Installing LetsEncrypt SSL certificate leave ssl.conf.lock file

After successfull letsencrypt certificate installation file /etc/apache2/mods-available/ssl.conf.lock not deleted automaticaly preventing any further letsencrypt certificate installation. Problem found after last system update ( webmin, some other packages ).

Status: 
Fixed (pending)
Virtualmin version: 
6.15
Webmin version: 
1.973

Comments

What were the contents of that /etc/apache2/mods-available/ssl.conf.lock file? If it was the PID of a running process, what was the command line of that process?

Also, how did you install the cert? Was it via the web UI, from the virtualmin command line, or did it happen with automatic renewal?

File contains PID of some process, but that process not running already. Certs was installed from Web UI, same behavior with auto renewal.

Ilia's picture
Submitted by Ilia on Fri, 04/02/2021 - 18:34

What is the output of:

cat /etc/webmin/apache/config

A lock file containing the PID of a process that's not running shouldn't have any effect on future attempts to lock the file (by Webmin)

After update from Virtualmin 6.15 to 6.16 letsencrypt update works fine. Lock file ssl.conf.lock still not auto deleted but this not blocking further ssl updates.

cat /etc/webmin/apache/config

auto_mods=1

virt_file=/etc/apache2/sites-available

link_dir=/etc/apache2/sites-enabled

test_apachectl=1

test_always=0

httpd_path=/usr/sbin/apache2

show_names=0

srm_conf=/etc/apache2/srm.conf

httpd_conf=/etc/apache2/apache2.conf

stop_cmd=/etc/init.d/apache2 stop

test_config=1

defines_name=APACHE_ARGUMENTS

apply_cmd=/usr/sbin/apache2ctl graceful

show_order=0

mime_types=/etc/apache2/mime.types

allow_virtualmin=0

apachectl_path=/usr/sbin/apache2ctl

defines_file=/etc/apache2/envvars

start_cmd=/etc/init.d/apache2 start

httpd_dir=/etc/apache2

access_conf=/etc/apache2/access.conf

test_manual=0

max_servers=100

show_list=1

Can you post the contents of /etc/apache2/mods-available/ssl.conf on your system?

<IfModule mod_ssl.c>

    # Pseudo Random Number Generator (PRNG):
    # Configure one or more sources to seed the PRNG of the SSL library.
    # The seed data should be of good random quality.
    # WARNING! On some platforms /dev/random blocks if not enough entropy
    # is available. This means you then cannot use the /dev/random device
    # because it would lead to very long connection times (as long as
    # it requires to make more entropy available). But usually those
    # platforms additionally provide a /dev/urandom device which doesn't
    # block. So, if available, use this one instead. Read the mod_ssl User
    # Manual for more details.
    #
    SSLRandomSeed startup builtin
    SSLRandomSeed startup file:/dev/urandom 512
    SSLRandomSeed connect builtin
    SSLRandomSeed connect file:/dev/urandom 512

    ##
    ##  SSL Global Context
    ##
    ##  All SSL configuration in this context applies both to
    ##  the main server and all SSL-enabled virtual hosts.
    ##

    #
    #   Some MIME-types for downloading Certificates and CRLs
    #
    AddType application/x-x509-ca-cert .crt
    AddType application/x-pkcs7-crl .crl

    #   Pass Phrase Dialog:
    #   Configure the pass phrase gathering process.
    #   The filtering dialog program (`builtin' is a internal
    #   terminal dialog) has to provide the pass phrase on stdout.
    SSLPassPhraseDialog exec:/usr/share/apache2/ask-for-passphrase

    #   Inter-Process Session Cache:
    #   Configure the SSL Session Cache: First the mechanism 
    #   to use and second the expiring timeout (in seconds).
    #   (The mechanism dbm has known memory leaks and should not be used).
    #SSLSessionCache                 dbm:${APACHE_RUN_DIR}/ssl_scache
    SSLSessionCache         shmcb:${APACHE_RUN_DIR}/ssl_scache(512000)
    SSLSessionCacheTimeout  300

    #   Semaphore:
    #   Configure the path to the mutual exclusion semaphore the
    #   SSL engine uses internally for inter-process synchronization. 
    #   (Disabled by default, the global Mutex directive consolidates by default
    #   this)
    #Mutex file:${APACHE_LOCK_DIR}/ssl_mutex ssl-cache


    #   SSL Cipher Suite:
    #   List the ciphers that the client is permitted to negotiate. See the
    #   ciphers(1) man page from the openssl package for list of all available
    #   options.
    #   Enable only secure ciphers:
    SSLCipherSuite HIGH:!aNULL

    # SSL server cipher order preference:
    # Use server priorities for cipher algorithm choice.
    # Clients may prefer lower grade encryption.  You should enable this
    # option if you want to enforce stronger encryption, and can afford
    # the CPU cost, and did not override SSLCipherSuite in a way that puts
    # insecure ciphers first.
    # Default: Off
    #SSLHonorCipherOrder on

    #   The protocols to enable.
    #   Available values: all, SSLv3, TLSv1, TLSv1.1, TLSv1.2
    #   SSL v2  is no longer supported
    SSLProtocol all -SSLv3

    #   Allow insecure renegotiation with clients which do not yet support the
    #   secure renegotiation protocol. Default: Off
    #SSLInsecureRenegotiation on

    #   Whether to forbid non-SNI clients to access name based virtual hosts.
    #   Default: Off
    #SSLStrictSNIVHostCheck On

</IfModule>

vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Thanks - I found the bug that can cause that extra lock file, and will fix it in the next Virtualmin release.