Hi Guys,
First of all, let me introduce myself as an experience admin with more than 10 years of experience.
I'm having a problem install any SSL after successfully cloning a server using R1soft CDP. My ailing (old) server has been decommissioned after the cloning and and I've updated my new primary IP address using ipswap.sh in the scripts directory. My secondary ip address have been migrated to my new server so there are no changes required. So, long story short, my cloning has been very successful and directadmin and all hosted websites are working fine.
However, I'm running into a very very strange problem with the SSL. I'm not able to install any SSL, be it Godaddy, Thwate or Comodo. I know how to install SSL and have been doing it on directadmin for over 7 years so please don't discount me on that. The error message I got on the admin site (2222) was:
Could not execute your request
Details
Certificate is Invalid
The error I got from the debug mode /usr/local/directadmin/directadmin b2000 was:
2FGbPb5sVJmRBkiUrFN03KYBzeFIK5gV4JzdtBWAWCsd5Guf8%2Ftm2%0D%0A9mNVz%2FSYSpsbQ2PzSUqUxSxdZI4KZed6VYJw%2BXE9XHTD95EAVxLnJINhkw%2F8igcM%0D%0AM0w5blbrLaB1keu5tRVuOSzv81oqZwslpdAn3ifAt5rA1J2NasLQWBfwscoJKaR%2F%0D%0AN1ztWTKYPL8iZA%3D%3D%0D%0A-----END+CERTIFICATE-----%0D%0A&submit=Save
unable to write certificate
19668:error:09072007
EM routinesEM_write_bio:BUF libem_lib.c:595:
I've checked all over and all files and directories in /usr/local/directadmin/ and /etc/pki and they have the exact same ownership and permission as on my old server. I've also checked /tmp and /var/tmp and there are all ok. I've also checked the output of ps aux | grep directadmin and the results were several directadmin instances running as nobody.
I did a strace on the directadmin instances using "strace $(/sbin/pidof directadmin |sed 's/\([0-9]*\)/\-fp\1/g') 2> test" and saw somewhere along the line where the error occured but it's not making any sense to me:
[pid 6262] read(0, "-", 1) = 1
[pid 6262] read(0, "-", 1) = 1
[pid 6262] read(0, "-", 1) = 1
[pid 6262] read(0, "-", 1) = 1
[pid 6262] read(0, "\n", 1) = 1
[pid 6262] fstat64(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
[pid 6262] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc7000
[pid 6262] write(1, "Modulus=BC8F2FF6684B70E316570153"..., 1024) = -1 EPIPE (Broken pipe)
[pid 6262] --- SIGPIPE (Broken pipe) @ 0 (0) ---
[pid 6262] write(2, "unable to write certificate\n", 28) = -1 EBADF (Bad file descriptor)
[pid 6262] write(2, "6262:error:09072007EM routines"..., 70) = -1 EBADF (Bad file descriptor)
[pid 6262] exit_group(1) = ?
Now, let me provide more details on various modes of SSL installation. If I use "Create your own self signed certificate", there would be no problem and I've checked that the cert and key files are updated in /usr/local/directadmin/data/users/username/domains with the respective self-signed cert and key. There's also seeming no problem when I create a CSR, with the new private key created and updated in the key file. The problem comes when I select "Paste a pre-generated certificate and key" and save. The above error will be produced no matter what I paste into the box. Even directadmin's own self-signed certificate would produce the same error when I paste the cert and key pair into the "pre-generated certificate and key" box.
I suspected directadmin was having a problem verifying any SSL certificate. So I went in and run "cat username.com.cert | openssl x509 -modulus" as the diradmin user and compared it with the results from "cat username.com.key | openssl rsa -modulus". The outputs are conclusive that openssl is working properly and the cert/key pair is matching.
I'm running out of idea as to what might have gone wrong with the SSL checking mechanism behind the directadmin admin panel but the strace output gives me a feeling that some files might be inaccessible and that resulted in an error of "Bad file descriptor" which interrupted the SSL verification process.
Lastly, I'm not able to apply any valid SSL certificate to any of my hosted domain names created in this hierarchy:
Admin --> Reseller -- User --> domains
Sorry for the long post as I'm desperate and could use any available help or clues. Please help me and thank you all for your time!
