencrypt/live/innovativeirrigation.ca/fullchain.pem
Private Key Path: /etc/letsencrypt/live/innovativeirrigation.ca/privkey.pem
That will not help. In fact, the cert your server is now sending out was revoked by Let's Encrypt.
What you are showing looks like a cert created using the Certbot client (not bncert). I am not sure bncert actually does wildcards, I think with bitnami you would use lego client.
But, your Apache config is pointing to different cert files. Let's see what @9peppe has to say .
I removed certbot and I renewed cert with bncert tool but its just giving the same result - a successful renewal and cert but hitting the revoked old cert when testing. Any more guidance?
Then ran through the process of renewing cert through bncert (Which does a restart of apache)
I'm only adding in innovativeirrigation.ca as a domain in bncert. Could it be an issue without adding in a wildcard domain when I was adding *.innovativeirrigation.ca when I was using certbot? Sorry but I am really confused on this one
That worked, Amazing! What I did wrong was run through the "install cert using bncert tool" as opposed to the above. Much appreciated @9peppe and everyone else!
