已安装Bitnami Let's Encrypt SSL但站点仍不安全求助

环境与操作背景 #

• AWS Lightsail Node.js服务器，使用Bitnami的bncert-tool安装Let's Encrypt SSL证书
• 修改了两个虚拟主机配置文件：
  • /opt/bitnami/apache/conf/vhosts/myapp-http-vhost.conf
  • /opt/bitnami/apache/conf/vhosts/myapp-https-vhost.conf
• 将应用目录从/opt/bitnami/projects/myapp/public改为/opt/bitnami/projects/whiteboard，HTTP虚拟主机示例配置如下：

<VirtualHost _default_:80>
    ServerAlias *
    DocumentRoot "/opt/bitnami/apache/htdocs/whiteboard"
    <Directory "/opt/bitnami/apache/htdocs/whiteboard">
      Require all granted
    </Directory>
    ProxyPass / http://localhost:3000/
    ProxyPassReverse / http://localhost:3000/
  </VirtualHost>

问题现象 #

1. HTTPS访问https://simplifylearning.org/test-wb.html时，浏览器提示“您的连接不是私密连接”，证书显示为过期的example.com证书，而非安装的Let's Encrypt证书
2. HTTP访问时返回代理错误：

Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request

Reason: Error reading from remote server

3. 更换浏览器、重启Apache后问题依旧

已完成的排查操作 #

• 验证证书与密钥哈希匹配，结果一致：

openssl pkey -in /opt/bitnami/apache/conf/simplifylearning.org.crt -pubout -outform pem | sha256sum
openssl pkey -in /opt/bitnami/apache/conf/simplifylearning.org.key -pubout -outform pem | sha256sum

• bitnami-ssl.conf中证书路径配置正确：

<VirtualHost _default_:443>
  DocumentRoot "/opt/bitnami/apache/htdocs"
  SSLEngine on
  SSLCertificateFile "/opt/bitnami/apache/conf/simplifylearning.org.crt"
  SSLCertificateKeyFile "/opt/bitnami/apache/conf/simplifylearning.org.key"
</VirtualHost>

• bncert-tool生成的simplifylearning.org.json显示有效条目：

{
    "domain": "simplifylearning.org",
    "certUrl": "https://acme-v02.api.letsencrypt.org/acme/cert/0419...d658",
    "certStableUrl": "https://acme-v02.api.letsencrypt.org/acme/cert/0419...d658"
}

• 证书文件权限配置正确：

ls -la /opt/bitnami/letsencrypt/certificates/simplifylearning.org.crt
-rw-r--r-- 1 bitnami root 5292 Oct  3 14:27 /opt/bitnami/letsencrypt/certificates/simplifylearning.org.crt

ls -la /opt/bitnami/letsencrypt/certificates/simplifylearning.org.key
-rw-r--r-- 1 bitnami root 227 Oct  3 14:27 /opt/bitnami/letsencrypt/certificates/simplifylearning.org.key

• 已执行Apache重启命令：

sudo /opt/bitnami/ctlscript.sh restart apache

解决方案 #

1. 修复SSL证书不生效问题 #

检查虚拟主机配置优先级

Bitnami默认的bitnami.conf可能包含默认的SSL虚拟主机配置，优先于你的自定义vhost生效，导致加载example.com证书：

• 打开/opt/bitnami/apache/conf/bitnami/bitnami.conf，查找<VirtualHost _default_:443>块，若存在，直接替换为你的证书配置，或者注释掉该块。

完善HTTPS虚拟主机配置

确保自定义的myapp-https-vhost.conf包含完整的SSL配置，不要仅依赖bitnami-ssl.conf，示例配置：

<VirtualHost _default_:443>
    ServerName simplifylearning.org
    ServerAlias www.simplifylearning.org
    DocumentRoot "/opt/bitnami/projects/whiteboard"
    <Directory "/opt/bitnami/projects/whiteboard">
        Require all granted
        AllowOverride All
    </Directory>
    SSLEngine on
    SSLCertificateFile "/opt/bitnami/letsencrypt/certificates/simplifylearning.org.crt"
    SSLCertificateKeyFile "/opt/bitnami/letsencrypt/certificates/simplifylearning.org.key"
    # 必须配置Let's Encrypt链式证书，否则部分浏览器会判定证书无效
    SSLCertificateChainFile "/opt/bitnami/letsencrypt/certificates/simplifylearning.org.ca-bundle"
    ProxyPass / http://localhost:3000/
    ProxyPassReverse / http://localhost:3000/
</VirtualHost>

同步证书文件路径

你当前在bitnami-ssl.conf中引用的是/opt/bitnami/apache/conf/下的证书，但实际证书存储在/opt/bitnami/letsencrypt/certificates/目录，可能存在文件未同步的问题，执行以下命令同步：

sudo cp /opt/bitnami/letsencrypt/certificates/simplifylearning.org.* /opt/bitnami/apache/conf/
sudo chown bitnami:root /opt/bitnami/apache/conf/simplifylearning.org.*

2. 修复HTTP代理错误 #

检查Node.js服务状态

代理错误说明Apache无法连接到localhost:3000的Node.js服务：

• 执行curl http://localhost:3000/test-wb.html，确认是否能正常返回内容
• 检查Node.js服务是否启动：

  sudo systemctl status your-node-app.service # 若用systemd管理服务
  netstat -tulpn | grep 3000 # 检查端口是否被监听
  

验证Apache代理模块

确保Apache的代理模块已启用：

sudo /opt/bitnami/apache/bin/httpd -M | grep proxy

若proxy_module、proxy_http_module未加载，编辑/opt/bitnami/apache/conf/httpd.conf，取消对应模块的注释：

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so

3. 验证配置并重启Apache #

• 先检查Apache配置语法是否正确：

  sudo /opt/bitnami/apache/bin/httpd -t
  

• 若语法无错误，强制重启服务：

  sudo /opt/bitnami/ctlscript.sh stop apache
  sudo /opt/bitnami/ctlscript.sh start apache
  

4. 额外验证 #

用openssl直接检查Apache返回的证书：

openssl s_client -connect simplifylearning.org:443

查看输出中的证书信息，确认是否为你的Let's Encrypt证书。

内容的提问来源于stack exchange，提问作者Mor Sagmon