Site not reachable after successful certificate installation

Help
21

I can also edit through webmin if you say me what I should write and where

22

Add
ServerAlias incipio.it
right after
ServerName www.incipio.it
in both files:
/etc/httpd/conf/httpd-le-ssl.conf
/etc/httpd/conf/httpd.conf

restart web server

23

Done.
Https still not reachable

24

wget https://www.incipio.it/
–2018-05-08 09:20:31-- https://www.incipio.it/
Resolving www.incipio.it (www.incipio.it)… 80.211.142.114
Connecting to www.incipio.it (www.incipio.it)|80.211.142.114|:443… failed: No route to host.

wget https://incipio.it/
–2018-05-08 09:20:36-- https://incipio.it/
Resolving incipio.it (incipio.it)… 80.211.142.114
Connecting to incipio.it (incipio.it)|80.211.142.114|:443… failed: No route to host.

Is port 443 allowed or blocked?
Does it reach your web server?
Can you check the web server logs?

25

I have created a firewall rule: If protocol is TCP and destination port is 443 and state of connection is NEW = Accept

error_log of apache:
[notice] Apache/2.2.15 (Unix) DAV/2 mod_fcgid/2.3.9 PHP/5.3.3 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips mod_wsgi/3.2 Python/2.6.6 configured – resuming normal operations
[Tue May 08 14:54:33 2018] [error] [client .*.***.***] script ‘/home/incipio.it/www/ip_js.php’ not found or unable to stat
[Tue May 08 15:05:37 2018] [error] [client .*.***.***] script ‘/home/incipio.it/www/ip_js.php’ not found or unable to stat
[Tue May 08 15:07:06 2018] [notice] caught SIGTERM, shutting down
[Tue May 08 15:07:11 2018] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue May 08 15:07:11 2018] [notice] Digest: generating secret for digest authentication …
[Tue May 08 15:07:11 2018] [notice] Digest: done
[Tue May 08 15:07:11 2018] [notice] Apache/2.2.15 (Unix) DAV/2 mod_fcgid/2.3.9 PHP/5.3.3 mod_ssl/2.2.15 OpenSSL/1.0.1e-fips mod_wsgi/3.2 Python/2.6.6 configured – resuming normal operations
[Tue May 08 15:17:01 2018] [error] [client .*.***.***] script ‘/home/incipio.it/www/ip_js.php’ not found or unable to stat
[Tue May 08 15:28:29 2018] [error] [client .*.***.***] script ‘/home/incipio.it/www/ip_js.php’ not found or unable to stat

26

still fails for me:
wget https://www.incipio.it/
–2018-05-08 09:48:27-- https://www.incipio.it/
Resolving www.incipio.it (www.incipio.it)… 80.211.142.114
Connecting to www.incipio.it (www.incipio.it)|80.211.142.114|:443… failed: No route to host.

27

What can be? Should I do something with firewall or is it something more?

28

I think the firewall is not playing nice.
But I don’t know which firewall you have nor how to correct it.
And this is really not a firewall related forum - although I am a firewall guy.
I would suggest you seek help from your firewall forum.

29

Can you help me understand what kind of Firewall I have? I read Linux Firewall and I have for ipv4 and ipv6. Is it the basic firewall of centOS?

30

Then it is CentOS firewall.
Look for help using “CentOS firewall https failed no route to host”

31

I tried deactivating the firewall temporarily and the browser result was: ERR_SSL_PROTOCOL_ERROR

So the firewall was blocking, but without firewall it still doesn’t work.

32

Show that file again.
You said you replaced it.

33

Here it is:
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.

SSLEngine on

# Intermediate configuration, tweak to your needs
SSLProtocol +TLSv1 +TLSv1.1 +TLSv1.2
SSLCipherSuite          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
SSLHonorCipherOrder     on

SSLOptions +StrictRequire

# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common

#CustomLog /var/log/apache2/access.log vhost_combined
#LogLevel warn
#ErrorLog /var/log/apache2/error.log

# Always ensure Cookies have "Secure" set (JAH 2012/1)
#Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"
34

nothing strange there.

Start with the httpd.conf file and review each line and then each line in each included file.
The problem is in there somewhere…

35

the problem is I will probably read 10 lines of errors and noticing nothing wrong :joy:

Is there something wrong here?
<VirtualHost *>
DocumentRoot “/home/incipio.it/www”
ServerName www.incipio.it
ServerAlias incipio.it
<Directory “/home/incipio.it/www”>
allow from all
Options None



NameVirtualHost *:443

Include /etc/httpd/conf/httpd-le-ssl.conf

36

post them here
then maybe someone can help you review them

37

Is there something wrong here?

<VirtualHost *>
DocumentRoot “/home/incipio.it/www”
ServerName www.incipio.it
ServerAlias incipio.it
<Directory “/home/incipio.it/www”>
allow from all
Options None



NameVirtualHost *:443

Include /etc/httpd/conf/httpd-le-ssl.conf

38

the very first line is wrong - no port would bind it to all ports
Use a specific IP:port:
<VirtualHost 1.2.3.4:443>; ( replace 1.2.3.4 with your actual internal IP )
Use any IP:port:
<VirtualHost *:443>;

39

Guys now it connects to site but gives this message:
NET::ERR_CERT_COMMON_NAME_INVALID

like if the certificate is not valid…why?

40

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.