Bitnami Archives - WP Encryption

Fix Let’s Encrypt “R3” Root Certificate Expired or SSL Not Trusted Issue

wp_encryption — Sat, 02 Oct 2021 11:43:19 +0000

Is your HTTPS site powered by Let’s Encrypt (Open certificate authority) SSL certificate showing INSECURE, “Your connection is not private”, “ERR_CERT_AUTHORITY_INVALID” or similar SSL issue all of a sudden since September 30, 2021?. This is due to recent expiration of DST cross-signed root certificate. Likewise, you are not alone as huge number of HTTPS sites using Let’s Encrypt are impacted by this expiration.

In our previous post, we explained how to resolve the SSL not trusted / root certificate expired issue for WordPress users and WP Encryption plugin users. Whereas, this guide is focused towards anyone using Let’s Encrypt SSL on their website using Apache, Nginx, Bitnami, Lightsail, Certbot or any server/platform.

Fixing root certificate expired issue on shared hosting platforms

If you are using SSL provided by AutoSSL or your shared hosting platform, all you need to do is just re-install the SSL certificate or re-run the autossl to fix the issue, hoping that almost all hosting platforms have updated the root certificate on their platform already. If that doesn’t resolve your issue, you could manually generate new SSL certificate and install it manually on your hosting platform with new active intermediate certificate (cabundle) provided at the bottom of this post.

If you manually generated Let’s Encrypt SSL certificate using WP Encryption WordPress plugin or with any other service which helps generate free Let’s Encrypt SSL certificate, simply re-installing the existing certificate & private key with the new intermediate certificate provided at the bottom of this post would resolve the issue. If you have updated to latest release v5.7.1 of WP Encryption plugin, the new intermediate certificate is already updated so you could easily re-generate fresh SSL certificate with correct root / intermediate or you could easily download / copy the new intermediate certificate to use from the “Download SSL Certificates” page of WP Encryption.

Fixing root certificate expired issue on AWS, Digital Ocean, Self managed server

Websites hosted on self managed servers with Apache, Nginx or Bitnami needs to follow a slightly different suit. Please modify your Apache / Nginx server config file via SSH console, check for file path of SSLCACertificateFile in case of Apache (which points to your intermediate certificate file) and ssl_certificate in case of Nginx (which points to a concatenated certificate + intermediate cert file).

Apache Server:-

Please update your intermediate cert file content with the new intermediate cert provided at the bottom of this article, save the file and restart apache server to fix the HTTPS issue.

Nginx Server:-

You will notice 2 cert blocks within your ssl_certificate file and you only need to replace the bottom one with the new intermediate cert provided at the bottom of this article. Once after updating, please save the server config file and restart nginx server once to fix the HTTPS issue.

Finally, the new rise of this SSL issue only requires updating of your intermediate certificate and you don’t really need to worry about your active certificate or key file.

Let’s Encrypt Active Intermediate Certificate to Use:

The post Fix Let’s Encrypt “R3” Root Certificate Expired or SSL Not Trusted Issue appeared first on WP Encryption.

Setup CRON Job to Restart Server Monthly Once

wp_encryption — Mon, 03 May 2021 09:29:19 +0000

This guide is focused towards step by step instructions on setting up a cron job on server to restart Apache/Nginx/Bitnami monthly once so your latest SSL certificate is always loaded up automatically on frontend site without having to manually restart server.

First of all, You need to have root SSH access to your server. Otherwise, this method would not be possible as server restart requires sudo privileges and not something possible with your basic / jailed SSH access offered on shared hosting environments.

Further steps explained below:

1. Login to your SSH console as root user.

2. In case of Apache or Nginx server, please run the below command to identify your service path and make note of the path.

which service

It will be something like /usr/sbin/service

3. Run the below command to see which cron jobs you are already running.

crontab -l

4. Start editing the crontab with nano editor using below command

crontab -e

5. Using the service path you have noted, add a new monthly cron job line (runs on date 1 of each month) at the bottom of crontab editor in a new line as below

0 0 1 * * /usr/sbin/service apache2 restart > /monthlycron.log 2>&1

If you are using Nginx server, the above line should be,

0 0 1 * * /usr/sbin/service nginx restart > /monthlycron.log 2>&1

If you are using Bitnami server / Apache Lightsail, the above line should be,

0 0 1 * * /opt/bitnami/ctlscript.sh restart apache > /monthlycron.log 2>&1

Note: Both success & errors are logged in monthlycron.log file of root directory which will be helpful for debugging if server restart fails.

Press CTRL + O to save the crontab & you are all set!. You can run crontab -l command to see the saved cron job.

CAUTION:

In rare cases, If there is any error / typo in your server config file or if certificate.crt, private.pem, cabundle.crt files don’t exists in keys/ directory of your WordPress directory, your server restart could fail and your site may become inaccessible on day 1 of month. In such case, you need to correct any error logged in monthlycron.log file, fix missing cert files in keys/ directory and restart server once manually.

The post Setup CRON Job to Restart Server Monthly Once appeared first on WP Encryption.

How to Install SSL for AWS Lightsail Bitnami WordPress

wp_encryption — Tue, 25 Aug 2020 11:44:35 +0000

This tutorial demonstrates how to install Let’s Encrypt® (open certificate authority) SSL certificate for your Bitnami WordPress as well as AWS Lightsail WordPress. If you wish to use some premium SSL certificate you have purchased, feel free to upload it to a secure folder on your server and skip to step 2 below.

Technical Requirements:

Bitnami WordPress
SSH / Command line access with root privileges

1. Generate free SSL certificate provided by Let’s Encrypt®

To keep this very simple, We will make use of a WordPress plugin “WP Encryption” to generate free SSL certificate in one click.

