/ Register

Discover Centmin Mod today
Register Now

Wordpress Wordpress self-signed SSL certificate not issued

Discussion in 'Blogs & CMS usage' started by drabhaydaga, Apr 24, 2020.

Previous Thread Next Thread
Loading...
  1. Apr 24, 2020 #1
    drabhaydaga

    drabhaydaga New Member

    28
    3
    3
    Nov 24, 2018
    Ratings:
    +3
    Local Time:
    8:46 AM
    just 1 issue tried to install new wordpress site with self signed ssl
    self signed ssl is not issued
    even after

    Create a self-signed SSL certificate Nginx vhost? [y/n]: y


    also due to which i am not able to login my admin panel

    you can check https://hanilmedicare.com/

    its my test domain
     
  2. Apr 24, 2020 #2
    eva2000

    eva2000 Administrator Staff Member

    59,284
    12,509
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,141
    Local Time:
    1:16 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    When you create a new nginx vhost domain via centmin.sh menu option 2 or menu option 22 or via /usr/bin/nv cli command line, you will create the Nginx vhost files and directories. You will get an outputted the path location where it will create the domain name's vhost conf file named newdomain.com.conf (and newdomain.com.ssl.conf if you selected yes to self signed SSL)
    • Nginx vhost conf path will be at /usr/local/nginx/conf/conf.d/newdomain.com.conf
    • Nginx HTTP/2 SSL vhost conf path will be at /usr/local/nginx/conf/conf.d/newdomain.com.ssl.conf
    • Nginx Self-Signed SSL Certificate Directory at /usr/local/nginx/conf/ssl/newdomain.com
    • Vhost public web root will be at /home/nginx/domains/newdomain.com/public
    • Vhost log directory will be at /home/nginx/domains/newdomain.com/log
    Please post the contents of /usr/local/nginx/conf/conf.d/newdomain.com.conf and if applicable /usr/local/nginx/conf/conf.d/newdomain.com.ssl.conf wrapped in CODE tags (outlined at How to use forum BBCODE code tags)

    what is output of these commands in ssh
    Code (Text):
    curl -Ik https://domain.com

    Code (Text):
    curl -Ik https://www.domain.com

    Code (Text):
    curl -I http://domain.com

    Code (Text):
    curl -I http://www.domain.com

    wrap output in CODE tags
     
  3. Apr 24, 2020 #3
    eva2000

    eva2000 Administrator Staff Member

    59,284
    12,509
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,141
    Local Time:
    1:16 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    but self-signed ssl cert does exist when i check the domain at Check SSL Certificate
    self-signed ssl certs are untrusted in browsers so they will be unsecure and used only for testing and you need to in browser click through and ignore the warnings. If you want valid ssl certs you need letsencrypt SSL certs

    There's generally 3 ways of setting up HTTPS SSL certificate for Centmin Mod Nginx HTTP/2 based HTTPS which are web browser trusted via Letsencrypt SSL certs instead of self-signed SSL certs

    Method 1. The traditional way via centmin.sh menu option 2, 22 but ensuring you set LETSENCRYPT_DETECT='y' in persistent config file created at /etc/centminmod/custom_config.inc before you run centmin.sh menu option 2 or 22 for wordpress. You can do that using command below - only need to do this step once and every subsequent run of centmin.sh menu option 2 or 22 will have letsencrypt ssl certificate support enabled
    Code (Text):
    # enable letsencrypt ssl certificate integration https://centminmod.com/acmetool/
touch /etc/centminmod/custom_config.inc
echo "LETSENCRYPT_DETECT='y'" >> /etc/centminmod/custom_config.inc


    Method 2. Using and testing Centmin Mod 123.09beta01's new addons/acmetool.sh addon which is still in beta testing only for integrating Letsencrypt SSL certificates. And has both auto and manual methods.

