Skip to main content
Since this morning, roughly 1 out of 25 #HTTPS requests to friendica.mrpetovan.com fails because of an invalid date? The #SSL certificate isn't expired and I don't understand why only a small fractions of the requests fail.

Can anyone please #help me troubleshoot the issue?
#help #HTTPS #SSL
Adam
Adam  
You'll have to find out why apache is loading this cert, it has:
Serial #: 03:29:D0:39:1E:C4:02:B5:D2:90:07:C7:A3:23:AB:12:2A:C5
Expires: June 19, 2019

SHA-256 Fingerprint: 40:B9:53:99:15:40:79:AA:7E:13:A5:B0:50:A2:E6:5E:A5:27:3C:1D:12:9B:12:F4:9B:4F:5A:00:3E:A9:99:72
SHA1 Fingerprint:35:F1:D3:F3:F4:DB:A2:03:34:57:91:91:BC:0B:CD:64:1C:56:25:98

(I'm not sure if you'd been able to grab that info along the way)

Find the cert file that has that, and I suspect you'll be able to start tracking down how it's getting used in Apache.
Hypolite Petovan
Hypolite Petovan  
Adam
Adam  
That's interesting... would an extra add-on be doing that? No smileys are showing on my end (and I personally would find that a little annoying in a 'code' block)...
Steffen K9 🐰
Steffen K9 🐰  
I have two add-ons enabled that come to my mind 'unicode-smileys' and 'highlightjs'.
Hypolite Petovan
Hypolite Petovan  
Can confirm the issue with Unicode Emojis.
Adam
Adam  
Heh, that's awesome that a Friendica issue was resolved out of this.
Hypolite Petovan
Hypolite Petovan  
And the cakes goes to Dojo: https://serverfault.com/a/845338

The reason was it was an intermittent error came from lingering Apache processes, even after restart, even after complete stop. These processes would have had the previous certificate in memory while the newer processes would correctly serve the newer certificate. And Apache would randomly assign a process for each request, hence the 1 error out of 25 requests.
Adam
Adam  
I don't know anything about Dojo - does it manage your Apache, or it's own?

I find it amazing that Apache would allow itself to start again (during a restart) when other conflicting processes would already be around. I don't recall ever running in to that situation myself, but I guess it's entirely possible.

I'm glad you found it - I hope you find a solution to hammer away old apache processes in the future too - that would be a situation where unexpected behaviour would drive me a little crazy!
Hypolite Petovan
Hypolite Petovan  
Dojo is the ServerFault username of the person who described my problem in the link I provided.
Adam
Adam  
lol! Oh, that Dojo!

I wound up finding https://dojotoolkit.org/ after searching "apache dojo".

Nevermind me, then! lol
⇧