After 10/18 webmin/virtualmin module update, multiple things seem broken with virtualhost creation

hoogs · October 23, 2019, 9:19pm

Yeah, I generally use Incognito mode all the time with all browsers, except when I connect to Chrome webstore (as it won’t let you install plugins in Incongito mode)

hoogs · October 23, 2019, 9:19pm

Not now that the domain is deleted.

Dibs · October 23, 2019, 9:20pm

ROFL… I meant before you deleted it & it played up. Might be hard to answer now that’s its gone. LOL

hoogs · October 23, 2019, 9:21pm

One concern I have is that after a couple tries, LetsEncrypt stops issuing certs. (“Too many requests from this domain.”)

I tripped over that problem once, due to a -very- slow server host. After a few days, tried again; then LE issued it.

Dibs · October 23, 2019, 9:21pm

for 5. Assuming connection to http://NewDomain1 works, then “Enable Feature SSL” - I would request the LE cert too., then test.

Dibs · October 23, 2019, 9:25pm

Just saw a post on a LE forum about some guy getting that “too many requests” message but he did 5 identical requests in a week. Maybe leave the “mail” host off - so it isn’t an identical request. Or if you get a cert - make a copy of it, you can then copy it back?

hoogs · October 23, 2019, 9:26pm

[HeadDesk] [Scream]

[From Opera]
Your connection is not private
This server could not prove that it is NewDomain1; its security certificate is from DefaultDomain. This may be caused by a misconfiguration or an attacker intercepting your connection.

NET::ERR_CERT_COMMON_NAME_INVALID

[From Chrome]
Forbidden
You don’t have permission to access / on this server.

EDIT1:
I had commented out those ReWrite rules … no effect

Dibs · October 23, 2019, 9:28pm

Is that with a LE SSL cert or nothing, i.e. the self signed cert?

hoogs · October 23, 2019, 9:30pm

Nothing.

(No cert at all. Only :80 virtualhost block created.)

Dibs · October 23, 2019, 9:33pm

Any files in there? I suspect not. If not - drop the test .php & .html files in the root.

hoogs · October 23, 2019, 9:48pm

OK, both index.html and myinfo.php are now in NewDomain1/public_html , and work properly.

httpd.conf v-block for NewDomain1 does not have the ReWrite rules commented out. (Nothing commented out.)

I’ll see about adding SSL site now via “Edit Virtual Server - Enabled Features”:

https://Server_IP_Addr:10000/virtual-server/edit_domain.cgi?dom=157186493720342&xnavigation=1

hoogs · October 23, 2019, 9:51pm

SIGH.


Error signing certificate: 429 Error creating new cert :: too many certificates already issued for exact set of domains: [domainlist] : see https://letsencrypt.org/docs/rate-limits/

Dibs · October 23, 2019, 9:58pm

Have you tried changing the “exact set of domains” - so use

basically stick anything in there alongside the www? So it’s not exactly the same as last time or the last few times.

Dibs · October 23, 2019, 10:12pm

Saw the following on a LE forum post


… or you have to use “loophole” in rate limits. Certificate is counted as a duplicate, if it has exact same set of hostnames. Hence, if you request a new certificate for heidelberg.yaroscloud.com and (for example) www.heidelberg.yaroscloud.com, it won’t be treated as duplicate one.
Please note that there is also a weekly limit of 20 certificates per domain.

Where the guy was trying to request for heidelberg.yaroscloud.com (for the upmteenth time)

So put www.NewDomain1.com & MadeUp.NewDomain1.com in the hosts fields for the LE Cert and see what happens?