    Method 3. Fully manual method for free Letsencrypt SSL certificates.
    If you want to switch from self-signed SSL cert to letsencrypt SSL certificates, try acmetool.sh add reissue-only option for existing nginx HTTPS SSL vhosts with domain.com.ssl.conf vhost config files that exist. This only does reissue of letsencrypt SSL cert without touching the nginx vhost. Ideal for use when you tried creating a Nginx HTTPS SSL default vhost site but letsencrypt SSL issuance failed the first time. When it fails, Centmin Mod usually falls back to self-signed SSL as a place holder for the domain.com.ssl.conf vhost config. When you run:
    Code (Text):
    cd /usr/local/src/centminmod/addons
./acmetool.sh reissue-only domain.com live

    It will only try reissuing the letsencrypt SSL certificate for the domain = domain.com for live production SSL certificate without touching any of the existing nginx vhost at domain.com.ssl.conf
     
  4. Apr 24, 2020 #4
    drabhaydaga

    drabhaydaga New Member

    28
    3
    3
    Nov 24, 2018
    Ratings:
    +3
    Local Time:
    8:46 AM
    /usr/local/nginx/conf/conf.d/newdomain.com.conf

    Code:
    # Centmin Mod Getting Started Guide
# must read http://centminmod.com/getstarted.html

# redirect from non-www to www
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
#server {
#            listen   80;
#            server_name hanilmedicare.com;
#            return 301 $scheme://www.hanilmedicare.com$request_uri;
#       }

server {
 
  server_name hanilmedicare.com www.hanilmedicare.com;

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  #add_header X-Frame-Options SAMEORIGIN;
  add_header X-Xss-Protection "1; mode=block" always;
  add_header X-Content-Type-Options "nosniff" always;
  #add_header Referrer-Policy "strict-origin-when-cross-origin";
  #add_header Feature-Policy "accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'";

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/hanilmedicare.com/log/access.log combined buffer=256k flush=5m;
  error_log /home/nginx/domains/hanilmedicare.com/log/error.log;

  include /usr/local/nginx/conf/autoprotect/hanilmedicare.com/autoprotect-hanilmedicare.com.conf;
  root /home/nginx/domains/hanilmedicare.com/public;
  # uncomment cloudflare.conf include if using cloudflare for
  # server and/or vhost site
  #include /usr/local/nginx/conf/cloudflare.conf;
  include /usr/local/nginx/conf/503include-main.conf;

  #include /usr/local/nginx/conf/wpincludes/hanilmedicare.com/wpcacheenabler_hanilmedicare.com.conf;
  #include /usr/local/nginx/conf/wpincludes/hanilmedicare.com/wpsupercache_hanilmedicare.com.conf;
  # https://community.centminmod.com/posts/18828/
  include /usr/local/nginx/conf/wpincludes/hanilmedicare.com/rediscache_hanilmedicare.com.conf; 

  location / {
  include /usr/local/nginx/conf/503include-only.conf;
 

  # Enables directory listings when index file not found
  #autoindex  on;

  # for wordpress super cache plugin
  #try_files /wp-content/cache/supercache/$http_host/$cache_uri/index.html $uri $uri/ /index.php?q=$uri&$args;

  # for wp cache enabler plugin
  #try_files $cache_enabler_uri $uri $uri/ $custom_subdir/index.php?$args;

  # Wordpress Permalinks
  #try_files $uri $uri/ /index.php?q=$uri&$args; 

  # Nginx level redis Wordpress
  # https://community.centminmod.com/posts/18828/
  try_files $uri $uri/ /index.php?$args;

  }

location ~* /(wp-login\.php) {
    limit_req zone=xwplogin burst=1 nodelay;
    #limit_conn xwpconlimit 30;
    #auth_basic "Private";
    #auth_basic_user_file /home/nginx/domains/hanilmedicare.com/htpasswd_wplogin;   
    #include /usr/local/nginx/conf/php-wpsc.conf;
    # https://community.centminmod.com/posts/18828/
    include /usr/local/nginx/conf/php-rediscache.conf;
}

location ~* /(xmlrpc\.php) {
    limit_req zone=xwprpc burst=45 nodelay;
    #limit_conn xwpconlimit 30;
    #include /usr/local/nginx/conf/php-wpsc.conf;
    # https://community.centminmod.com/posts/18828/
    include /usr/local/nginx/conf/php-rediscache.conf;
}

location ~* /wp-admin/(load-scripts\.php) {
    limit_req zone=xwprpc burst=5 nodelay;
    #limit_conn xwpconlimit 30;
    #include /usr/local/nginx/conf/php-wpsc.conf;
    # https://community.centminmod.com/posts/18828/
    include /usr/local/nginx/conf/php-rediscache.conf;
}

