I'm migrating from Digital Ocean to AWS and having a hard time at it. After a lot of trouble with the need for setting up static ip's, DNS zones, etc, now my workflow for creating SSL certificates and establishing HTTPS connections is not working despite everything seemingly being OK.
I've tried everything I can possibly find, I've spent hours already trying to figure this out with 0 progress. I've never had this issue before, on DO I just issue the "certbot -d example.com" command and it "just works". It feels like there is something specific to Lightsail that I'm not aware of that is preventing HTTPS connections.
- Non HTTPS connections are working
- I am using the same example.com.conf files I've used before at DO, after my newly created ones didn't work, using the same Ubuntu version. I can't see anything wrong with them. Config test says syntax is OK.
- When I try to visit a site on HTTPS I get an error in Firefox I've never seen before:
Secure Connection Failed
An error occurred during a connection to test.***.com. PR_CONNECT_RESET_ERROR
Error code: PR_CONNECT_RESET_ERROR
** The page you are trying to view cannot be shown because the authenticity of the received data could not be verified**
The only reference on this support forum I can find has one answer which refers to "the proxy" interfering, I don't use a proxy (I tried Cloudflare but that doesn't work with Lightsail, unfortunately). As far as I know there is no proxy in front of my sites unless Lightsail does something I'm not aware of.
- I use certbot to generate certificates. I've tried generating them for only one domain, for all the subdomains individually, and by using wildcard certificates. No luck either way.
- Commands like: openssl s_client -connect ***.com:443 -showcerts in the terminal just keep loading, nothing happens.
- No errors in the apache2 error log
- I verified that the certificates have proper file permissions, that they are properly linked in the apache config files.
- UFW rules are:
Apache Full ALLOW Anywhere 22/tcp ALLOW Anywhere 80/tcp ALLOW Anywhere 443/tcp ALLOW Anywhere Apache Full (v6) ALLOW Anywhere (v6) 22/tcp (v6) ALLOW Anywhere (v6) 80/tcp (v6) ALLOW Anywhere (v6) 443/tcp (v6) ALLOW Anywhere (v6)
- When I test the certificates with "openssl x509 -in /etc/letsencrypt/live/***.com/fullchain.pem -text -noout" the correct domains are in the output.
- Mod rewire module is enabled
Thanks in advance for any guidance.
.
On Lightsail blueprints of application type that come with an application listening on port 443, the port is open. . But on an OS-only Ubuntu instance since there is no application listening on 443 nor any guarantees on a customer wanting to run an app on that port, the port is closed by default. . Thanks for the feedback. Also noted the documentation feedback below.