Getting ✗ Error self-signed certificate in CLI | Appwrite | Page 1

runic lake Jun 21, 2023, 12:04 PM

#

I am trying to login in CLI and getting ✗ Error self-signed certificate

pref.json is

{
    "endpoint": "https://abc.example.com/",
    "cookie": "",
    "key": "",
    "selfSigned": "true"
}

#

server version 1.3.71
cli version 2.0.2

#

it seems, SSL is not yet generated for some reason 👀 , it have been quite a while...

#

Certificate seems to have been generated still it showing SSL is not there

#

The certificate is not trusted because it is self-signed.
 
Error code: MOZILLA_PKIX_ERROR_SELF_SIGNED_CERT

topaz dagger Jun 21, 2023, 12:37 PM

#

selfSigned need to be boolean

#

"selfSigned": true instead of "selfSigned": "true"

runic lake Jun 21, 2023, 12:45 PM

#

topaz dagger `"selfSigned": true` instead of `"selfSigned": "true"`

seems still not working,

✗ Error Not Found

topaz dagger Jun 21, 2023, 12:48 PM

#

Don't you forgot v1 at end of endpoint ?

runic lake Jun 21, 2023, 12:49 PM

#

topaz dagger Don't you forgot v1 at end of endpoint ?

yaa right

#

thank you

#

any idea about the SSL part?

topaz dagger Jun 21, 2023, 12:52 PM

#

Check you'r CNAME config

runic lake Jun 21, 2023, 12:56 PM

#

those seems fine

runic lake Jun 21, 2023, 5:30 PM

#

does SSL needs to be enabled for parent domain only then on child domain SSL gets enabled?

lofty quarry Jun 21, 2023, 5:34 PM

#

It doesn't sounds like a requirement

What are the logs of:

docker logs appwrite 
docker logs appwrite-worker-certificates

Check list:

Have you added the domain as a custom domain to any of your projects?
Check the logs again after running docker exec -it appwrite ssl

runic lake Jun 21, 2023, 5:36 PM

#

checking it

#

Have you added the domain as a custom domain to any of your projects?
Nope

Check the logs again after running docker exec -it appwrite ssl
checking ...

lofty quarry Jun 21, 2023, 5:38 PM

#

So first add it

#

Then run the ssl command

runic lake Jun 21, 2023, 5:39 PM

#

mmm, in the logs seeing this,

Cannot renew domain (appwrite.mobc.com) on attempt no. 3 certificate: Failed to issue a certificate with message: Saving debug log to /var/log/letsencrypt/letsencrypt.log
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

lofty quarry Jun 21, 2023, 5:43 PM

#

What version of Appwrite you have?

runic lake Jun 21, 2023, 5:44 PM

#

1.3.7

#

I didn't faced this issue when deployed earlier for anther sub-domain for some reason facing only for this

lofty quarry Jun 21, 2023, 5:49 PM

#

Sometime when the challenges don't pass

#

Its best to wait like an hour and retry,

runic lake Jun 21, 2023, 5:50 PM

#

mm, actually I treid this like 6 hr ago

lofty quarry Jun 21, 2023, 5:52 PM

#

Ohh

#

And you didn't run the SSL now?

runic lake Jun 21, 2023, 5:54 PM

#

nope, still haven't got it enabled for some reason

lofty quarry Jun 21, 2023, 5:54 PM

#

runic lake

I mean this command again

runic lake Jun 21, 2023, 5:55 PM

#

oh you mean, after running the command should wait for min 1hr or so?

#

I ran that just 5min or so ago

lofty quarry Jun 21, 2023, 5:59 PM

#

Ohh
So I meant run it again after 1 hour yes

runic lake Jun 21, 2023, 5:59 PM

#

👍

topaz dagger Jun 21, 2023, 6:49 PM

#

Add this volumes to appwrite-worker-certificates on docker-compose file

- ./le_log:/var/log/letsencrypt

And run it again. You can look at log message

#

Or on appwrite container ? Not knows, you need to try it ^^
NB: Create le_log folder before ofc

runic lake Jun 22, 2023, 5:51 AM

#

lofty quarry Ohh So I meant run it again after 1 hour yes

seems some issue with Redis?

