MacOS Server 5.6.3 certificate auto renewal cause collaboration services disruption

Well there won't be another thread! For those reading down this far!

The issue of the Certificate was solved with the guidance for LetsEncrypt, mentioned above and I am looking forward to install auto renewal.

As for the Wikis issue, after checking as much as I can the A & B above and also if the FQDN of domain was correctly inscribed in the configuration file, I was down to C, for a full reinstall of the Server App.

Luckily, I have several backups of different types, Time Machine, Disk Images and Full Volumes copies. I used the Time Machine to restore the dedicated volume for the Server App specific and users datas because it was the freshest one, the others were a few days older. After manually comparing the content of different backups I notice that the Time Machine restoration was incomplete.

I wasn't aware that Time Machine would not back up all the files, as I never restored a full non booting volume with TM before. I was under the expectation that all files, even system files were to be copied. I decided then to experiment a feature of Carbon Copy Cloner to fusion the content of two different volumes with the “preserve newer files” option. What I had to loose, better loosing a few days of office work than many years!

It worked perfectly, better that I could hope for! On putting the Wikis back on, It loaded in a snap! All the calendars that are linked to the Wikis also reappeared on the spot! What a relief before reopening the office tomorrow morning!

I'll try to perform a system upgrade on the server as soon as possible and definitely do a migration in a short future. My main concern is to find the best solution to preserve the Wikis datas and functionnality, is anyone with experience would have a suggestion?

Thanks to all that helped on this issue and to all those that were considering helping!

Especially, thanks to Bombich Software! A life saver!

Thanks for links Yikes!

There will be very helpful, especially if I decide to continue to use LetsEncrypt certificates. I'm new to it and it seems to do a good job!

I may report the occurence of a major bug with Server 5.6.3 running MacOS X 10.13.6 localized for French-Canada. When the renewal of a self signed certificate is initiated by the application itself, it will produce a new certificate that is disrupting the collaboration service of the Server. This new certificate is also considered invalid by the client devices.

In the office over here, this trouble started on the afternoon of Friday September 4th 2020, when the Server application initiated automatically the renewal of its self signed certificate that was due to expire on December 6th 2020. Within minutes, this renewal gradually causing a major havoc in the office.

As a first time user of LetsEncrypt, I followed the Getting Started instructions created a startup partition from a backup previous to the certificate renewal to have the Web service running and to have a web site running on http port 80. This was complicated by the fact that during the time it took to install

Thanks for links Yikes!

There will be very helpful, especially if I decide to continue to use LetsEncrypt certificates. I'm new to it and this organization seems to do a good job!

I may report the occurence of a major bug with Server 5.6.3 running MacOS X 10.13.6 localized for French-Canada. When the renewal of a self signed certificate is initiated by the application itself, it will produce a new certificate that is disrupting the collaboration services of the Server. This new certificate is also considered invalid by the client devices.

In the office over here, this trouble started on the afternoon of Friday September 4th 2020, when the Server application initiated automatically the renewal of its self signed certificate that was due to expire on December 6th 2020. Within minutes, this renewal gradually causing a major havoc in the office.

As a first time user of LetsEncrypt, I followed the Getting Started instructions and I created a new startup partition from a backup previous to the certificate renewal to have the Web service running and have a web site active on http port 80. This was complicated by the fact that during the time it took to install HomeBrew and CertBot, the certificate was renewing itself and I was loosing the Web service.

On the CertBot certificate installation:

sudo certbot certonly --apache

I was getting all the times the error:

“Unable to find a virtual host listening on port 80 which is currently needed for Certbot to prove to the CA that you control your domain. Please add a virtual host for port 80.”

Which I taught was caused by the disruption of the Web service.

The workaround I found, was the follow the instructions of Seth Schoen on his July 19 2019 answer to Cannot issue cert for Mac Server where he propose two options to get the certificate, the alternate being to use this terminal command instead:

certbot certonly --webroot

And manually install the certificate with the Server interface.

I did this a few hours ago and it went well for the new certificate's installation, there were some issues restarting the Mail service, but the Mail service seems to be back on for now. My main problem at this moment is with the Wikis that I can reach now on https, but it hangs on the window's opening with Safari and ultimately returns the 502 Proxy Error.

BDAqua wrote:

A Bug report will go in the Round Filing drawer.:(

Most likely, especially with the current status of this version the MacOS X Server application.

But it may warns other users of this dangerous potential issue as it may kill a business as it is causing great harms and stresses to mine at this moment.

I am not so sure that the auto certificate renewal has anything to do with the App Store, it's most probably an internal setting inside the application or in a configuration file that I wasn't able to locate.

Many thanks

MrHoffman wrote:

This mess is pretty much normal.

Private self-generated certs that don’t get auto-renewed will (also) cause piles of connection failures.

Thank you for the clarifications. I do understand the necessity of auto-renewal and I suppose that this is an internal setting of the Server App to renew its own certificate 60 days in advance without an alert.

I will definitely look forward for auto-renewal with LetsEncrypt! Thanks for the additional informations.

The real trouble is that the Server 5.6.3 App generates a new self signed certificate that is incompatible with itself, which in all practicality means the auto dysfunctioning of the collaboration services. Hoping it's not auto destructions. That's the waning I try to express to other potential users!

---------

Practically, the main issue of this thread is solved, as the new certificate seems to perform normally, minus ONE huge issue with the Wikis.

During the two days of the intense stress that this issues caused, not knowing wha's exactly what was going on, my first actions were to salvage as much datas as possible, save all settings and make multiple backup volumes of the startup partition with the previous old certificate.

With our office settings with Server 5.6.3 all the application and users datas are located on a dedicated volume. Yesterday the volume was erased with Disk Utility with the MacOS extended format. The “Library” folder was copied back from a fresh Time Machine backup while being in root user.

Now it seems that all services can be put back on except for the Wikis that return in Safari:

1) 502 Proxy error

The proxy server received an invalid response from an upstream server.

The proxy server could not handle the request GET /wiki.

Reason: Error reading from remote server

or

2) 503 Service Unavailable

The server is temporarily unable to service your request due to maintenance downtime or capacity problems. Please try again later.

Additionally, a 503 Service Unavailable error was encountered while trying to use an ErrorDocument to handle the request.

Apache Server at wiki.photographex.com Port 35343

My questions how to solve this major problem:

A) Is it a folders and files permissions issue? If yes, how to solve that?

B) Is it a configuration issue in the config files? I have none experience with these particular one located in: </Library/Server/Wiki/Config>

C) Should I just uninstall Server by putting it the the garbage, reboot the computer and put the Server App back in the application folder to force a reinstallation?

Any hint will be welcome!

Maybe should I start a new thread for this?

Many thanks for your help!

Regards

Mr Hoffman,

Well! I know too well that Server is gone, I am just late, if I survive all this I will definitely get out of this as soon as possible.

Thanks for all the informations clarifying the correct procedure for certificate uses. This is much appreciated.

I am still trying to figure out the issue with Wikis, I am very afraid I've lost a lot essential datas. I am not sure but it looks like Time Machine back up isn't complete of the “Library” folder!

I'll start a new thread for this!

Many thanks and my best regards!