EDIT - put the domains in the cert that you require and the MadeUp one as well. That way you will be covered for the required domains & a non-existent one, which should be no headache. Then in 7 days time request a new one without the MadeUp one. Otherwise you could hit the weekly limit of new certs.

hoogs · October 23, 2019, 10:13pm

We’re in deep weeds now… guess I’ll have to wait a few days. :’/

testcert.NewDomain1.com challenge did not pass: Invalid response from DefaultDomain.com/.well-known/acme-challenge/xg7oI4vHWnuA8-Y1crQkuRcf4TVrojOiZkG1xfDvG0c : “\n<html lang=“en-US”>\n\n<link rel=“profile” href=“https://gmpg.org/xfn/11”>\n<meta http-equiv=“Content-Type” c”

Dibs · October 23, 2019, 10:17pm

As a last ditch attempt - maybe testcert.NewDomain1.com needs to exist. Try creating a subdomain called testcert for NewDomain1.com. Basically same as create New Virtual Server except at the top select it to be a subdomain (subserver) of NewDomain1.com.

Whether it works or not isn’t relevant I think - when LE checks it should be there.

EDIT - or maybe just request it for the single domain for now, i.e. www.NewDomain1.com on it’s own? Previously you’ve done root domain, www & mail, so www on it’s own isn’t a duplicate. And might allow you to carry on with the “testing”.

hoogs · October 23, 2019, 10:53pm

Requested for NewDomain1.com, and www.NewDomain1.com. (Dropped mail, as I don’t use mail on this server anyway…)

LE approved that.

Dibs · October 23, 2019, 11:28pm

So if LE supplied the SSL - does that mean that the .html & .php files now display correctly on NewDomain1.com (both HTTP & HTTPS)? Assuming the CF proxy is still turned off. It files display correctly with the CF proxy off - what happens if you turn the proxy on?

[Make a copy of the cert just in case. Don’t put it in a directory that belongs to that VirtualHost ; ) ]

hoogs · October 24, 2019, 12:59am

Somebody shoot me, I’m in (virtualmin) Hell.

I tried fiddling manually with the main public_html dir (minor stuff) and suddenly the website started giving me ERR_TOO_MANY_REDIRECT errors again.

So… after futzing with multiple variations of editing httpd.conf and then adding/removing website options via Virtualmin – and consistently failing – I saved the SSL cert file and blew away NewDomain1 and remade it, and put the SSL certs back in.

#FAIL again.

This led me down the well-trod path of deleting / recreating NewDomain1 and consistently #FAIL’ing again.

I have NO idea what is causing these problems. I just know that ever since 10/18 nothing works. At least, not for long.

#SCREAM

Dibs · October 24, 2019, 3:58am

I can sympathise with your plight. What I would say is that it would be best to go back to your 5 point plan (sort of).

Turn off your CF proxy & leave it off until you get a successful result. [?]
You need to get a basic webpage to display in html & php. Just HTTP is fine, so (re)create a VirtualServer for NewDomain1.com with just Website Enabled. [?]
Place your .php & .html files in the public folder & test that they display. [?]

Without this - no point going further. Assuming you are successful at this stage: [?]

enable the SSL for the website. [?] Then in SSL serts (Server Conf) look at the current cert - it should be a self signed one. [?] Note it’s location and check (and note) the persmissions. [?]
Place your backed up cert there and ensure it’s permissions are the same. [?] Even make the file name the same for now if need be. [?]
Go back to Server Configs - SSL certs & check that Current Cert’s details are as expected, i.e. issued by LE & the time\date should marry up to when you requested it prior to saving it. [?]
At this point test via HTTPS for the .html file & .php files - that they display.[?]
If all is well, switch on your CF proxy and test it works. [?]

You may find the following useful - https://stackoverflow.com/questions/41583088/http-to-https-nginx-too-many-redirects - I know it isn’t about Apache, but the CF proxies and SSL certs and how they interplay might be useful.

Give it a go and use the above tasks in the bullet points above and reply back adding some commentary to the bullet points, i.e. use them as a bit of a check list? Feel free to cut & paste it back into your reply. I’ve left [?] place holders for a Yes or a No, or a fuller answer if you feel that adds to things.

HIH

p.s. As the saying goes “The morning is wiser than the evening.” - might be an idea to leave it for a day and then come back to it.