Differences

This shows you the differences between two versions of the page.

--- install [2021/04/02 21:37] – [KONFIMINE] rene
+++ install [2024/08/05 17:28] (current) – rene
@@ Line 327: / Line 327: @@
 == Adding HTTPS to a new subomain ==
+First make a copy of current files so that you can view diff afterwards:
+    cp /etc/apache2/sites-enabled/rene-le-ssl.conf /etc/apache2/sites-enabled/rene-le-ssl.conf_orig
+    cp /etc/apache2/sites-enabled/rene.conf /etc/apache2/sites-enabled/rene.conf_orig
+Look at a sample conf for example for "bikes.rene.ee"
 Make sure that in your apache conf (/etc/apache2/sites-enabled/rene.conf) ServerName and ServerAlias are correct! ServerName=base domain; ServerAlias=actual subdomain
@@ Line 334: / Line 341: @@
     certbot --apache
-# NB! For some odd reason this process tends to mess up bernard.ee conf (change its ServerAlias to the new domain and also point certificate files wrongly). It is done in this file: /etc/apache2/sites-enabled/rene-le-ssl.conf
+# NB! For some odd reason this process tends to mess up bernard.ee conf (/etc/apache2/sites-enabled/rene-le-ssl.conf)! Probleemid:
+  - The main ServerAlias is changed to the new domain and also certificate files point wrongly. The wrong certificate locations should have been added to the new conf section, but they are missing from there Restore right values manually based on the diff with originla conf files.
+  - Make sure the new conf starts with "<VirtualHost *:443>" and not with "<VirtualHost *:80>"
+  - Make sure the new conf section has "SSLCertificateFile" and "SSLCertificateKeyFile". Keep in mind that the cert file locations are custom to that particular subdomain and not generic to the base domain!!!
 # it does also add some rewrite rules into your own base conf (/etc/apache2/sites-enabled/rene.conf), but these seem to be just fine.
+== Renewal (new) ==
+Open up port 80 in Apache conf:
+  vi /etc/apache2/ports.conf
+Generate new certs (select option "3" and give correct base dir): /media/ssd/www/bernard.ee/):
+  certbot certonly --force-renewal -d bernard.ee
+Check what was the new folder name created for new certs:
+  l /etc/letsencrypt/live/
+Change cert folder in Apache conf (SSLCertificateFile / SSLCertificateKeyFile):
+  apache_conf
+Restart apache:
+  apache_restart
+If new cert works then remove old certs directory:
+  rm -rf /etc/letsencrypt/live/bernard.ee-0002
+# Updating rene.ee....
+NB! Ilmselt tuleb DNS'i verificationit kasutada, sest wildcard serti ei saa HTTP'ga uuendada.... vist.... Seega all olev päris ei tööta...
+Disable index preview (as we need to make rene.ee publicly accessible for renewal)
+  /etc/apache2/sites-available/rene-le-ssl.conf
+  apatche_restart
+Removce htaccess to make rene.ee publicly accessible:
+  mv /media/ssd/www/rene.ee/.htaccess /media/ssd/www/rene.ee/xhtaccess
+Rund the command (NB! Mind that it's wildcard!) (/media/ssd/www/rene.ee):
+certbot certonly --force-renewal -d *.rene.ee
+Enable index htaccess
+  mv /media/ssd/www/rene.ee/xhtaccess /media/ssd/www/rene.ee/.htaccess
+Enable index showing
+  /etc/apache2/sites-available/rene-le-ssl.conf
+  apatche_restart
+Clean up afterwards from here (not needed for web server):
+  /etc/letsencrypt/renewal
+Close port 80:
+  vi /etc/apache2/ports.conf
-== Renewal ==
+== Renewal (original) ==
-Certificates expire in 90 days, but renewal is automatic.
+Certificates expire in 90 days. Renewal can only be automatic if port 80 is open... Which by default is not...
 You can check that the daemon is working: