2

Ok so I forgot to renew my Let's Encrypt Server Certificate, and well I just can't startup Apache. Here is the present CentOS is giving me instead:

service httpd status
Redirecting to /bin/systemctl status httpd.service
● httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Sat 2019-03-23 18:55:50 PDT; 6s ago
     Docs: man:httpd(8)
           man:apachectl(8)
  Process: 3216 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=1/FAILURE)
  Process: 32430 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful (code=exited, status=0/SUCCESS)
  Process: 3213 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
 Main PID: 3213 (code=exited, status=1/FAILURE)

Mar 23 18:55:50 localhost.localdomain systemd[1]: Starting The Apache HTTP Server...
Mar 23 18:55:50 localhost.localdomain httpd[3213]: AH00558: httpd: Could not reliably determine the server's fully qualified domain name...message
Mar 23 18:55:50 localhost.localdomain systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
Mar 23 18:55:50 localhost.localdomain kill[3216]: kill: cannot find process ""
Mar 23 18:55:50 localhost.localdomain systemd[1]: httpd.service: control process exited, code=exited status=1
Mar 23 18:55:50 localhost.localdomain systemd[1]: Failed to start The Apache HTTP Server.
Mar 23 18:55:50 localhost.localdomain systemd[1]: Unit httpd.service entered failed state.
Mar 23 18:55:50 localhost.localdomain systemd[1]: httpd.service failed.
Hint: Some lines were ellipsized, use -l to show in full.

So for the life of me I don't know what is going wrong. I can't get this to start... and therefor I also cannot renew my certificate. Have I been Hakerd? I guess I shouldn't be terse and idiotic with my request for help. Here is the related & recent content of my Apache logs /var/log/httpd/error_log:

[Sat Mar 23 16:27:43.414544 2019] [core:error] [pid 1330] AH00546: no record of generation 19 of exiting child 19951
[Sat Mar 23 16:27:43.533511 2019] [:error] [pid 19955] SSL Library Error: -8181 Certificate has expired
[Sat Mar 23 16:27:43.533542 2019] [:error] [pid 19955] Unable to verify certificate 'Server-Cert'. Add "NSSEnforceValidCerts off" to nss.conf so the server can start until the problem can be resolved.

/var/log/httpd/ssl_error_log:

[Sat Mar 23 16:40:20.015874 2019] [ssl:warn] [pid 21695] AH01909: RSA certificate configured for localhost.localdomain:443 does NOT include an ID which matches the server name
[Sat Mar 23 16:40:54.682141 2019] [ssl:warn] [pid 21735] AH01909: RSA certificate configured for localhost.localdomain:443 does NOT include an ID which matches the server name

All I want is to get my server back up and running fast, and suddenly I think I am in Logans Run and everyone else is winning but me...............

I know its 2019 and I have my options, but I'm still using Apache cause my distro had it, and its worked like this forever you see.

I get lazy I admit it. Sometimes my life is busy, sometimes the client want so much I'm tired, and I forget to go to meetups, free workshops, or even to wash the dog.

1 Answer 1

1

I dealt with this already this year, and the strange thing is that this has nothing to do with your SSL Server Cert or being Hackerd. If you read the log you submitted you'll actually find a suggestion from Apache on what to do. If you Add this line:

NSSEnforceValidCerts off

to /etc/httpd/conf.d/nss.conf you will be able to start your server again. Don't worry the cypher gangs haven't uploaded a sploit to end your servers capabilities. There is a great answer here on what is going wrong: https://serverfault.com/posts/578073/revisions

Likely best to uninstall NSS, since your probably not using it anyway. It's just the crappy timing of your NSS cert going bad, and also coinciding with your SSL cert going bad. The NSS cert is unrelated to the SSL cert.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .