1. In the Chrome browser, the prompt says: Your connection is not private. See Figure 1.
Plaintext
Your connection is not private
Attackers might be trying to steal your information from learn-php-app-0605-prod.wangqiang.store (for example, passwords, messages, or credit cards). Learn more
NET::ERR_CERT_DATE_INVALID
If you want the highest level of protection from Chrome, turn on enhanced protection
learn-php-app-0605-prod.wangqiang.store normally uses encryption to protect your information. When Chrome tried to connect to learn-php-app-0605-prod.wangqiang.store this time, the website sent back unusual and incorrect credentials. This may be because an attacker is trying to impersonate learn-php-app-0605-prod.wangqiang.store, or a Wi-Fi login screen has interrupted this connection. Rest assured, your information is still safe because Chrome stopped the connection before any data was exchanged.
You cannot access learn-php-app-0605-prod.wangqiang.store right now because this site uses HSTS. Network errors and attacks are usually temporary, so this page might be back to normal later.
2. Reference: The process of switching a website’s domain to another domain . The time of this switch was 2023/06/05, and the current time is 2023/12/11. It was confirmed to be working normally half a year ago.
3. In the Firefox browser, the prompt says: Warning: Potential Security Risk Ahead. It is likely that the website’s certificate has expired, preventing Firefox from connecting securely. See Figure 2.
Plaintext
Warning: Potential Security Risk Ahead
Firefox detected a potential security threat and did not continue to learn-php-app-0605-prod.wangqiang.store. The website may be misconfigured, or your computer's clock may be set incorrectly.
It is likely that the website's certificate has expired, preventing Firefox from connecting securely. If you continue to this website, attackers may try to steal your passwords, emails, or credit cards.
What can you do?
This issue is usually related to the website and cannot be resolved through your actions. You can report this problem to the website's administrator.
Learn more…
4. I decided to delete the virtual host and then re-add it. It failed at the “Verify finished, start to sign.” step. I deleted and re-added it again successfully. See Figure 3.
Plaintext
Do you want to redirect all HTTP requests to HTTPS? [y/n]: y
Please select domain cert key length.
Enter one of 2048, 3072, 4096, 8192 will issue a RSA cert.
Enter one of ec-256, ec-384, ec-521 will issue a ECC cert.
Please enter your cert key length (default 2048):
[Mon Dec 11 05:42:44 PM CST 2023] Using CA: https://acme.zerossl.com/v2/DV90
[Mon Dec 11 05:42:44 PM CST 2023] Single domain='learn-php-app-0605-prod.wangqiang.store'
[Mon Dec 11 05:42:44 PM CST 2023] Getting domain auth token for each domain
[Mon Dec 11 05:43:42 PM CST 2023] Getting webroot for domain='learn-php-app-0605-prod.wangqiang.store'
[Mon Dec 11 05:43:42 PM CST 2023] Verifying: learn-php-app-0605-prod.wangqiang.store
[Mon Dec 11 05:43:44 PM CST 2023] Processing, The CA is processing your order, please just wait. (1/30)
[Mon Dec 11 05:43:48 PM CST 2023] Success
[Mon Dec 11 05:43:48 PM CST 2023] Verify finished, start to sign.
[Mon Dec 11 05:43:48 PM CST 2023] Lets finalize the order.
[Mon Dec 11 05:43:48 PM CST 2023] Le_OrderFinalize='https://acme.zerossl.com/v2/DV90/order/AXuZJZhYYoC-V2rj0fM0pQ/finalize'
[Mon Dec 11 05:44:51 PM CST 2023] Sign failed, finalize code is not 200.
[Mon Dec 11 05:44:51 PM CST 2023] <html>
<head><title>504 Gateway Time-out</title></head>
<body>
<center><h1>504 Gateway Time-out</h1></center>
<hr><center>nginx</center>
</body>
</html>
[Mon Dec 11 05:44:51 PM CST 2023] Please add '--debug' or '--log' to check more details.
[Mon Dec 11 05:44:51 PM CST 2023] See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
Do you want to add hotlink protection? [y/n]: yPlaintext
[root@iZ23wv7v5ggZ ~]# ~/oneinstack/vhost.sh --del
#######################################################################
# OneinStack for CentOS/RedHat 7+ Debian 9+ and Ubuntu 16+ #
# For more information please visit https://oneinstack.com #
#######################################################################
Virtualhost list:
learn-php-app-0605-prod.wangqiang.store www.shuijingwanwq.com
Please input a domain you want to delete: learn-php-app-0605-prod.wangqiang.store
Do you want to delete Virtul Host directory? [y/n]: n
Domain: learn-php-app-0605-prod.wangqiang.store has been deleted.