Fatal error: Uncaught RedisException: socket error on read socket in /usr/src/code/vendor/colinmollenhour/credis/Client.php:1334
Stack trace:
#0 /usr/src/code/vendor/colinmollenhour/credis/Client.php(1334): Redis->ping()
#1 /usr/src/code/vendor/resque/php-resque/lib/Resque/Redis.php(265): Credis_Client->__call('ping', Array)
#2 /usr/src/code/vendor/resque/php-resque/lib/Resque/Worker.php(180): Resque_Redis->__call('ping', Array)
#3 /usr/src/code/vendor/resque/php-resque/bin/resque(185): Resque_Worker->work('1', false)
#4 {main}

Next CredisException: socket error on read socket in /usr/src/code/vendor/colinmollenhour/credis/Client.php:1351
Stack trace:
#0 /usr/src/code/vendor/resque/php-resque/lib/Resque/Redis.php(265): Credis_Client->__call('ping', Array)
#1 /usr/src/code/vendor/resque/php-resque/lib/Resque/Worker.php(180): Resque_Redis->__call('ping', Array)
#2 /usr/src/code/vendor/resque/php-resque/bin/resque(185): Resque_Worker->work('1', false)
#3 {main}

Next Resque_RedisException: Error communicating with Redis: socket error on read socket in /usr/src/code/vendor/resque/php-resque/lib/Resque/Redis.php:268
Stack trace:
#0 /usr/src/code/vendor/resque/php-resque/lib/Resque/Worker.php(180): Resque_Redis->__call('ping', Array)
#1 /usr/src/code/vendor/resque/php-resque/bin/resque(185): Resque_Worker->work('1', false)
#2 {main}
  thrown in /usr/src/code/vendor/resque/php-resque/lib/Resque/Redis.php on line 268

runic lake Jun 22, 2023, 5:53 AM

#

topaz dagger Or on appwrite container ? Not knows, you need to try it ^^ NB: Create le_log fo...

where do you suggest to create that le_log folder ?

topaz dagger Jun 22, 2023, 8:26 AM

#

runic lake where do you suggest to create that `le_log folder` ?

On same folder than your docker compose file

runic lake Jun 22, 2023, 8:27 AM

#

you mean inside appwrite folder?

topaz dagger Jun 22, 2023, 8:28 AM

#

Yes

runic lake Jun 22, 2023, 12:42 PM

#

umm, still doesn't seems to solve it

lofty quarry Jun 22, 2023, 12:44 PM

#

Do you see you domain here?

ls /var/lib/docker/volumes/appwrite_appwrite-certificates/_data

Do you have new logs in:

appwrite
appwrite-worker-certificates

runic lake Jun 22, 2023, 12:45 PM

#

checking..

runic lake Jun 22, 2023, 12:45 PM

#

lofty quarry Do you see you domain here? ```sh ls /var/lib/docker/volumes/appwrite_appwrite-c...

~/appwrite$ sudo ls /var/lib/docker/volumes/appwrite_appwrite-certificates/_data

this prints nothing

lofty quarry Jun 22, 2023, 12:46 PM

#

So you have no certificates.

#

btw, Why you don't want that domain to be your main Appwrite domain?

runic lake Jun 22, 2023, 12:46 PM

#

ya, it have been not generated

runic lake Jun 22, 2023, 12:46 PM

#

lofty quarry btw, Why you don't want that domain to be your main Appwrite domain?

you mean root domain?

lofty quarry Jun 22, 2023, 12:46 PM

#

Yes, for Appwrite

runic lake Jun 22, 2023, 12:47 PM

#

umm, because there would be static website page so...

lofty quarry Jun 22, 2023, 12:47 PM

#

Yes, but it won't interfere.

#

What I mean is that you'll still use that sub-domain but that would be your main domain of Appwrite

#

Is this make sense?

runic lake Jun 22, 2023, 12:48 PM

#

but doesn't console will open when try to vist root domain 👀

lofty quarry Jun 22, 2023, 12:48 PM

#

Nope.

#

Only the domain that points to Appwrite

runic lake Jun 22, 2023, 12:50 PM

#

mm, so you are saying when user will try to vist appwrite.xyz.com to open console but if user vist xyz.com it will open static website ?

lofty quarry Jun 22, 2023, 12:50 PM

#

Exactly

#

What I suggest is

Remove the custom domain from Appwrite console.
Add A record of your sub-domain points to Appwrite

Then follow all the steps here: #1113876456779554826 message

runic lake Jun 22, 2023, 12:51 PM

#

I mean I did tried it

lofty quarry Jun 22, 2023, 12:52 PM

#

With _APP_DOMAIN and _APP_DOMAIN_TARGET?

runic lake Jun 22, 2023, 12:52 PM

#

one min will share ss

runic lake Jun 22, 2023, 12:53 PM

#

lofty quarry With `_APP_DOMAIN` and `_APP_DOMAIN_TARGET`?

#

I guess same as yestraday

lofty quarry Jun 22, 2023, 12:55 PM

#

Okay

#

Now, see if you get an error on other containers?

runic lake Jun 22, 2023, 12:55 PM

#

Cannot renew domain (appwrite.monofyi.com) on attempt no. 8 certificate: Failed to issue a certificate with message: Saving debug log to /var/log/letsencrypt/letsencrypt.log
Some challenges have failed.
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.

