0

I am trying to install a Let's Encrypt certificate on a Oracle Linux Server 7.6. Since the server does not have a public IP, I had to validate via DNS.I followed the instructions here https://github.com/joohoi/acme-dns-certbot-joohoi and the validation worked and I got the certificate. How do I now install the certificate?

I followed instructions online and moved the certificate to etc/ssl/certs and deleted the old certificate. After restarting the machine however the website does not work and I get an error site cannot be reached.

I can interact with the server only via SSH.

0

I believe this should be comparable to CentOS 7.6. The path etc/ssl/certs is simply a symbolic link to /etc/pki/tls/certs/. The certificate is divided into two parts, the first which you have already mentioned is the *.crt file which contains the public key and shall be placed in /etc/pki/tls/certs/ which is in my case certificate.crt, while the other part is the private key, and shall be placed in /etc/pki/tls/private/, usually has *.key extension, in my case private.key.

In case you are using Apache web server, here is a working example of my redmine.conf, it should be enough to guide you thru:

<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{HTTPS}  !=on
    RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
</VirtualHost>


<VirtualHost *:443>
    ServerName www.example.com
    ServerAlias 192.0.2.37

    SSLEngine on
    SSLCertificateFile /etc/pki/tls/certs/certificate.crt
    SSLCertificateKeyFile /etc/pki/tls/private/private.key
    SSLCertificateChainFile /etc/pki/tls/certs/ca_bundle.crt

    DocumentRoot /var/www/html/redmine/public

    <Directory /var/www/html/redmine/public>
      Allow from all
      Options -MultiViews
      Require all granted
    </Directory>
</VirtualHost>

I almost forgot to mention - which might solve your problem - is that you need to make sure that you have firewall rules in place, and permanent ones as follows:

firewall-cmd --permanent --add-service=http --add-service=https --zone=public
firewall-cmd --reload

Also, make sure you have SeLinux disabled in case you have not changed its rules for your web service.

  • Thank you, I got it to work. The main thing that I was missing was modifying the request_tracker.conf to point to the new SSL certificate. – cflasrado Aug 2 at 14:08
  • What is the purpose of ServerAlias with an IP address? If there is an HTTPS access with the IP as hostname in the URL the certificate will not match (as it does not have the IP address in it, just the hostname) – Patrick Mevzek Aug 5 at 22:20
  • Completely disabling Selinux may have far reaching consequences... – Patrick Mevzek Aug 5 at 22:21
  • ServerAlias is not necessary in this case, still you can use it regardless of the certificate, you can bypass it on the browser – elekgeek Aug 12 at 14:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.