[root@iZ23wv7v5ggZ ~]# ~/oneinstack/vhost.sh
#######################################################################
# OneinStack for CentOS/RedHat 7+ Debian 9+ and Ubuntu 16+ #
# For more information please visit https://oneinstack.com #
#######################################################################
What Are You Doing?
1. Use HTTP Only
2. Use your own SSL Certificate and Key
3. Use Let's Encrypt to Create SSL Certificate and Key
q. Exit
Please input the correct option: 3
Please input domain(example: www.example.com): learn-php-app-0605-prod.wangqiang.store
domain=learn-php-app-0605-prod.wangqiang.store
Please input the directory for the domain:learn-php-app-0605-prod.wangqiang.store :
(Default directory: /data/wwwroot/learn-php-app-0605-prod.wangqiang.store): /data/wwwroot/learn-php-app-0605-prod.shuijingwanwq.com
Create Virtul Host directory......
set permissions of Virtual Host directory......
Do you want to add more domain name? [y/n]: n
Do you want to redirect all HTTP requests to HTTPS? [y/n]: y
Please select domain cert key length.
Enter one of 2048, 3072, 4096, 8192 will issue a RSA cert.
Enter one of ec-256, ec-384, ec-521 will issue a ECC cert.
Please enter your cert key length (default 2048):
[Tue Dec 12 09:45:48 AM CST 2023] Using CA: https://acme.zerossl.com/v2/DV90
[Tue Dec 12 09:45:48 AM CST 2023] Single domain='learn-php-app-0605-prod.wangqiang.store'
[Tue Dec 12 09:45:48 AM CST 2023] Getting domain auth token for each domain
[Tue Dec 12 09:47:19 AM CST 2023] Getting webroot for domain='learn-php-app-0605-prod.wangqiang.store'
[Tue Dec 12 09:47:19 AM CST 2023] Verifying: learn-php-app-0605-prod.wangqiang.store
[Tue Dec 12 09:47:50 AM CST 2023] Processing, The CA is processing your order, please just wait. (1/30)
[Tue Dec 12 09:48:16 AM CST 2023] Success
[Tue Dec 12 09:48:16 AM CST 2023] Verify finished, start to sign.
[Tue Dec 12 09:48:16 AM CST 2023] Lets finalize the order.
[Tue Dec 12 09:48:16 AM CST 2023] Le_OrderFinalize='https://acme.zerossl.com/v2/DV90/order/Vngx1i061GLKvKou91RuTg/finalize'
[Tue Dec 12 09:48:46 AM CST 2023] Order status is processing, lets sleep and retry.
[Tue Dec 12 09:48:46 AM CST 2023] Retry after: 15
[Tue Dec 12 09:49:02 AM CST 2023] Polling order status: https://acme.zerossl.com/v2/DV90/order/Vngx1i061GLKvKou91RuTg
[Tue Dec 12 09:49:32 AM CST 2023] Downloading cert.
[Tue Dec 12 09:49:32 AM CST 2023] Le_LinkCert='https://acme.zerossl.com/v2/DV90/cert/fOxlsHbazT9i7VwqoS2W7g'
[Tue Dec 12 09:50:06 AM CST 2023] Cert success.
-----BEGIN CERTIFICATE-----
xxxxxxxxxx
-----END CERTIFICATE-----
[Tue Dec 12 09:50:06 AM CST 2023] Your cert is in: /root/.acme.sh/learn-php-app-0605-prod.wangqiang.store/learn-php-app-0605-prod.wangqiang.store.cer
[Tue Dec 12 09:50:06 AM CST 2023] Your cert key is in: /root/.acme.sh/learn-php-app-0605-prod.wangqiang.store/learn-php-app-0605-prod.wangqiang.store.key
[Tue Dec 12 09:50:06 AM CST 2023] The intermediate CA cert is in: /root/.acme.sh/learn-php-app-0605-prod.wangqiang.store/ca.cer
[Tue Dec 12 09:50:06 AM CST 2023] And the full chain certs is there: /root/.acme.sh/learn-php-app-0605-prod.wangqiang.store/fullchain.cer
Do you want to add hotlink protection? [y/n]: y
Allow Rewrite rule? [y/n]: y
Please input the rewrite of programme :
wordpress,opencart,magento2,drupal,joomla,codeigniter,laravel
thinkphp,pathinfo,discuz,typecho,ecshop,nextcloud,zblog,whmcs rewrite was exist.
