Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. crt.sh | example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
Hello, I moved my home webserver off of an older Atom motherboard to a new Single Board Computer, an Orange Pi 5.
I'm running Armbian OS and installed my Certbot certificates using Snap.
(TBH - I don't know how I installed them in the past or what circumstances let me to using Snap).
Since the move I can no longer see my page while I'm in the same LAN as the server, but the pages are visible/functional via the WAN. (confusingly the pages work fine on ONE of my home computers, on the same LAN.
This wasn't a problem prior to moving to the new server, I only had to make entires in the Windows host file and the pages would load as https.
Thank you.
Yeah, for some reason your Apache server uses the cert you have for www.jondowd.com rather than the cert for jondowd.com. See: SSL Checker
Usually the registered name and a www subdomain are in the same cert and used by the same VirtualHost. That is not required and some people prefer it separate. Just noting that you should review your Apache config and which of the certs it should be using for which VHost
Note in the past you did get a cert with both names combined so maybe you just need to repeat that.
As for your local networking problem, that's a big outside the scope of what we normally handle. Perhaps someone will comment anyway but that is not related to your certs.
Thank you for your help. I will continue to poke around for the LAN issue,
As for "Usually the registered name and a www subdomain are in the same cert and used by the same VirtualHost. That is not required and some people prefer it separate. Just noting that you should review your Apache config and which of the certs it should be using for which VHost"
Could this be due to utilizing snap install certbot --classic
to install the certificates? Is there a more preferable way?
No. It is related to the command you used to request the certificate
Your most recent only requested a single name in the cert. You did not describe the commands so I couldn't say more. This could be something you did explicitly (like using just one -d value). Or was caused by the way you responded to Certbot prompts. Or, it could be because you re-arranged your Apache config and let Certbot default.
Anyway, since you had a working system before It sounded like you just needed to resume doing whatever you did before.
If you are not sure, please show outputs of these and we can get you sorted out.
TL? (I think things are working, I can see my three little websites when I request them outside of my LAN, so I don't want to trouble you unnecessarily - For fun I moved my server to an SBC, and now only one of the computers shows me my sites while on my home network)
If any of the information submitted below warrants me making changes I will follow your advice. THANK YOU.
Any of my difficulties have been self imposed as I hoped it would be interesting to move my Apache web server to a Single Board Computer, in this case an Orange Pi 5. The OS is Armbian. After getting Apache2 up and running with my three virtual hosts, I attempted to reinstall certificates with Certbot as I had done before. Unable to find my notes, a search led me to certbot.eff.org which in turn led me to these instructions - Certbot Instructions
I installed Snap Certbot and running it brings the following (I don't remember using Snaap and it didn't look familiar to my prior installation of Certbot, but I proceeded, bringing us to here, today.
The output of sudo certbot
jon@sotw:~$ sudo certbot
[sudo] password for jon:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel):
The output of sudo certbot certificates
jon@sotw:~$ sudo certbot certificates
[sudo] password for jon:
Saving debug log to /var/log/letsencrypt/letsencrypt.log
The output of
sudo apache2ctl -t -D DUMP_VHOSTS
jon@sotw:~$ sudo apache2ctl -t -D DUMP_VHOSTS
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
VirtualHost configuration:
*:443 is a NameVirtualHost
default server atomicvigil.net (/etc/apache2/sites-enabled/atomicvigil.net-le-ssl.conf:2)
port 443 namevhost atomicvigil.net (/etc/apache2/sites-enabled/atomicvigil.net-le-ssl.conf:2)
alias www.atomcivigil.net
port 443 namevhost jondowd.com (/etc/apache2/sites-enabled/jondowd.com-le-ssl.conf:2)
alias www.jondowd.com
port 443 namevhost serveronthewall.com (/etc/apache2/sites-enabled/serveronthewall.com-le-ssl.conf:2)
alias www.serveronthewall.com
*:80 is a NameVirtualHost
default server 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1)
port 80 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1)
port 80 namevhost atomicvigil.net (/etc/apache2/sites-enabled/atomicvigil.net.conf:1)
alias www.atomcivigil.net
port 80 namevhost jondowd.com (/etc/apache2/sites-enabled/jondowd.com.conf:1)
alias www.jondowd.com
port 80 namevhost serveronthewall.com (/etc/apache2/sites-enabled/serveronthewall.com.conf:1)
alias www.serveronthewall.com
Certbot will ask if you want to expand the cert to include a new name. Do that.
I used the --cert-name for the www subdomain as that is what you Apache currently uses: SSL Checker
If there are any problems with that let us know. Otherwise, once you confirm both domain names work properly you should delete the obsolete one with:
sudo certbot delete --cert-name jondowd.com
And once that all works repeat the same process for your other two pairs of domain names.
You will need to correct the typo for www.atomicvigil.net in your two Apache config files too. You have it spelled www.atomcivigil.net. Correct this before running the steps above for this pair and note you won't have a certificate to delete since you did not get one for the misspelled name.
