HTTPS not working. If I do a https://support.konspec.in:6443, I get a NGINX default web page saying it is fine. HTTP connection to Osticket stopped working because I made the mistake of saying 'Force HTTPS' in the setup.
On my firewall device, I have forwarded all internet traffic landing at my 2 public IPs to be forwarded to 8081 and 6443 respectively.
This is what I see in nginx/error.log
2021/07/09 13:27:01 [error] 223305#223305: *59 directory index of "/var/www/crmstaging/" is forbidden, client: 60.217.75.69, server: crmapitest.konspec.in, request: "GET / HTTP/1.1", host: "117.247.188.128"
2021/07/09 14:05:29 [notice] 224249#224249: signal process started
2021/07/09 14:05:31 [notice] 224254#224254: signal process started
2021/07/09 14:06:48 [error] 224255#224255: *13 directory index of "/var/www/crmstaging/" is forbidden, client: 172.25.1.1, server: crmapitest.konspec.in, request: "GET / HTTP/1.1", host: "support.konspec.in"
Watch the first error at 13:27 and then again at 14:06. The end part, "host" has the support.konspec.in
I have gotten as far as having no errors in the error.log but accessing the https link on 6443 downloads the index.php. Accessing the site on http doesn't work because it tries to auto-forward to https (as per my settings in Osticket).
Posting the relevant sections of the ost-config file.
server {
listen 8081;
server_name support.konspec.in;
root /var/www/osticket/upload;
index index.php index.html index.htm;
location / {
try_files $uri $uri/ index.php;
autoindex on;
autoindex_exact_size on;
}
server
{
root /var/www/osticket/upload;
index index.php index.html index.htm;
listen [::]:6443 ssl; # managed by Certbot
listen 6443 ssl; # managed by Certbot
server_name support.konspec.in;
You rock! thanks a ton for helping out. The configuration you gave works perfectly and I am able to use the site without issues and it does auto-redirect if I use the http site.
I added the 6443 server block somewhere midway after I managed to generate the certificates. Sorry I did not update the changes on this thread. I really don't know how cerbot managed to downgrade itself as I sure didn't touch the executables or try any install/uninstall.
It is all good now. Many thanks again for all your help
You are quite welcome and I'm very happy it worked out so well!
As for certbot , I suspect that you might have multiple versions installed. You only want the snapd version installed if possible. The others should be uninstalled. See the instructions in the link below for the installation steps, which include uninstalling the old versions. You can repeat them if necessary without harming any of your certificate data or webserver configuration.
I didn't want to touch certbot after seeing this. Probably, the message you see in the output earlier is in the config files for the websites before a system update was done. 2 websites have been using Letsencrypt for 3 months now. A system update to Ubuntu was done a few weeks back which must have updated cerbot version from 1.16 to .40. Although I can't figure out how the version numbers are going down!
If I see the /etc/letsencrypt/renewal/support.konspec.in.conf, it shows version=0.40.0.
While I was at it, I tried a certbot renew --dry-run and got this result for all 3 websites.
The following errors were reported by the server:
Domain: crmapitest.konspec.in
Type: connection
Detail: Fetching
http://crmapitest.konspec.in/.well-known/acme-challenge/geI6hT1e5hkbCuG6r678dkU3tyeNvDUlL62vdGhFCyU:
Timeout during connect (likely firewall problem)
...
Domain: crmtest.konspec.in
Type: connection
Detail: Fetching
http://crmtest.konspec.in/.well-known/acme-challenge/bj_8A0TzwY2x_soXpmtZOopwukMuLXpfrln63bkCcIc:
Timeout during connect (likely firewall problem)
...
Domain: support.konspec.in
Type: connection
Detail: Fetching
http://support.konspec.in/.well-known/acme-challenge/SdXEtzTGDyrsyzBQ8XdDALLjMtdYhVn1Dg24oPeUhSs:
Timeout during connect (likely firewall problem)
...
If it were a firewall issue, my websites would not work but all of them are functional. Is it the same issue of 2 gateway IPs present and being chosen in some round robin fashion by validation servers?
Perhaps nginx isn't binding correctly to both IP addresses?
You could try shutting down nginx then killing all remaining nginx processes. This would let you start nginx fresh with all processes being on the same page.
You might also check you IP address routing rules for both IP addresses. There might be something amiss there.
Thanks @griffin. Tried rebooting the server and also the routing on the firewall, etc. Nothing fancy or out of the ordinary. The best option I know is to shutdown one of the gateway IPs and also remove DNS entry at the registrar and then do the certbot renewal.
You could catch the HTTP challenge requests and redirect them to another name that only resolves to one of those IPs.
[You would still be validating the original name (with multiple IPs), but at a name with a single IP]
Thanks @rg305. I am not well versed with redirection techniques. Could you please throw more light on that?
Do you mean I can setup a rule in our firewall device (Sophos)? Or is this something we have to do in the DNS settings of our Domain Registrar's admin panel?
Actually, yes and no.
Yes = you will need a new DNS A record entry that only resolves to one IP.
No = the redirection isn't done in DNS (it's done in HTTP).
For nginx try something like this:
[replace all HTTP vhosts with this single HTTP vhost config file]
server {
# default server
listen 80 default; # make it the default for all HTTP requests IPv4
listen [::]:80 default; # make it the default for all HTTP requests IPv6
server_name _;
location ^/(?!\.well-known) { # skip challenge requests
return 301 https://$host$request_uri; # send all requests to HTTPS
}# location
location / {
# send challenge requests to a single IP name.
return 301 http://one-ip-only-name.your.domain$request_uri;
}# location
}# server
server {
# ACME challenge requests ONLY server
listen 80;
listen [::]:80;
server_name one-ip-only-name.your.domain; # used for challenge requests only.
location / {
root /some/unique/path/only/for/challenge/files; # make new path
}# location
}# server
, I suspect that you might have multiple versions installed. You only want the snapd version installed if possible. The others should be uninstalled. See the instructions in the link below for the installation steps, which include uninstalling the old versions. You can repeat them if necessary without harming any of your certificate data or webserver configuration.