(Default rewrite: other): laravel
You choose rewrite=laravel
Allow Nginx/Tengine/OpenResty access_log? [y/n]: y
You access log file=/data/wwwlogs/learn-php-app-0605-prod.wangqiang.store_nginx.log
nginx: the configuration file /usr/local/nginx/conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx/conf/nginx.conf test is successful
Reload Nginx......
#######################################################################
# OneinStack for CentOS/RedHat 7+ Debian 9+ and Ubuntu 16+ #
# For more information please visit https://oneinstack.com #
#######################################################################
Your domain: learn-php-app-0605-prod.wangqiang.store
Virtualhost conf: /usr/local/nginx/conf/vhost/learn-php-app-0605-prod.wangqiang.store.conf
Directory of: /data/wwwroot/learn-php-app-0605-prod.shuijingwanwq.com
Rewrite rule: /usr/local/nginx/conf/rewrite/laravel.conf
Let's Encrypt SSL Certificate:/usr/local/nginx/conf/ssl/learn-php-app-0605-prod.wangqiang.store.crt
SSL Private Key: /usr/local/nginx/conf/ssl/learn-php-app-0605-prod.wangqiang.store.key
5. After editing the Nginx configuration file as needed, I edited the root path and restarted the Nginx service. See Figure 4.
Nginx
server {
listen 80;
listen [::]:80;
listen 443 ssl http2;
listen [::]:443 ssl http2;
ssl_certificate /usr/local/nginx/conf/ssl/learn-php-app-0605-prod.wangqiang.store.crt;
ssl_certificate_key /usr/local/nginx/conf/ssl/learn-php-app-0605-prod.wangqiang.store.key;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ecdh_curve X25519:prime256v1:secp384r1:secp521r1;
ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256;
ssl_conf_command Ciphersuites TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256;
ssl_conf_command Options PrioritizeChaCha;
ssl_prefer_server_ciphers on;
ssl_session_timeout 10m;
ssl_session_cache shared:SSL:10m;
ssl_buffer_size 2k;
add_header Strict-Transport-Security max-age=15768000;
ssl_stapling on;
ssl_stapling_verify on;
server_name learn-php-app-0605-prod.wangqiang.store;
access_log /data/wwwlogs/learn-php-app-0605-prod.wangqiang.store_nginx.log combined;
index index.html index.htm index.php;
root /data/wwwroot/learn-php-app-0605-prod.shuijingwanwq.com/public;
if ($ssl_protocol = "") { return 301 https://$host$request_uri; }
include /usr/local/nginx/conf/rewrite/laravel.conf;
#error_page 404 /404.html;
#error_page 502 /502.html;
location ~ .*\.(wma|wmv|asf|mp3|mmf|zip|rar|jpg|gif|png|swf|flv|mp4)$ {
valid_referers none blocked *.wangqiang.store learn-php-app-0605-prod.wangqiang.store;
if ($invalid_referer) {
return 403;
}
}
location ~ [^/]\.php(/|$) {
#fastcgi_pass remote_php_ip:9000;
fastcgi_pass unix:/dev/shm/php-cgi.sock;
fastcgi_index index.php;
include fastcgi.conf;
}
location ~ .*\.(gif|jpg|jpeg|png|bmp|swf|flv|mp4|ico)$ {
expires 30d;
access_log off;
}
location ~ .*\.(js|css)?$ {
expires 7d;
access_log off;
}
location ~ /(\.user\.ini|\.ht|\.git|\.svn|\.project|LICENSE|README\.md) {
deny all;
}
location /.well-known {
allow all;
}
}
Nginx
[root@iZ23wv7v5ggZ ~]# service nginx restart
Redirecting to /bin/systemctl restart nginx.service
6. Open: https://learn-php-app-0605-prod.wangqiang.store/robots.txt. It is now working normally in both the Chrome and Firefox browsers. See Figure 5.
7. Looking into the root cause, the certificate was issued by Let’s Encrypt. Let’s Encrypt is a global Certificate Authority (CA) that provides services for individuals and organizations worldwide to obtain, renew, and manage SSL/TLS certificates. Reference: Let’s Encrypt FAQ. https://letsencrypt.org/zh-cn/docs/faq/. The certificate is valid for 90 days. The reasoning behind this can be found here. This period cannot be adjusted, and there are no exceptions. We recommend that you automatically renew your certificate every 60 days (later, after waiting for the next certificate expiration, I hope to find a way to renew it automatically instead of deleting and re-adding the virtual host.). See Figure 6.