First of all, let me introduce myself as an experience admin with more than 10 years of experience.
I'm having a problem install any SSL after successfully cloning a server using R1soft CDP. My ailing (old) server has been decommissioned after the cloning and and I've updated my new primary IP address using ipswap.sh in the scripts directory. My secondary ip address have been migrated to my new server so there are no changes required. So, long story short, my cloning has been very successful and directadmin and all hosted websites are working fine.
However, I'm running into a very very strange problem with the SSL. I'm not able to install any SSL, be it Godaddy, Thwate or Comodo. I know how to install SSL and have been doing it on directadmin for over 7 years so please don't discount me on that. The error message I got on the admin site (2222) was:
Could not execute your request
Details
Certificate is Invalid
The error I got from the debug mode /usr/local/directadmin/directadmin b2000 was:
2FGbPb5sVJmRBkiUrFN03KYBzeFIK5gV4JzdtBWAWCsd5Guf8%2Ftm2%0D%0A9mNVz%2FSYSpsbQ2PzSUqUxSxdZI4KZed6VYJw%2BXE9XHTD95EAVxLnJINhkw%2F8igcM%0D%0AM0w5blbrLaB1keu5tRVuOSzv81oqZwslpdAn3ifAt5rA1J2NasLQWBfwscoJKaR%2F%0D%0AN1ztWTKYPL8iZA%3D%3D%0D%0A-----END+CERTIFICATE-----%0D%0A&submit=Save
unable to write certificate
19668:error:09072007
EM routinesEM_write_bio:BUF libem_lib.c:595:I've checked all over and all files and directories in /usr/local/directadmin/ and /etc/pki and they have the exact same ownership and permission as on my old server. I've also checked /tmp and /var/tmp and there are all ok. I've also checked the output of ps aux | grep directadmin and the results were several directadmin instances running as nobody.
I did a strace on the directadmin instances using "strace $(/sbin/pidof directadmin |sed 's/\([0-9]*\)/\-fp\1/g') 2> test" and saw somewhere along the line where the error occured but it's not making any sense to me:
[pid 6262] read(0, "-", 1) = 1
[pid 6262] read(0, "-", 1) = 1
[pid 6262] read(0, "-", 1) = 1
[pid 6262] read(0, "-", 1) = 1
[pid 6262] read(0, "\n", 1) = 1
[pid 6262] fstat64(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
[pid 6262] mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7fc7000
[pid 6262] write(1, "Modulus=BC8F2FF6684B70E316570153"..., 1024) = -1 EPIPE (Broken pipe)
[pid 6262] --- SIGPIPE (Broken pipe) @ 0 (0) ---
[pid 6262] write(2, "unable to write certificate\n", 28) = -1 EBADF (Bad file descriptor)
[pid 6262] write(2, "6262:error:09072007
EM routines"..., 70) = -1 EBADF (Bad file descriptor)[pid 6262] exit_group(1) = ?
Now, let me provide more details on various modes of SSL installation. If I use "Create your own self signed certificate", there would be no problem and I've checked that the cert and key files are updated in /usr/local/directadmin/data/users/username/domains with the respective self-signed cert and key. There's also seeming no problem when I create a CSR, with the new private key created and updated in the key file. The problem comes when I select "Paste a pre-generated certificate and key" and save. The above error will be produced no matter what I paste into the box. Even directadmin's own self-signed certificate would produce the same error when I paste the cert and key pair into the "pre-generated certificate and key" box.
I suspected directadmin was having a problem verifying any SSL certificate. So I went in and run "cat username.com.cert | openssl x509 -modulus" as the diradmin user and compared it with the results from "cat username.com.key | openssl rsa -modulus". The outputs are conclusive that openssl is working properly and the cert/key pair is matching.
I'm running out of idea as to what might have gone wrong with the SSL checking mechanism behind the directadmin admin panel but the strace output gives me a feeling that some files might be inaccessible and that resulted in an error of "Bad file descriptor" which interrupted the SSL verification process.
Lastly, I'm not able to apply any valid SSL certificate to any of my hosted domain names created in this hierarchy:
Admin --> Reseller -- User --> domains
Sorry for the long post as I'm desperate and could use any available help or clues. Please help me and thank you all for your time!