location ~* /wp-admin/(load-styles\.php) {
    limit_req zone=xwprpc burst=5 nodelay;
    #limit_conn xwpconlimit 30;
    #include /usr/local/nginx/conf/php-wpsc.conf;
    # https://community.centminmod.com/posts/18828/
    include /usr/local/nginx/conf/php-rediscache.conf;
}

  include /usr/local/nginx/conf/wpincludes/hanilmedicare.com/wpsecure_hanilmedicare.com.conf;
  #include /usr/local/nginx/conf/php-wpsc.conf;
 
  # https://community.centminmod.com/posts/18828/
  include /usr/local/nginx/conf/php-rediscache.conf;
  include /usr/local/nginx/conf/pre-staticfiles-local-hanilmedicare.com.conf;
  include /usr/local/nginx/conf/pre-staticfiles-global.conf;
  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}
    /usr/local/nginx/conf/conf.d/hanilmedicacare.com.ssl.conf

    Code:
    # Centmin Mod Getting Started Guide
# must read http://centminmod.com/getstarted.html
# For HTTP/2 SSL Setup
# read http://centminmod.com/nginx_configure_https_ssl_spdy.html

# redirect from www to non-www  forced SSL
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
# server {
#   server_name hanilmedicare.com www.hanilmedicare.com;
#    return 302 https://$server_name$request_uri;
# }

server {
  listen 443 ssl http2;
  server_name hanilmedicare.com www.hanilmedicare.com;

  ssl_dhparam /usr/local/nginx/conf/ssl/hanilmedicare.com/dhparam.pem;
  ssl_certificate      /usr/local/nginx/conf/ssl/hanilmedicare.com/hanilmedicare.com.crt;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/hanilmedicare.com/hanilmedicare.com.key;
  include /usr/local/nginx/conf/ssl_include.conf;

  # cloudflare authenticated origin pull cert community.centminmod.com/threads/13847/
  #ssl_client_certificate /usr/local/nginx/conf/ssl/cloudflare/hanilmedicare.com/origin.crt;
  #ssl_verify_client on;
  http2_max_field_size 16k;
  http2_max_header_size 32k;
  http2_max_requests 5000;
  # mozilla recommended
  ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS;
  ssl_prefer_server_ciphers   on;
  #add_header Alternate-Protocol  443:npn-spdy/3;

  # before enabling HSTS line below read centminmod.com/nginx_domain_dns_setup.html#hsts
  #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
  #add_header X-Frame-Options SAMEORIGIN;
  add_header X-Xss-Protection "1; mode=block" always;
  add_header X-Content-Type-Options "nosniff" always;
  #add_header Referrer-Policy "strict-origin-when-cross-origin";
  #add_header Feature-Policy "accelerometer 'none'; camera 'none'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'none'";
  #spdy_headers_comp 5;
  ssl_buffer_size 1369;
  ssl_session_tickets on;
 
  # enable ocsp stapling
  #resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 valid=10m;
  #resolver_timeout 10s;
  #ssl_stapling on;
  #ssl_stapling_verify on;
  #ssl_trusted_certificate /usr/local/nginx/conf/ssl/hanilmedicare.com/hanilmedicare.com-trusted.crt; 

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/hanilmedicare.com/log/access.log combined buffer=256k flush=5m;
  error_log /home/nginx/domains/hanilmedicare.com/log/error.log;

  include /usr/local/nginx/conf/autoprotect/hanilmedicare.com/autoprotect-hanilmedicare.com.conf;
  root /home/nginx/domains/hanilmedicare.com/public;
  # uncomment cloudflare.conf include if using cloudflare for
  # server and/or vhost site
  #include /usr/local/nginx/conf/cloudflare.conf;
  include /usr/local/nginx/conf/503include-main.conf;

  #include /usr/local/nginx/conf/wpincludes/hanilmedicare.com/wpcacheenabler_hanilmedicare.com.conf;
  #include /usr/local/nginx/conf/wpincludes/hanilmedicare.com/wpsupercache_hanilmedicare.com.conf;
  # https://community.centminmod.com/posts/18828/
  include /usr/local/nginx/conf/wpincludes/hanilmedicare.com/rediscache_hanilmedicare.com.conf; 

  location / {
  include /usr/local/nginx/conf/503include-only.conf;
 

