Website not reachable after certbot installation on Raspberry Pi

Help
21

Apparently each device gets its own IPv6 address - that explains why my previous attempts to set the AAAA records didn't work. I needed to get the IPv6 address of the Raspberry Pi hosting the website, not my laptop, or iPad or iPhone which is what I was using. That mystery is now solved.

The www.rpiweather.net name is now working, too. But it is not a secured site (despite the AAAA record).
Do do I fix that?

22

Yes; I would fix it.

OR
If you meant to say: "How do I fix that?"

Web Serving 101

The web server needs to service all the names that point to it.
And if any names are to be served securely [HTTPS], then the web server needs to have certificate(s) that cover all of those names.

23

So I need to certbot again and this time tell it to use www.rpiweather.net?

As you can tell I'm quite new to this stuff.

24

I don't know what you have.
So, I can't be certain about what you need to do next.

What shows?:

certbot certificates

26

in the meantime...

The DNS resolutions of those two names aren't equal:

Name:      rpiweather.net
Addresses: 2600:4040:5050:8900:b176:3528:f70d:7c67
           71.174.250.159

Name:    www.rpiweather.net
Address: 2600:4040:5050:8900:b176:3528:f70d:7c67
27

IPv4 and IPv6 are not being served equally [securely]:

curl -Ii4k https://www.rpiweather.net/
curl: (7) Couldn't connect to server

curl -Ii6k https://www.rpiweather.net/
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 18 Jan 2024 02:58:37 GMT
Content-Type: text/html
Content-Length: 16955
Last-Modified: Sun, 21 Aug 2022 19:07:55 GMT
Connection: keep-alive
ETag: "6302828b-423b"
Accept-Ranges: bytes

Shown another way:

curl -Ii4k https://rpiweather.net/
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Thu, 18 Jan 2024 03:00:31 GMT
Content-Type: text/html
Content-Length: 16955
Last-Modified: Sun, 21 Aug 2022 19:07:55 GMT
Connection: keep-alive
ETag: "6302828b-423b"
Accept-Ranges: bytes

curl -Ii4k https://www.rpiweather.net/
curl: (7) Couldn't connect to server
28

I added an A record for www.rpiweahter.net.

Using curl I get these responses:

C:\Users\micha>curl -Ii4k https://rpiweather.net/
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Fri, 19 Jan 2024 13:11:22 GMT
Content-Type: text/html
Content-Length: 16955
Last-Modified: Sun, 21 Aug 2022 19:07:55 GMT
Connection: keep-alive
ETag: "6302828b-423b"
Accept-Ranges: bytes

C:\Users\micha>curl -Ii4k https://www.rpiweather.net/
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Fri, 19 Jan 2024 13:11:28 GMT
Content-Type: text/html
Content-Length: 16955
Last-Modified: Sun, 21 Aug 2022 19:07:55 GMT
Connection: keep-alive
ETag: "6302828b-423b"
Accept-Ranges: bytes

C:\Users\micha>curl -Ii6k https://rpiweather.net/
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Fri, 19 Jan 2024 13:11:54 GMT
Content-Type: text/html
Content-Length: 16955
Last-Modified: Sun, 21 Aug 2022 19:07:55 GMT
Connection: keep-alive
ETag: "6302828b-423b"
Accept-Ranges: bytes

C:\Users\micha>curl -Ii6k https://www.rpiweather.net/
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Fri, 19 Jan 2024 13:12:06 GMT
Content-Type: text/html
Content-Length: 16955
Last-Modified: Sun, 21 Aug 2022 19:07:55 GMT
Connection: keep-alive
ETag: "6302828b-423b"
Accept-Ranges: bytes

To me these all look the same. Are there other issues I need to fix?

29

Great job on that part.

One that I can see:

curl -Ii6 https://www.rpiweather.net/
curl: (60) SSL: no alternative certificate subject name matches target host name 'www.rpiweather.net'
More details here: https://curl.se/docs/sslcerts.html
curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

The "www" name is not covered by the current cert.

30

I get this:

'''
pi@HomeAutomation:~ $ sudo certbot certificates
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Found the following certs:
Certificate Name: rpiweather.net
Serial Number: 348df935cc991df9635f8477cc2000b3466
Key Type: ECDSA
Domains: rpiweather.net
Expiry Date: 2024-04-13 15:49:24+00:00 (VALID: 85 days)
Certificate Path: /etc/letsencrypt/live/rpiweather.net/fullchain.pem
Private Key Path: /etc/letsencrypt/live/rpiweather.net/privkey.pem

'''

I suspect I need to run certbot again and add the www.rpiwethaer.net? How do I do that?

31

You could use --expand

User Guide — Certbot 2.6.0 documentation

32

I ran the certbot using:

certbot --expand -d rpiweather.net,www.rpiweather.net

After I got this for the curl:

C:\Users\micha>curl -Ii4k http:/rpiweather.net
HTTP/1.1 301 Moved Permanently
Server: nginx/1.14.2
Date: Sun, 21 Jan 2024 17:09:01 GMT
Content-Type: text/html
Content-Length: 185
Connection: keep-alive
Location: https://rpiweather.net/

C:\Users\micha>curl -Ii4k http:/www.rpiweather.net
HTTP/1.1 301 Moved Permanently
Server: nginx/1.14.2
Date: Sun, 21 Jan 2024 17:09:11 GMT
Content-Type: text/html
Content-Length: 185
Connection: keep-alive
Location: https://www.rpiweather.net/

C:\Users\micha>curl -Ii6k https:/www.rpiweather.net
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Sun, 21 Jan 2024 17:09:22 GMT
Content-Type: text/html
Content-Length: 16955
Last-Modified: Sun, 21 Aug 2022 19:07:55 GMT
Connection: keep-alive
ETag: "6302828b-423b"
Accept-Ranges: bytes

C:\Users\micha>curl -Ii6k https:/rpiweather.net
HTTP/1.1 200 OK
Server: nginx/1.14.2
Date: Sun, 21 Jan 2024 17:09:33 GMT
Content-Type: text/html
Content-Length: 16955
Last-Modified: Sun, 21 Aug 2022 19:07:55 GMT
Connection: keep-alive
ETag: "6302828b-423b"
Accept-Ranges: bytes

Does this make everything SSL legal and legitimate?

33

[not sure how all your http and https request show only one forward slash "http:/", "https:/" - but curl seems to understand what you meant]

Yes, success!

SSL Labs agrees:
SSL Server Test: www.rpiweather.net (Powered by Qualys SSL Labs)

34

Many thanks to everyone for helping me through the SSL encryption maze!

35

Yes, that also means "pay attention to your firewall"

IPv6 has no "port forwarding" -- everything is exposed all the time, if there's no firewalls.