Hi all,
I am building this on an Rhel 9.6 server and using Letsencrypt. I’d welcome any help to resolve this. Steps welcome too. Thx
Permissions in of the letsencrypte files used by OOD and you will see apache has access to the privatekey2.pem file.
[root@login002 login002.meerkat.mcri.edu.au]# ls -l /etc/letsencrypt/archive/login002.meerkat.mcri.edu.au/*2*
-rw-r--r--. 1 root root 1322 Jul 30 16:35 /etc/letsencrypt/archive/login002.meerkat.mcri.edu.au/cert2.pem
-rw-r--r--. 1 root root 1566 Jul 30 16:35 /etc/letsencrypt/archive/login002.meerkat.mcri.edu.au/chain2.pem
-rw-r--r--. 1 root root 2888 Jul 30 16:35 /etc/letsencrypt/archive/login002.meerkat.mcri.edu.au/fullchain2.pem
-rw-r-----. 1 root apache 227 Jul 30 16:35 /etc/letsencrypt/archive/login002.meerkat.mcri.edu.au/privkey2.pemOOD Portal config for certs:port: '443'
LetsEncrypte SSL certs in : /etc/ood/config/ood_portal.yml
ssl:
- 'SSLCertificateFile /etc/letsencrypt/live/login002.meerkat.mcri.edu.au/fullchain.pem'
- 'SSLCertificateKeyFile /etc/letsencrypt/live/login002.meerkat.mcri.edu.au/privkey.pem'
- 'SSLCertificateChainFile /etc/letsencrypt/live/login002.meerkat.mcri.edu.au/chain.pem'
SSL Error Log
Web page output:
Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.
Please contact the server administrator at root@localhost to inform them of the time this error occurred, and the actions you performed just before this error.
More information about this error may be available in the server error log.
[Tue Aug 12 12:33:56.519135 2025] [auth_openidc:error] [pid 18062:tid 18181] [client 172.16.14.13:32908] oidc_util_http_call: curl_easy_perform() failed on: https://login002.meerkat.mcri.edu.au/dex/.well-known/openid-configuration (SSL certificate problem: self-signed certificate in certificate chain)
[Tue Aug 12 12:33:56.519177 2025] [auth_openidc:error] [pid 18062:tid 18181] [client 172.16.14.13:32908] oidc_provider_static_config: could not retrieve metadata from url: https://login002.meerkat.mcri.edu.au/dex/.well-known/openid-configuration
Server log:
172.16.13.33 - - [12/Aug/2025:12:30:59 +1000] "GET /dex/.well-known/openid-configuration HTTP/1.1" 200 1332 "-" "curl/7.76.1"
172.16.14.13 - - [12/Aug/2025:12:32:45 +1000] "GET / HTTP/1.1" 302 238 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"
172.16.14.13 - - [12/Aug/2025:12:32:45 +1000] "GET /pun/sys/dashboard HTTP/1.1" 500 527 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"
172.16.14.13 - - [12/Aug/2025:12:33:05 +1000] "-" 408 - "-" "-"
172.16.14.13 - - [12/Aug/2025:12:33:53 +1000] "GET / HTTP/1.1" 302 238 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"
172.16.14.13 - - [12/Aug/2025:12:33:53 +1000] "GET /pun/sys/dashboard HTTP/1.1" 500 527 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"
172.16.14.13 - - [12/Aug/2025:12:34:14 +1000] "-" 408 - "-" "-"
172.16.13.33 - - [12/Aug/2025:12:44:01 +1000] "GET /dex/.well-known/openid-configuration HTTP/1.1" 200 1332 "-" "curl/7.76.1"
Running curl from the command line on my OOD server
[root@login002 login002.meerkat.mcri.edu.au]# curl https://login002.meerkat.mcri.edu.au/dex/.well-known/openid-configuration
{
"issuer": "https://login002.meerkat.mcri.edu.au/dex",
"authorization_endpoint": "https://login002.meerkat.mcri.edu.au/dex/auth",
"token_endpoint": "https://login002.meerkat.mcri.edu.au/dex/token",
"jwks_uri": "https://login002.meerkat.mcri.edu.au/dex/keys",
"userinfo_endpoint": "https://login002.meerkat.mcri.edu.au/dex/userinfo",
"device_authorization_endpoint": "https://login002.meerkat.mcri.edu.au/dex/device/code",
"introspection_endpoint": "https://login002.meerkat.mcri.edu.au/dex/token/introspect",
"grant_types_supported": [
"authorization_code",
"refresh_token",
"urn:ietf:params:oauth:grant-type:device_code",
"urn:ietf:params:oauth:grant-type:token-exchange"
],
"response_types_supported": [
"code"
],
"subject_types_supported": [
"public"
],
"id_token_signing_alg_values_supported": [
"RS256"
],
"code_challenge_methods_supported": [
"S256",
"plain"
],
"scopes_supported": [
"openid",
"email",
"groups",
"profile",
"offline_access"
],
"token_endpoint_auth_methods_supported": [
"client_secret_basic",
"client_secret_post"
],
"claims_supported": [
"iss",
"sub",
"aud",
"iat",
"exp",
"email",
"email_verified",
"locale",
"name",
"preferred_username",
"at_hash"
]
And the Cert creation Steps I took:
Steps I took to install the cert:
dnf install certbot python3-certbot-dns-cloudflare
mkdir /root/.secrets/certbot
chmod -R 0700 /root/.secrets/
touch /root/.secrets/certbot/cloudflare.ini
chmod 0400 /root/.secrets/certbot/cloudflare.ini
cd /root/.secrets/certbot
certbot certonly --no-eff-email --agree-tos --dns-cloudflare --dns-cloudflare-credentials /root/.secrets/certbot/cloudflare.ini -m net.support@mcri.edu.au -d login002.meerkat.mcri.edu.au
Result:
# renew_before_expiry = 30 days
version = 3.1.0
archive_dir = /etc/letsencrypt/archive/login002.meerkat.mcri.edu.au
cert = /etc/letsencrypt/live/login002.meerkat.mcri.edu.au/cert.pem
privkey = /etc/letsencrypt/live/login002.meerkat.mcri.edu.au/privkey.pem
chain = /etc/letsencrypt/live/login002.meerkat.mcri.edu.au/chain.pem
fullchain = /etc/letsencrypt/live/login002.meerkat.mcri.edu.au/fullchain.pem
So I guess If a CA issued the certificate, that CA’s root certificate is not present or trusted in the client’s system’s certificate store.
What are the redhat steps to get the CARoot certificate and make it trusted? Or is the issue something else?