All you need to do is just install & activate the plugin on your WordPress Admin, navigate to WP Encryption page, enter your email address and click on Generate SSL Certificate button.

This process will request and retrieve free SSL certificate from Let’s Encrypt authority for your domain. SSL certificates provided by Let’s Encrypt authority will expire in 90 days and you will need to re-generate new certificates again using the same process before the expiry date. SSL certificates cost you several $$$ a year, You could upgrade to “WP Encryption Pro” to avail auto renew feature and lifetime SSL mechanism. The required certificate.crt and private.pem files will be generated and stored in keys/ folder inside your WordPress directory.

2. Configure Bitnami to use SSL certificates by Let’s Encrypt®

Assuming you are on a default setup of Bitnami / AWS Lightsail WordPress, You will need to configure the server config file to use SSL certificate and key from correct path. This is an one time process and you don’t ever need to do it again.

Solution 1

Create a symbolic link from existing / current SSL certificate to new SSL certificates generated & stored by WP Encryption plugin. You can do so by connecting via SSH / Command line to your server and run the below SSH commands,

For Latest Bitnami:

If you are using latest bitnami instance where your WordPress site files are located in /opt/bitnami/wordpress/ folder,

cd /opt/bitnami/apache/conf/bitnami/certs

sudo ln -sf /opt/bitnami/wordpress/keys/certificate.crt server.crt

sudo ln -sf /opt/bitnami/wordpress/keys/private.pem server.key

sudo /opt/bitnami/ctlscript.sh restart apache

For Older Bitnami:

If you are using older bitnami instance where your WordPress site files are located in /opt/bitnami/apps/wordpress/htdocs/ folder, please use below commands instead of above,

cd /opt/bitnami/apache2/conf

sudo ln -sf /opt/bitnami/apps/wordpress/htdocs/keys/certificate.crt server.crt

sudo ln -sf /opt/bitnami/apps/wordpress/htdocs/keys/private.pem server.key

sudo /opt/bitnami/ctlscript.sh restart apache

Finally, Open your site with https:// protocol and check if valid certificate exists as below. If so, you are all set so please skip solution 2.

Solution 2

If the above symlink method fail, We will need to modify WordPress hosts config to use SSL certificates from correct path. Please login via SSH / Command line and follow the below procedure:

Latest Bitnami:

cd /opt/bitnami/apache2/conf/vhosts/

sudo nano wordpress-https-vhost.conf

Older Bitnami:

cd /opt/bitnami/apps/wordpress/conf/

sudo nano httpd-vhosts.conf

You will find a VirtualHost block similar to below


    ServerName yourserverdomain.com
    ServerAlias *.yourserverdomain.com
    DocumentRoot "/opt/bitnami/apps/wordpress/htdocs"

    SSLEngine on

  SSLCertificateFile "/opt/bitnami/apps/wordpress/conf/certs/new_server.crt"
  SSLCertificateKeyFile "/opt/bitnami/apps/wordpress/conf/certs/new_server.key"

    Include "/opt/bitnami/apps/wordpress/conf/httpd-app.conf"

All you need to modify here are the SSLCertificateFile and SSLCertificateKeyFile lines as below

Latest Bitnami:

SSLCertificateFile "/opt/bitnami/wordpress/keys/certificate.crt"

SSLCertificateKeyFile "/opt/bitnami/wordpress/keys/private.pem"

Older Bitnami:

SSLCertificateFile "/opt/bitnami/apps/wordpress/htdocs/keys/certificate.crt"

SSLCertificateKeyFile "/opt/bitnami/apps/wordpress/htdocs/keys/private.pem"

After making these changes, press CTRL + O to save the changes and CTRL + X to exit the file editor. Now We will need to include this httpd-vhosts config file in main config file of Bitnami, please run below commands

NOTE: Skip to restart command below if you are on Latest Bitnami server.

cd /opt/bitnami/apache2/conf/bitnami/

sudo nano bitnami-apps-vhosts.conf

This will open Bitnami vhosts file editor, at the very bottom of the file add the below line in a new line

Include "/opt/bitnami/apps/wordpress/conf/httpd-vhosts.conf"

After making these changes, press CTRL + O to save the changes and CTRL + X to exit the file editor. Lastly, restart Bitnami for changes to take effect using below command

sudo /opt/bitnami/ctlscript.sh restart

Either one of the above two solutions would definitely succeed with the SSL setup for your Bitnami WordPress. Once after you see a valid SSL certificate accessing the https:// version of your site, please change the site & admin url to https:// via Settings -> General of WP-Admin and also enable “Force HTTPS” feature of WP Encryption plugin interface if you notice any mixed content warning in browser console.

3. Resolving Intermediate Cert (CA) issue in Bitnami WordPress

Facebook share debugger and SSLLabs might show your SSL intermediate certificate is missing. Please follow the below commands to resolve the issue:

Latest Bitnami:

cd /opt/bitnami/apache2/conf/bitnami
sudo nano bitnami-ssl.conf

Older Bitnami:

cd /opt/bitnami/apache2/conf/bitnami
sudo nano bitnami.conf

Add below line just after SSLCertificateKeyFile line

Latest Bitnami:

SSLCACertificateFile "/opt/bitnami/wordpress/keys/cabundle.crt"

Older Bitnami:

SSLCACertificateFile "/opt/bitnami/apps/wordpress/htdocs/keys/cabundle.crt"

After making these changes, press CTRL + O to save the changes and CTRL + X to exit the file editor. Lastly, restart Bitnami Apache for changes to take effect using below command

sudo /opt/bitnami/ctlscript.sh restart apache

The post How to Install SSL for AWS Lightsail Bitnami WordPress appeared first on WP Encryption.