  # Enables directory listings when index file not found
  #autoindex  on;

  # for wordpress super cache plugin
  #try_files /wp-content/cache/supercache/$http_host/$cache_uri/index.html $uri $uri/ /index.php?q=$uri&$args;

  # for wp cache enabler plugin
  #try_files $cache_enabler_uri $uri $uri/ $custom_subdir/index.php?$args; 

  # Wordpress Permalinks
  #try_files $uri $uri/ /index.php?q=$uri&$args;

  # Nginx level redis Wordpress
  # https://community.centminmod.com/posts/18828/
  try_files $uri $uri/ /index.php?$args;

  }

location ~* /(wp-login\.php) {
    limit_req zone=xwplogin burst=1 nodelay;
    #limit_conn xwpconlimit 30;
    #auth_basic "Private";
    #auth_basic_user_file /home/nginx/domains/hanilmedicare.com/htpasswd_wplogin;   
    #include /usr/local/nginx/conf/php-wpsc.conf;
    
    # https://community.centminmod.com/posts/18828/
    include /usr/local/nginx/conf/php-rediscache.conf;
}

location ~* /(xmlrpc\.php) {
    limit_req zone=xwprpc burst=45 nodelay;
    #limit_conn xwpconlimit 30;
    #include /usr/local/nginx/conf/php-wpsc.conf;
    
    # https://community.centminmod.com/posts/18828/
    include /usr/local/nginx/conf/php-rediscache.conf;
}

location ~* /wp-admin/(load-scripts\.php) {
    limit_req zone=xwprpc burst=5 nodelay;
    #limit_conn xwpconlimit 30;
    #include /usr/local/nginx/conf/php-wpsc.conf;
    
    # https://community.centminmod.com/posts/18828/
    include /usr/local/nginx/conf/php-rediscache.conf;
}

location ~* /wp-admin/(load-styles\.php) {
    limit_req zone=xwprpc burst=5 nodelay;
    #limit_conn xwpconlimit 30;
    #include /usr/local/nginx/conf/php-wpsc.conf;
    
    # https://community.centminmod.com/posts/18828/
    include /usr/local/nginx/conf/php-rediscache.conf;
}

  include /usr/local/nginx/conf/wpincludes/hanilmedicare.com/wpsecure_hanilmedicare.com.conf;
  #include /usr/local/nginx/conf/php-wpsc.conf;
 
  # https://community.centminmod.com/posts/18828/
  include /usr/local/nginx/conf/php-rediscache.conf;
  include /usr/local/nginx/conf/pre-staticfiles-local-hanilmedicare.com.conf;
  include /usr/local/nginx/conf/pre-staticfiles-global.conf;
  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}
    Code:
    [03:47][root@spinefitmedical ~]# curl -I http://hanilmedicare.com
HTTP/1.1 200 OK
Date: Fri, 24 Apr 2020 04:21:01 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding
Link: <https://hanilmedicare.com/wp-json/>; rel="https://api.w.org/"
Server: nginx centminmod
X-Powered-By: centminmod
X-Cache: MISS
X-Cache-2: BYPASS
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
    Code:
    HTTP/1.1 301 Moved Permanently
Date: Fri, 24 Apr 2020 04:22:49 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
X-Redirect-By: WordPress
Location: http://hanilmedicare.com/
Server: nginx centminmod
X-Powered-By: centminmod
X-Cache: MISS
X-Cache-2: BYPASS
X-Xss-Protection: 1; mode=block
X-Content-Type-Options: nosniff
     
  5. Apr 24, 2020 #5
    eva2000

    eva2000 Administrator Staff Member

    59,284
    12,509
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,141
    Local Time:
    1:16 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Looks all ok along with ssl check site i mentioned shows self-signed SSL certificate exists and is working as expected. It's untrusted in browsers so needs for you to manually ignore the warnings. As stated for live use and trust in web browsers, you want letsencrypt SSL cert instead of self-sign using the above reissue method via acmetool.sh or in future for new wordpress sites creation select letsencrypt ssl cert instead
     
Previous Thread Next Thread
Loading...

.