while investigating for EXITCODE=51 I came across this posting:
As I’m using a LetsEncrypt certificate as well, I’m wondering if the root cause for my issues could be the same as described in the above post. How can I find out?
Workaround (untested), please remove the “–cacert /etc/univention/ssl/ucsCA/CAcert.pem” from all curl calls in the join script and run univention-run-join-scripts (i am not sure but i think the letsenrypt app puts the root certificate into the global certificate store by now)
OK, i modified the wordpress join script (removed --cacert from the curl calls). Join works with the standard UCS root ca (as use registers the root ca in the global ca store, lets hope the letsencrypt app does the same).
this should be the final fix for the wordpress app (rely on the global certificates store rather than specify the --cacert curl paramater).
The letsenrypt App also stores its root ca certificates in the global certificates store (i havn’t actually tested this, but i have been told that indeed this is the case ), so we should be good
After this, the same (!) Wordpress installation (including the already edited content) as before came up again?! The script (50wordpress.inst) ran into the same error again.
Did I missed somehing, e.g. manually remove docker-container, reboot the machine or something else?
that is normal, the wordpress files are in a docker volume (a directory mapped to the docker host) and the data/config in a database on the host, both are not removed and are reused.
But the join script 50wordpress.inst should be the new one, can you post this file?
OK, my initial analysis was wrong, the problem is not the certificate in the wordpress container but that fact, that the wordpress join script (executed on the host) wants to establish a https connection to the system with the UCS hostname (curl https://$UCS_HOSTNAME/wordpress/setup…).
This fails with letsenrypt because the apache is using the new cert which is only valid for the external DNS name (the name letsenrypt is using) not the actual hostname of the system.
Quick fix is to use http://localhost instead of https://$(hostname -f) in the join script (should be ok from a security standpoint, because of localhost). This is now changed in the wordpress app.
Could you try again (remove, update, install) and let me know if this works now?
Real fix is to change the letsenrypt app. The apache SSL configuration should use the letsenrypt certificate only for the external DNS name (virtual host) not for the real system name.
), so we should be good
Thank you Felix.