Reseting SSL certificate for aaPanel portal, without any insecure access

brainchild

How can I reset the SSL certificate for aaPanel port access?

I am requesting certificates through Let's Encrypt.

One solution suggests disabling SSL during the process. However, access credentials would be exposed in plain text.

Is a more secure solution available to reset SSL settings for aaPanel, without any access that is insecure?

aaPanel_Kern

Hello, you can set up the Panel SSL configuration via the settings interface Let's Encrypt and access the panel using the SSL certificate validation domain name. No binding domain required

brainchild

aaPanel_Kern

How can the interface be accessed securely (without leaking credentials, or other secrets, in plaintext), when a certificate is not currently installed?

aaPanel_Kern

Hello,
The panel uses self-signed certificates by default
You can enable SSL certificate access using bt 27 and access using https

brainchild

aaPanel_Kern

If the current certificate, issued by an authority, is disabled, will aaPanel revert automatically to using a self-signed certificate, until a new certificate is installed?

aaPanel_Kern

No, you need to do it yourself, you can usebt 27to use a self-signed certificate

brainchild

aaPanel_Kern

Would it be possible to reset the certificate, without any insecure access, by the following steps?:

Remove the current certificate (issued by an authority) through the web interface.
Open a secure shell, to execute bt 27.
Return to the web interface, accepting the self-signed certificate.
Through the web interface, install a new certificate.

Perhaps step (1) is unnecessary.

aaPanel_Kern

brainchild
Yes, 2,3,4

brainchild

aaPanel_Kern

After I execute bt 27, the browser is not successfully receiving a self-signed certificate.

Various web browsers all fail, reporting slightly different messages.

In Firefox, the message reads...

An error occurred during a connection to aapanel.mydomain.com:1234. SSL received a record that exceeded the maximum permissible length.

Error code: SSL_ERROR_RX_RECORD_TOO_LONG

Fortunately, I can restore the previous certificate, by executing the same command again. I believe the system is now in the same state as originally.

brainchild

aaPanel_Kern

Do you have any suggestions for switching successfully to using a self-signed certificate?

Presently, I can restore the certificate previously installed, issued from an authority, but it will expire soon. I need to request a new certificate, which requires disabling the certificate, while accessing the interface successfully with a self-signed certificate.

aaPanel_Kern

Hello,
It is recommended that you use a new subdomain dedicated panel and use file verification to apply for SSL. Certificates below 30 days will automatically apply for renewal.

brainchild

aaPanel_Kern

Sorry. I am not understanding the recommendation.

Are you advising that I provision a new subdomain (which would also require new records in the name server)?

Would I be required to access aaPanel permanently only through the new subdomain, or is the new subdomain intended only as a temporary workaround?

Please explain the steps you suggest in more detail. Thank you.

aaPanel_Kern

Hello, yes, use the new subdomain and set up the record to the server IP
If you do not want to see the prompt that it is not safe, the subdomain used requires the domain name authenticated by the SSL certificate for consistent matching

brainchild

aaPanel_Kern

There may have been a misunderstanding.

The problem is not that I do not want to see a prompt to accept the self-signed certificate. I would be happy accepting the self-signed certificate.

The problem is that, in fact, I do not see a prompt to accept the certificate. Instead, the browser rejects the certificate as completely invalid (not as unsigned, but as internally malformed).

aaPanel_Kern

Hello,
Is it OK to delete all files in this /www/server/panel/ssl directory and then re-execute bt 27?

brainchild

aaPanel_Kern

After the recommended actions, could the interface still be accessible securely using the certificate currently installed from the authority?

It is necessary that at least one certificate be available to continue supporting secure access, even if the steps fail to allow correct installation of the self-signed certificate.

aaPanel_Kern

Hello,
By default, you can use a self-signed SSL certificate. You can change it on the interface yourself.

brainchild

aaPanel_Kern

I am explaining that the attempts to use the self-signed certificate are unsuccessful.

The browser reports the certificate is malformed (not that the signature cannot be verified against an authority).

aaPanel_Kern

Hi, can you give us your aapanel information? The server makes a snapshot backup first, if possible, please send it to kern@aapanel.com.
It is recommended to fill in the following
Post link:
SSH IP address, account password and port:
aapanel login link address and account password:
Detailed problem description:

No post link will not be able to know which user's information is, and the problem will not be processed

brainchild

aaPanel_Kern

If I delete all files in /www/server/panel/ssl, would it still be possible to revert to using the current certificate issued from the authority, in case it remains unsuccessful to use a self-signed certificate?

aaPanel_Kern

brainchild
Yes, bt 27