Certbot certificates not working on Apache for multiple Flask sites sharing an IP address

user_10135824 0
Viewed 1118

After two days of trying, I am completely at a loss with adding a certificate to my second domain. Here is my situation:

What works:
I have a dynamic site (domain1 / site1) hosted on a Digital Ocean droplet running Ubuntu. It is served using Apache and uses the Flask microframework. Everything works correctly, and I was able to install a Let's Encrypt certificate successfully using certbot.

I have added a second dynamic site (domain2 / site2) to the same droplet, sharing the single IP across the two domains/sites. I was able to get this working by following this answer: hosting multiple Flask apps for unique domains. Now I can:
(1) visit site1 via domain1 over HTTPS like I always could
(2) visit site2 via domain2 over HTTP.

What doesn't:
The problem comes in when I try to add a new Let's Encrypt certificate to site2/domain2. The tutorial at Digital Ocean and the certbot documentation suggest all I need to do is run certbot again with the new domain. A new certificate is created, but best case scenario, site1 becomes a "potential security risk" and site2 is still insecure.

Below are the contents of /etc/apache2/sites-available/ files BEFORE I attempt to install the second certificate.

000-default.conf

<VirtualHost *:80>
        <Directory /var/www/FlaskApp>
                Options +ExecCGI
                DirectoryIndex index.py
        </Directory>
        AddHandler cgi-script .py
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/FlaskApp
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

FlaskApp.conf

<VirtualHost *:80>
                ServerName www.audiologysource.com
                ServerAlias audiologysource.com
                #ServerName 157.245.135.241
                ServerAdmin admin@mywebsite.com
                WSGIScriptAlias / /var/www/FlaskApp/flaskapp.wsgi
                <Directory /var/www/FlaskApp/FlaskApp/>
                        Order allow,deny
                        Allow from all
                </Directory>
                Alias /static /var/www/FlaskApp/FlaskApp/static
                <Directory /var/www/FlaskApp/FlaskApp/static/>
                        Order allow,deny
                        Allow from all
                </Directory>
                ErrorLog ${APACHE_LOG_DIR}/error.log
                LogLevel warn
                CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.audiologysource.com [OR]
RewriteCond %{SERVER_NAME} =audiologysource.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
<VirtualHost *:80>
                ServerName www.travismmoore.com
                ServerAlias travismmoore.com
                ServerAdmin youemail@email.com
                WSGIScriptAlias / /var/www/PersonalSiteApp/flaskapp.wsgi
                <Directory /var/www/PersonalSiteApp/FlaskApp/>
                        Order allow,deny
                        Allow from all
                </Directory>
                Alias /static /var/www/PersonalSiteApp/FlaskApp/static
                <Directory /var/www/PersonalSiteApp/FlaskApp/static/>
                        Order allow,deny
                        Allow from all
                </Directory>
                ErrorLog ${APACHE_LOG_DIR}/error.log
                LogLevel warn
                CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

FlaskApp-le-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>
                ServerName www.audiologysource.com
                ServerAlias audiologysource.com
                #ServerName 157.245.135.241
                ServerAdmin admin@mywebsite.com
                WSGIScriptAlias / /var/www/FlaskApp/flaskapp.wsgi
                <Directory /var/www/FlaskApp/FlaskApp/>
                        Order allow,deny
                        Allow from all
                </Directory>
                Alias /static /var/www/FlaskApp/FlaskApp/static
                <Directory /var/www/FlaskApp/FlaskApp/static/>
                        Order allow,deny
                        Allow from all
                </Directory>
                ErrorLog ${APACHE_LOG_DIR}/error.log
                LogLevel warn
                CustomLog ${APACHE_LOG_DIR}/access.log combined

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/audiologysource.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/audiologysource.com/privkey.pem
</VirtualHost>
</IfModule>

My /var/www directory is organized like this:

\var\www
|
└─── FlaskApp
|    |    flaskapp.wsgi
|    |
|    └─── FlaskApp
|         |  __init__.py
|         |
|         └─── static
|         └─── templates
|         |        home.html
|         |
|         └─── venv
|
└─── PersonalSiteApp                  #same as FlaskApp
     |    flaskapp.wsgi
     |
     └─── FlaskApp
          |  __init__.py
          |
          └─── static
          └─── templates
          |        home.html
          |
          └─── venv

