ISPConfig LetsEncrypt & Self Signed Certificate BROKEN CONFIG

Question

im at that point, that i couldnt solve the problem now anymore ... seriosly, i was so stupid, checked the letsencrypt ssl and simultanously created a self signed certificate. however, i think with that i have broken the SSL config. other domains working with letsencrypt, except that one domain/website even after new creating it. i cant find logs outside of the log printed below.

Following is the error.log of Apache2:

[Wed Jul 03 17:46:02.826733 2019] [ssl:warn] [pid 10839] AH01909: kronos.pixelcode.at:8080:0 server certificate does NOT include an ID which matches the server name
[Wed Jul 03 17:46:02.826780 2019] [ssl:error] [pid 10839] AH02217: ssl_stapling_init_cert: can't retrieve issuer certificate! [subject: emailAddress=admin@alphaground.net,CN=alphaground.net,O=Alphaground,L=Telfs,ST=Austria,C=AT / issuer: emailAddress=admin@alphaground.net,CN=alphaground.net,O=Alphaground,L=Telfs,ST=Austria,C=AT / serial: 0A5E411BEFE1832A40230F6F9BC1B0E1F7078CF8 / notbefore: Jun 19 18:42:15 2019 GMT / notafter: Jun 16 18:42:15 2029 GMT]
[Wed Jul 03 17:46:02.826796 2019] [ssl:error] [pid 10839] AH02604: Unable to configure certificate kronos.pixelcode.at:8080:0 for stapling
[Wed Jul 03 17:46:02.826847 2019] [:error] [pid 10839] python_init: Python version mismatch, expected '2.7.6', found '2.7.16'.
[Wed Jul 03 17:46:02.826884 2019] [:error] [pid 10839] python_init: Python executable found '/usr/bin/python'.
[Wed Jul 03 17:46:02.826886 2019] [:error] [pid 10839] python_init: Python path being used '/usr/lib/python2.7:/usr/lib/python2.7/plat-x86_64-linux-gnu:/usr/lib/python2.7/lib-tk:/usr/lib/python2.7/lib-old:/usr/lib/python2.7/lib-dynload'.
[Wed Jul 03 17:46:02.826895 2019] [:notice] [pid 10839] mod_python: Creating 8 session mutexes based on 150 max processes and 0 max threads.
[Wed Jul 03 17:46:02.826898 2019] [:notice] [pid 10839] mod_python: using mutex_directory /tmp 
[Wed Jul 03 17:46:02.833564 2019] [mpm_prefork:notice] [pid 10839] AH00163: Apache/2.4.38 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1b mod_python/3.3.1 Python/2.7.16 configured -- resuming normal operations
[Wed Jul 03 17:46:02.833582 2019] [core:notice] [pid 10839] AH00094: Command line: '/usr/sbin/apache2'
[Wed Jul 03 17:50:02.673254 2019] [mpm_prefork:notice] [pid 10839] AH00169: caught SIGTERM, shutting down
[Wed Jul 03 17:50:02.783814 2019] [ssl:warn] [pid 11384] AH01906: kronos.pixelcode.at:8080:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Wed Jul 03 17:50:02.783845 2019] [ssl:warn] [pid 11384] AH01909: kronos.pixelcode.at:8080:0 server certificate does NOT include an ID which matches the server name
[Wed Jul 03 17:50:02.783917 2019] [ssl:error] [pid 11384] AH02217: ssl_stapling_init_cert: can't retrieve issuer certificate! [subject: emailAddress=admin@alphaground.net,CN=alphaground.net,O=Alphaground,L=Telfs,ST=Austria,C=AT / issuer: emailAddress=admin@alphaground.net,CN=alphaground.net,O=Alphaground,L=Telfs,ST=Austria,C=AT / serial: 0A5E411BEFE1832A40230F6F9BC1B0E1F7078CF8 / notbefore: Jun 19 18:42:15 2019 GMT / notafter: Jun 16 18:42:15 2029 GMT]
[Wed Jul 03 17:50:02.783924 2019] [ssl:error] [pid 11384] AH02604: Unable to configure certificate kronos.pixelcode.at:8080:0 for stapling
[Wed Jul 03 17:50:02.783955 2019] [suexec:notice] [pid 11384] AH01232: suEXEC mechanism enabled (wrapper: /usr/lib/apache2/suexec)
[Wed Jul 03 17:50:02.811836 2019] [ssl:warn] [pid 11390] AH01906: kronos.pixelcode.at:8080:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Wed Jul 03 17:50:02.811851 2019] [ssl:warn] [pid 11390] AH01909: kronos.pixelcode.at:8080:0 server certificate does NOT include an ID which matches the server name
[Wed Jul 03 17:50:02.811904 2019] [ssl:error] [pid 11390] AH02217: ssl_stapling_init_cert: can't retrieve issuer certificate! [subject: emailAddress=admin@alphaground.net,CN=alphaground.net,O=Alphaground,L=Telfs,ST=Austria,C=AT / issuer: emailAddress=admin@alphaground.net,CN=alphaground.net,O=Alphaground,L=Telfs,ST=Austria,C=AT / serial: 0A5E411BEFE1832A40230F6F9BC1B0E1F7078CF8 / notbefore: Jun 19 18:42:15 2019 GMT / notafter: Jun 16 18:42:15 2029 GMT]
[Wed Jul 03 17:50:02.811909 2019] [ssl:error] [pid 11390] AH02604: Unable to configure certificate kronos.pixelcode.at:8080:0 for stapling
[Wed Jul 03 17:50:02.811980 2019] [:error] [pid 11390] python_init: Python version mismatch, expected '2.7.6', found '2.7.16'.
[Wed Jul 03 17:50:02.812037 2019] [:error] [pid 11390] python_init: Python executable found '/usr/bin/python'.
[Wed Jul 03 17:50:02.812046 2019] [:error] [pid 11390] python_init: Python path being used '/usr/lib/python2.7:/usr/lib/python2.7/plat-x86_64-linux-gnu:/usr/lib/python2.7/lib-tk:/usr/lib/python2.7/lib-old:/usr/lib/python2.7/lib-dynload'.
[Wed Jul 03 17:50:02.812095 2019] [:notice] [pid 11390] mod_python: Creating 8 session mutexes based on 150 max processes and 0 max threads.
[Wed Jul 03 17:50:02.812099 2019] [:notice] [pid 11390] mod_python: using mutex_directory /tmp 
[Wed Jul 03 17:50:02.819199 2019] [mpm_prefork:notice] [pid 11390] AH00163: Apache/2.4.38 (Ubuntu) mod_fcgid/2.3.9 OpenSSL/1.1.1b mod_python/3.3.1 Python/2.7.16 configured -- resuming normal operations
[Wed Jul 03 17:50:02.819215 2019] [core:notice] [pid 11390] AH00094: Command line: '/usr/sbin/apache2'

thats what my error.log tries me to say, but it already worked with other domains. i think there have to be a config, where it tries to get or whatever the old certificate. letsencrypt shows me no error, and the server.sh from ispconfig no error too.

I recreated the website/domain in ispconfig, but i still get the same error. other domains works with no error at all. im really really sure, the problem was with check letsencrypt and create a certificate at the same time.

i read through the config in the .vhost but there is nothing in the ssl section...

Answer 1

Problem solved. If you stuck or get the same error, also check your IPv6 settings in DNS. I had two Numbers flipped. So IPv4 was correct, but IPv6 not and i got no error about it.

After reinstalling the server, i ended up with the same problem, so i struggled through the DNS settings. And e voila, AAAA IPv6 correct and the cert was generated perfect.