Secure Connection Failed

[Andrasf (Andras)]

**NethServer Version:7.9

Hi,
I tried to change the SSL Cert by uploading a wildcard ssl to the server but I received an error message when tried to set the cert for a reverse proxy and since then the web gui is unreachable, the reverse proxy isn’t working.
When I try to open the gui I receive the following error:

the /var/www/html folder contains only a .well-known folder witch has another empty folder in it.
I had no web pages on the server but I’m not sure if this should be empty, or where actually is the Nethserver webpage at all.

The vpn is working on the server.

Please help me restore the server so I could reach the gui and get the reverse proxy to work.
thx

[pike (Michael Kicks)]

Nethserver… 7.6? Really?

[Andrasf (Andras)]

I wasn’t sure, since it’s not working I couldn’t check, corrected to 7.9

[pike (Michael Kicks)]

Can you access via SSH?

[Andrasf (Andras)]

yes I can

[dnutan (Marc)]

You can “reset” configuration to default certificate:

Update break mail module

In the past this worked to reset certificate settings and fallback to self-signed cert: config show pki #just to know current settings config setprop pki CrtFile '' config setprop pki KeyFile '' config setprop pki ChainFile '' signal-event certificate-update

Do not know about the reverse proxy.

[Andrasf (Andras)]

Hi
unfortunately:
config: command not found

[Andrasf (Andras)]

created new key and a self signed certificate, copied them into place, now the httpd service is able to start but the web gui still won’t load, the same error appears

[dnutan (Marc)]

as root user?

[Andrasf (Andras)]

not, just sudoer, should I do it as root?

[dnutan (Marc)]

yes, as root… you cau use su - to switch to

[Andrasf (Andras)]

did as root but I got the same result.
here is what I did as root:
openssl genrsa -out domain.key 2048
openssl req -key domain.key -new -out domain.csr
openssl x509 -signkey domain.key -in domain.csr -req -days 730 -out domain.crt
cp domain.crt /etc/pki/tls/certs/localhost.crt
cp domain.key /etc/pki/tls/private/localhost.key
service httpd restart

[dnutan (Marc)]

what about the config commands? you get command not found as root?
cockpit (port 9090) does not rely on httpd (IIRC). Old server manager (neth-gui, port 980 relies on apache but has configured it’s own service httpd-admin)

there are a couple of cockpit services (if memory serves me well):

systemctl status -l cockpit.service cockpit.socket

[Andrasf (Andras)]

[root@ad gyaradm]# config
bash: config: command not found

[root@ad gyaradm]# systemctl status -l cockpit.service cockpit.socket
part of the reply:
● cockpit.socket - Cockpit Web Service Socket
Loaded: loaded (/usr/lib/systemd/system/cockpit.socket; enabled; vendor preset: disabled)
Active: active (listening) since Fri 2022-09-16 19:58:23 CEST; 1min 59s ago
Docs: man:cockpit-ws(8)
Listen: [::]:9090 (Stream)
Process: 2076 ExecStartPost=/bin/ln -snf active.motd /run/cockpit/motd (code=exited, status=0/SUCCESS)
Process: 2067 ExecStartPost=/usr/share/cockpit/motd/update-motd localhost (code=exited, status=0/SUCCESS)

Sep 16 19:58:23 ad.gyar.hu systemd[1]: Starting Cockpit Web Service Socket.
Sep 16 19:58:23 ad.gyar.hu systemd[1]: Listening on Cockpit Web Service Socket.

[dnutan (Marc)]

@Andrasf

[root@ad gyaradm]# config
bash: config: command not found

/usr/sbin/e-smith/config

Then the Path variable might be missing something.

Edit:

Letsencrypt for internal servers using cloudflare dns, ddns and nethserver-nginx as reverse proxy

config is /sbin/e-smith/config The config command comes from the nethserve-lib package, it’s a core package, you can’t have NethServer without it. Maybe you “adjusted” the PATH variable. Default is /sbin/e-smith:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/opt/puppetlabs/bin:/root/bin

[Andrasf (Andras)]

[root@ad gyaradm]# /usr/sbin/e-smith/config show pki
pki=configuration
CertificateDuration=3650
ChainFile=
CommonName=
CountryCode=
CrtFile=/etc/pki/tls/certs/wildcard.crt
EmailAddress=
KeyFile=/etc/pki/tls/private/wildcard.key
LetsEncryptChallenge=http
LetsEncryptDomains=internal.gyar.hu
LetsEncryptMail=andras@gyar.hu
LetsEncryptShortChain=enabled
Locality=
Organization=
OrganizationalUnitName=
State=
SubjectAltName=
[root@ad gyaradm]#

[dnutan (Marc)]

/usr/sbin/e-smith/config show pki    #just to know current settings
/usr/sbin/e-smith/config setprop pki CrtFile ''
/usr/sbin/e-smith/config setprop pki KeyFile ''
/usr/sbin/e-smith/config setprop pki ChainFile ''
/usr/sbin/e-smith/signal-event certificate-update

[dnutan (Marc)]

PATH variable (according to above post)

@Letsencrypt for internal servers using cloudflare dns

PATH variable.
Default is /sbin/e-smith:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/opt/puppetlabs/bin:/root/bin

[Andrasf (Andras)]

after these commands:
[root@ad gyaradm]# /usr/sbin/e-smith/config show pki
pki=configuration
CertificateDuration=3650
ChainFile=
CommonName=
CountryCode=
CrtFile=
EmailAddress=
KeyFile=
LetsEncryptChallenge=http
LetsEncryptDomains=internal.gyar.hu
LetsEncryptMail=andras@gyar.hu
LetsEncryptShortChain=enabled
Locality=
Organization=
OrganizationalUnitName=
State=
SubjectAltName=

and the webgui is working!!!

[Andrasf (Andras)]

thank you very much, you were a great help
many thanks!!!