Here are the same files AFTER I run certbot and reload Apache:

sudo certbot --apache -d travismmoore.com -d www.travismmoore.com

000-default.conf: unchanged

FlaskApp.conf

<VirtualHost *:80>
                ServerName www.audiologysource.com
                ServerAlias audiologysource.com
                #ServerName 157.245.135.241
                ServerAdmin admin@mywebsite.com
                WSGIScriptAlias / /var/www/FlaskApp/flaskapp.wsgi
                <Directory /var/www/FlaskApp/FlaskApp/>
                        Order allow,deny
                        Allow from all
                </Directory>
                Alias /static /var/www/FlaskApp/FlaskApp/static
                <Directory /var/www/FlaskApp/FlaskApp/static/>
                        Order allow,deny
                        Allow from all
                </Directory>
                ErrorLog ${APACHE_LOG_DIR}/error.log
                LogLevel warn
                CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =www.audiologysource.com [OR]
RewriteCond %{SERVER_NAME} =audiologysource.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanen$
</VirtualHost>
<VirtualHost *:80>
                ServerName www.travismmoore.com
                ServerAlias travismmoore.com
                ServerAdmin youemail@email.com
                WSGIScriptAlias / /var/www/PersonalSiteApp/flaskapp.w$
                <Directory /var/www/PersonalSiteApp/FlaskApp/>
                        Order allow,deny
                        Allow from all
                </Directory>
                Alias /static /var/www/PersonalSiteApp/FlaskApp/static
                <Directory /var/www/PersonalSiteApp/FlaskApp/static/>
                        Order allow,deny
                        Allow from all
                </Directory>
                ErrorLog ${APACHE_LOG_DIR}/error.log
                LogLevel warn
                CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =audiologysource.com [OR]
RewriteCond %{SERVER_NAME} =www.audiologysource.com [OR]
RewriteCond %{SERVER_NAME} =travismmoore.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanen$
</VirtualHost>

FlaskApp-le-ssl.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>
                ServerName www.audiologysource.com
                ServerAlias audiologysource.com
                #ServerName 157.245.135.241
                ServerAdmin admin@mywebsite.com
                WSGIScriptAlias / /var/www/FlaskApp/flaskapp.wsgi
                <Directory /var/www/FlaskApp/FlaskApp/>
                        Order allow,deny
                        Allow from all
                </Directory>
                Alias /static /var/www/FlaskApp/FlaskApp/static
                <Directory /var/www/FlaskApp/FlaskApp/static/>
                        Order allow,deny
                        Allow from all
                </Directory>
                ErrorLog ${APACHE_LOG_DIR}/error.log
                LogLevel warn
                CustomLog ${APACHE_LOG_DIR}/access.log combined

Include /etc/letsencrypt/options-ssl-apache.conf
ServerAlias travismmoore.com
SSLCertificateFile /etc/letsencrypt/live/travismmoore.com/fullchain.p$
SSLCertificateKeyFile /etc/letsencrypt/live/travismmoore.com/privkey.$
</VirtualHost>
</IfModule>
<IfModule mod_ssl.c>
<VirtualHost *:80>
                ServerName www.travismmoore.com
                ServerAlias travismmoore.com
                ServerAdmin youemail@email.com
                WSGIScriptAlias / /var/www/PersonalSiteApp/flaskapp.w$
                <Directory /var/www/PersonalSiteApp/FlaskApp/>
                        Order allow,deny
                        Allow from all
                </Directory>
                Alias /static /var/www/PersonalSiteApp/FlaskApp/static
                <Directory /var/www/PersonalSiteApp/FlaskApp/static/>
                        Order allow,deny
                        Allow from all
                </Directory>
                ErrorLog ${APACHE_LOG_DIR}/error.log
                LogLevel warn
                CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>
</IfModule>
<IfModule mod_ssl.c>
<VirtualHost *:443>
                ServerName www.travismmoore.com
ServerAlias travismmoore.com
                ServerAdmin youemail@email.com
                WSGIScriptAlias / /var/www/PersonalSiteApp/flaskapp.w$
                <Directory /var/www/PersonalSiteApp/FlaskApp/>
                        Order allow,deny
                        Allow from all
                </Directory>
                Alias /static /var/www/PersonalSiteApp/FlaskApp/static
                <Directory /var/www/PersonalSiteApp/FlaskApp/static/>
                        Order allow,deny
                        Allow from all
                </Directory>
                ErrorLog ${APACHE_LOG_DIR}/error.log
                LogLevel warn
                CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLCertificateFile /etc/letsencrypt/live/travismmoore.com/fullchain.p$
SSLCertificateKeyFile /etc/letsencrypt/live/travismmoore.com/privkey.$
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

Any help is greatly appreciated!

flask python-3.x ssl-certificate apache
1 Answers

I thought I'd update this with what ended up working for those who run into the same issue. I ended up having to remove all the certificates, then add them one at a time manually, using:

sudo certbot --manual certonly -d domain_1.com -d www.domain_1.com
sudo certbot --manual certonly -d domain_2.com -d www.domain_2.com
user_101358240
Related