Moodle in English: VPL + Let's Encrypt (Free certificates for https)

VPL + Let's Encrypt (Free certificates for https)

by crémos MOUSLI - Tuesday, April 14, 2020, 3:15 PM

Dear Juan Carlos,

Thank you for your responsiveness and your recommendations, indeed it seems to work better with double quotes "URLPATH = / moodle". I have a warning telling me that my certificate is not valid, the one generated during installation. The user must accept an invalid certificate.

Do I need to generate another certificate via (Lets Encrypt) or a certification authority?

Testing as a student, when the student asks the program to assess it we get messages "@error".

Is this normal?

I will conclude by saying that I have great admiration for the work accomplished.

Best regards,
Crémos Mousli

Re: No execution server available Not found http request URL path not found

by Juan Carlos Rodríguez-del-Pino - Tuesday, April 14, 2020, 5:36 PM

Dear Crémos Mousli,
To use Let's Encrypt you can:

Install Certbot with "sudo apt-get install cerbot"
Stop vpl-jail-service. Cerbot standalone needs port 80
Use cerbot in standalone mode to get certificates
Replace /etc/vpl/cert.pem with a symbolic link to /etc/letsencrypt/live/yourservername/fullchain.pem and /etc/vpl/key.pem with a symbolic link to /etc/letsencrypt/live/yourservername/privkey.pem. Another option is to copy files.
Restart vpl-jail-service

You also must control the renewing of certificates to stop and restart the service before and after of the renewing, notice that cerbot needs the port 80.

Please, let me know if this steps are correct and vpl-jail-service use the Let's Encrypt certificates.

About the problem with the automatic assessment: It seems that you are using a custom vpl_evaluate.sh that needs to be reviewed. Please, show your vpl_evaluate.sh and vpl_evaluate.cases for this activity.

Best regards,
Juan Carlos.

Average of ratings: -

Re: No execution server available Not found http request URL path not found

by crémos MOUSLI - Wednesday, April 15, 2020, 11:12 PM

Dear Juan Carlos,

Thank you again knowing that you are really responsive!

Step 1 — Installing Certbot
sudo apt-get install certbot

Step 2 — Running Certbot
Stop vpl-jail-service. Cerbot standalone needs port 80
certbot certonly --standalone --preferred-challenges http -d jupyter.ac-amiens.fr

Step 3 — Configuring Your Application
ln -s /etc/letsencrypt/live/jupyter.ac-amiens.fr/privkey.pem key.pem
ln -s /etc/letsencrypt/live/jupyter.ac-amiens.fr/cert.pem cert.pem

Step 4 — Handling Certbot Automatic Renewals "The certificate is valid for 3 months".
sudo nano /etc/letsencrypt/renewal/example.com.conf
A text file will open with some configuration options. Add your hook on the last line: "renew_hook = systemctl reload rabbitmq"
echo "00 00 01 /2 * /usr/bin/letsencrypt renew ; service vpl-jail-system start #LETS ENCRYPT RENEW ALL DOMAINS" >> /etc/crontab

When do you think ?
Thank you very much for your investment,

Crémos Mousli

Average of ratings: -

Re: No execution server available Not found http request URL path not found

by Juan Carlos Rodríguez-del-Pino - Thursday, April 16, 2020, 12:55 AM

Dear Crémos,
Really I haven't fully checked these steps, due to CAA DNS record. But, please, consider the following:

I think that at step 3 you must use
ln -s /etc/letsencrypt/live/jupyter.ac-amiens.fr/fullchain.pem cert.pem

The use of /etc/letsencrypt/live/jupyter.ac-amiens.fr/cert.pem may be insufficient if the browser needs the intermediate CAs certificates.

At step 4, I think that it will be better to use again cerbot command, instead of letsencrypt. Also, you need to stop the service before the certificate renews. Notice that at this moment the vpl-jail-system always tries to open the HTTP port (80 by default). If you change the HTTP port to other e.g. 8080 you will not need to stop the service, you only need to restart it after the renew.
The command may be something like
certbot renew --pre-hook "service vpl-jail-system stop" --post-hook "service vpl-jail-system start"
if PORT=8080 then
certbot renew --post-hook "service vpl-jail-system restart"

Best regards,
Juan Carlos.

Average of ratings: -

Re: No execution server available Not found http request URL path not found

by crémos MOUSLI - Thursday, April 16, 2020, 2:06 AM

Dear Juan Carlos,

Thanks for all the details.

Inside my bash (certbotrenew.sh)
#! / bin / bash
/usr/ bin/ certbot renew --pre-hook "service vpl-jail-system stop" --post-hook "service vpl-jail-system start" -q >> /var/log/certbot-renew.log | mail -s "CERTBOT Renewals" me@myemail.com /log/certbot-renew.log
exit 0
#####
and my cron is
00 20 * * 1 /bin/certbotrenew.sh

when do you think ?

Best regards,
Crémos Mousli

Average of ratings: -

Re: No execution server available Not found http request URL path not found

by Juan Carlos Rodríguez-del-Pino - Thursday, April 16, 2020, 3:58 AM

"Now" ;) ;)
I think the time (three months) will tell us if it is correct.

Best regards,
Juan Carlos.

Average of ratings: -

Virtual Programming Lab (plugin)

VPL + Let's Encrypt (Free certificates for https)