I've been trying to get a Let's Encrypt certificate, key and chain to work.

But I have also done some stuff that I know I didn't need to before I realized what to do.

Port 443 wasn't open so I've also been doing some stuff with "ports.conf" but I've changed that back to how it was, I think.

I modified the default-ssl.conf and did an a2ensite but the normal mywebsite.com.conf was still active.

There was an error in the file path to the keys, so I fixed that and tried to reboot apache2 but that's when the real problems started.

I tried a2dissite on one and both conf files (normal and SSL) but couldn't get apache to restart.

The only other thing was I did some thing I didn't need to like making a CSR and adding it to the certificate file.

Here's what it was saying:

● apache2.service - LSB: Apache2 web server
Loaded: loaded (/etc/init.d/apache2)
Drop-In: /lib/systemd/system/apache2.service.d
Active: failed (Result: exit-code) since Wed 2017-01-18 06:23:59 PST; 3min 31s ago
Process: 31878 ExecStop=/etc/init.d/apache2 stop (code=exited, status=0/SUCCESS)
Process: 31861 ExecReload=/etc/init.d/apache2 reload (code=exited, status=1/FAILURE)
Process: 30542 ExecStart=/etc/init.d/apache2 start (code=exited, status=0/SUCCESS)

Jan 18 06:22:10 archimedes systemd[1]: apache2.service: control process exited, code=exited status=1
Jan 18 06:22:10 archimedes systemd[1]: Reload failed for LSB: Apache2 web server.
Jan 18 06:23:37 archimedes systemd[1]: Reloading LSB: Apache2 web server.
Jan 18 06:23:38 archimedes apache2[31861]: Reloading web server: apache2 failed!
Jan 18 06:23:38 archimedes apache2[31861]: Apache2 is not running ... (warning).
Jan 18 06:23:38 archimedes systemd[1]: apache2.service: control process exited, code=exited status=1
Jan 18 06:23:38 archimedes systemd[1]: Reload failed for LSB: Apache2 web server.
Jan 18 06:23:59 archimedes apache2[31878]: Stopping web server: apache2.
Jan 18 06:23:59 archimedes systemd[1]: Unit apache2.service entered failed state.
 Jan 18 06:27:04 archimedes systemd[1]: Unit apache2.service cannot be reloaded because it is inactive.

Then I had a look at another thread from here and someone mentioned sudo reboot so I tried this and putty froze. But when I re-opened putty I was able to restart apache2 and it's back to normal HTTP now.

Any ideas what I did wrong?

Is going in and adding the SSL to sites-enabled again a good thing to do? It seems that port 443 is open now, which is a good thing.

EDIT: apache2.conf...

Mutex file:${APACHE_LOCK_DIR} default
Timeout 300
KeepAlive Off
MaxKeepAliveRequests 100
KeepAliveTimeout 5
HostnameLookups Off
ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
IncludeOptional mods-enabled/*.load
IncludeOptional mods-enabled/*.conf
Include ports.conf
<Directory />
    Options FollowSymLinks
    AllowOverride None
    Require all denied

<Directory /usr/share>
    AllowOverride None
    Require all granted

<Directory /var/www/>
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted

and, "mywebsite.com.conf"...

<VirtualHost *:80>
    ServerAdmin webmaster@mywebsite.com
    ServerName mywebsite.com
    ServerAlias www.mywebsite.com
    DocumentRoot /var/www/html

    ErrorLog /var/www/logs/error.log
    CustomLog /var/www/logs/access.log combined

    <Directory /var/www/html/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride all
            Order allow,deny
            allow from all

  • Thank you. I've just added the apache2.conf to the question. The server only has one website on it so those files are all in the "/var/www/html/" directory. – sdexp Jan 19 '17 at 5:07
  • Added mywebsite.com.conf. I've just done a sudo apache2ctl -M and ssl_module (shared) is on there, so yes. Maybe I did things in the wrong order? – sdexp Jan 19 '17 at 5:17
  • Yes, sorry, definitely made progress. I need to check your points 1 and 2. UFW allows 443. I'm getting a "unexpectedly closed the connection" error. Definitely progress though, thank you. – sdexp Jan 19 '17 at 5:45
  • If some problems persist or any new show up, feel free to ask a new question. – LinuxSecurityFreak Jan 19 '17 at 5:46
  1. Make sure to allow ports 80 and 443 in your router.

  2. Make sure to forward ports 80 and 443 to your server.

  3. Make sure to have punched holes in your firewall:

    sudo iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
    sudo iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
  4. Define VirtualHost for port 443 (as well as for 80):

    <VirtualHost *:80>
    ... your code here ...
    <IfModule mod_ssl.c>
      <VirtualHost *:443>
      ... your code here ...
  5. Activate mod_rewrite:

    sudo a2enmod rewrite
  6. Define a redirect from HTTP to HTTPS, something like:

    RewriteCond            %{HTTPS} !on
    RewriteRule            ^/?(.*) https://%{SERVER_NAME}/$1 [R=301]
  7. And finally restart Apache:

    sudo service apache2 restart
  • About point 4... I had the <VirtualHost *:443> in the default-ssl.conf which was enabled. Are you saying that I should just have one conf file enabled and put everything for both ports in there? – sdexp Jan 19 '17 at 5:25
  • @sdexp Yes, you should have just one file. – LinuxSecurityFreak Jan 19 '17 at 5:26
  • Ok, thanks. I hadn't done the rewrite rule yet, but that wouldn't cause apache to freak out, right? When I type "mywebsite.com:443" it forwards to "https" now, so I think it must have been the two files. Many thanks! – sdexp Jan 19 '17 at 5:31
  • @sdexp You are always welcome here. – LinuxSecurityFreak Jan 19 '17 at 5:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.