I installed Letsencrypt for my domain using the command sudo certbot --apache and everything appears to be ok. But I later noticed that if I enter the domain name in a browser web address without preceding it with https, it opens the default website (Apache Works default webpage) which is already disabled instead of the enabled virtual host website. But if the web address is entered in the browser using https, the correct website is loaded. What is wrong and what am I missing?
Below is the content of the sites-enabled conf file
And below is the content of /etc/letsencrypt/options-ssl-apache.conf
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file.
SSLEngine on
# Intermediate configuration, tweak to your needs
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY13>
SSLHonorCipherOrder on
SSLCompression off
SSLOptions +StrictRequire
# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_>
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
Yes, it is in the sites-available and here's the content
<VirtualHost *:80>
ServerName hiskingdommanna.com
ServerAlias www.hiskingdommanna.com
ServerSignature Off
RewriteEngine On
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
ErrorLog /var/log/apache2/redirect.error.log
LogLevel warn
<Directory "/var/www/hiskingdommanna.com">
AllowOverride All
</Directory>
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/hiskingdommanna.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/hiskingdommanna.com/privkey.pem
</VirtualHost>
Am I supposed to enable that one instead of the one for SSL or both? If I enabled both, I get the following error in the browser.
# Bad Request
Your browser sent a request that this server could not understand.
Reason: You're speaking plain HTTP to an SSL-enabled server port.
Instead use the HTTPS scheme to access this URL, please.
No, only the *:443 VirtualHost should have TLS enabled. Also, the Include, SSLCertificateFile and SSLCertificateKeyFile directives should NOT be present in the *:80 VirtualHost.
To debug this further, please show the output of the following command:
I understand your point but what I can't understand is why should *:80 VirtualHost matters in this situation? The *:80 VirtualHost file is not the enabled and active VirtualHost so why should it matter here? The following is the output from running apachectl -t -D DUMP_VHOSTS
AH00526: Syntax error on line 16 of /etc/apache2/sites-enabled/hiskingdommanna-le-ssl.conf:
SSLCertificateFile: file '/etc/letsencrypt/live/hiskingdommanna.com/fullchain.pem' does not exist or is empty
Action '-t -D DUMP_VHOSTS' failed.
The Apache error log may have more information.
After enabling the *:80 redirect VirtualHost and run the apachectl command again, I got the output belowt. It should also be noted that I have made the changes you recommended above to the *:80 virtual host file.
Yes. The redirection is working now after also enabling the redirect virtual host and removing the lines Include , SSLCertificateFile and SSLCertificateKeyFile directives from the *:80 redirect virtual host. Thank you for your time and support.