#

sorry I didn't get other containers? part

lofty quarry Jun 22, 2023, 1:00 PM

#

Are you using Cloudflare in front of your Appwrite?

runic lake Jun 22, 2023, 1:01 PM

#

yaa, as DNS config

#

I mean for root domain

lofty quarry Jun 22, 2023, 1:01 PM

#

Mmm,
Okay and what is your ssl settings?

runic lake Jun 22, 2023, 1:01 PM

#

btw it seems I found in AWS server inboud TCP for port 80 is not added

lofty quarry Jun 22, 2023, 1:02 PM

#

lofty quarry Mmm, Okay and what is your ssl settings?

runic lake Jun 22, 2023, 1:02 PM

#

lofty quarry Jun 22, 2023, 1:02 PM

#

runic lake btw it seems I found in AWS server inboud TCP for port 80 is not added

Okay,

#

So it can be on strict until you've set the SSL

#

Here's what you can do

#

Edit the A record

#

Remove the Proxied switch
Then access your domain to see it's accessbile without cloudflare.

runic lake Jun 22, 2023, 1:03 PM

#

lofty quarry Jun 22, 2023, 1:03 PM

#

Then run SSL generation again.

#

Make sure to disable it

runic lake Jun 22, 2023, 1:04 PM

#

done let try

lofty quarry Jun 22, 2023, 1:05 PM

#

When it done
You can get it back to Proxied
But, I still not sure you can use Full (strict) so you can use just Full

runic lake Jun 22, 2023, 1:06 PM

#

runic lake ``` Cannot renew domain (appwrite.monofyi.com) on attempt no. 8 certificate: Fai...

after ruuning the ssl command on appwrite folder still getting this

#

I guess I might need to enable prot 80 for TCP in-bound on AWS

lofty quarry Jun 22, 2023, 1:08 PM

#

Enable it anyhow yes, so letsencrypt can pass the challange under http

runic lake Jun 22, 2023, 1:09 PM

#

enabled it still diff

lofty quarry Jun 22, 2023, 1:09 PM

#

runic lake ``` Cannot renew domain (appwrite.monofyi.com) on attempt no. 8 certificate: Fai...

Which container producted this output?

runic lake Jun 22, 2023, 1:10 PM

#

lofty quarry Which container producted this output?

sudo docker logs appwrite-worker-certificates this command

lofty quarry Jun 22, 2023, 1:10 PM

#

Okay,
If you now accessing your Appwrite in incognito, as browser save some SSL cache

#

Do you have SSL?

runic lake Jun 22, 2023, 1:11 PM

#

I didn't tried access it in the incognito

lofty quarry Jun 22, 2023, 1:11 PM

#

So try and lmn

runic lake Jun 22, 2023, 1:12 PM

#

I mean it doesn't even open

#

lofty quarry Jun 22, 2023, 1:12 PM

#

This is your domain?
appwrite.monofyi.com

runic lake Jun 22, 2023, 1:12 PM

#

with public IP I can access the console

runic lake Jun 22, 2023, 1:12 PM

#

lofty quarry This is your domain? appwrite.monofyi.com

yap

lofty quarry Jun 22, 2023, 1:13 PM

#

In my computer you have a valid Let's Encrypt certificate

runic lake Jun 22, 2023, 1:13 PM

#

yaa, I just noticed I can now on phone but seems not opening on laptop

#

seems some cache issue

lofty quarry Jun 22, 2023, 1:15 PM

#

runic lake ``` Cannot renew domain (appwrite.monofyi.com) on attempt no. 8 certificate: Fai...

btw, if you want to see the logs of the file, you can run

 docker exec appwrite-worker-certificates cat /var/log/letsencrypt/letsencrypt.log

runic lake Jun 22, 2023, 1:16 PM

#

thank you, yaa seems now good... it seems the TCP needed to be enabled and also on Cloud-Flair proxy that be disabled

lofty quarry Jun 22, 2023, 1:16 PM

#

You can turn on Cloudflare proxy

runic lake Jun 22, 2023, 1:16 PM

#

I guess I can now remove the port 80 right?

lofty quarry Jun 22, 2023, 1:16 PM

#

But change to full

lofty quarry Jun 22, 2023, 1:17 PM

#

runic lake I guess I can now remove the port 80 right?

I think it has to be opened one in 90 days when the next challenge occurs.

runic lake Jun 22, 2023, 1:17 PM

#

oh, right mm

#

thank you again

#Getting ✗ Error self-signed certificate in CLI

Check list: