OK. Fresh start:
- I reloaded the default httpd.conf, as supplied in the RL 9 distribution. ONLY modification is, that I had to add “ServerName hartings.se:80”. Without specifying this, Apache could not find the domain name and said upon starting:
Oct 23 14:33:10 server.hartings.se httpd[281803]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using server.hartings.se. Set the 'ServerName' directive globally to suppress this message
- /etc/httpd/conf/httpd-le-ssl.conf as configured by the system - no manual changes
- /etc/letsencrypt/options-ssl-apache.conf as configured by the system - no manual changes
[root@server conf]# more /etc/letsencrypt/options-ssl-apache.conf
# This file contains important security parameters. If you modify this file
# manually, Certbot will be unable to automatically provide future security
# updates. Instead, Certbot will print and log an error message with a path to
# the up-to-date file that you will need to refer to when manually updating
# this file. Contents are based on https://ssl-config.mozilla.org
SSLEngine on
# Intermediate configuration, tweak to your needs
SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:
ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder off
SSLSessionTickets off
SSLOptions +StrictRequire
# Add vhost name to log entries:
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\"" vhost_combined
LogFormat "%v %h %l %u %t \"%r\" %>s %b" vhost_common
[root@server conf]#
- /etc/hosts:
[root@server conf]# ping -c 5 hartings.se
PING hartings.se (192.168.1.221) 56(84) bytes of data.
64 bytes from hartings.se (192.168.1.221): icmp_seq=1 ttl=64 time=0.041 ms
64 bytes from hartings.se (192.168.1.221): icmp_seq=2 ttl=64 time=0.017 ms
64 bytes from hartings.se (192.168.1.221): icmp_seq=3 ttl=64 time=0.016 ms
64 bytes from hartings.se (192.168.1.221): icmp_seq=4 ttl=64 time=0.016 ms
64 bytes from hartings.se (192.168.1.221): icmp_seq=5 ttl=64 time=0.020 ms
--- hartings.se ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4119ms
rtt min/avg/max/mdev = 0.016/0.022/0.041/0.009 ms
[root@server conf]# more /etc/hosts
127.0.0.1 localhost localhost4 localhost4.localdomain4
::1 localhost server.hartings.se localhost6 localhost6.localdomain6
192.168.1.221 hartings.se
[root@server conf]#
- All certificates as installed by the system - no manual changes, not touched:
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
Result in browser (after clearing cache and restarting browser):
With these default settings, and the installed LetsEncrypt certificate, it should show the hartings.se certificates, I think.
So I add the two LetsEncrypt SSLCertificate lines at the end of the httpd.conf
(This should NOT be required, as they are in the file /etc/httpd/conf/httpd-le-ssl.conf)
[root@server conf]# more httpd-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName hartings.se
Redirect / https://hartings.se/
ServerAlias www.hartings.se
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.
# RewriteCond %{SERVER_NAME} =www.hartings.se [OR]
# RewriteCond %{SERVER_NAME} =hartings.se
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/hartings.se/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/hartings.se/privkey.pem
</VirtualHost>
</IfModule>
[root@server conf]#
Restart httpd, clear cache in browser and restart browser.
Now the browser shows the following:
Why is the certificate “server.hartings.se” still there?
What did I do wrong here? Or could it be a bug in the OS?
As before, any hint on what to check/correct is very welcome!
