Aapanel problem with Cloudflare SSL Origin Certificate and Key after upgrade

aaP_zwj1021

Hello, I upgraded to the latest Aapanel and my SSL certificates stopped working. I'm using Cloudflare 15 year origin certificate and key, worked fine before the upgrade.

I have tried deleting the certificate and key, created new certificate and key pair (both are Cloudflare 15 year Origin Certificate and Key), re-adding them back into panel. If I use ECC encryption to create the Cloudflare certificate and key then the panel won't even let me save the certificate and key, so I used RSA, aapanel can save this but it shows "null" as certificate brand, before the upgrade of aapanel to the latest version, the certificate brand used to show "Cloudflare".

I used one of the Cloudflare allowed port numbers and changed the port number in aapanel settings, it can access the panel using IP address and this port number. BUT, when I added the domain name in the panel, and tried to access the panel using "domainname: port number", it shows SSL certificate invalid. I'm using "Full Strict " mode in Cloudflare as it is the 15 years origin certificate I'm using. So now in order to access aapanel, I had to SSH into the server and did the "bt 12" to unbind the domain.

What is wrong? Does Aapanel latest version work with Cloudflare 15 year origin certificate and key?

aaPanel_Kern

Hello, yes, both the current self-signed certificate and the Cloudflare self-signed certificate will display null.
Is the certificate used by aapanel a Cloudflare self-signed certificate or a trusted certificate? What port is used?

aaP_zwj1021

aaPanel_Kern It's the free version of the Cloudflare 15 years origin certificate. Does Aapanel support Cloudflare's ECC encryption?

aaPanel_Kern

Hello, it is supported as long as it is successfully added and can be accessed by restarting aapanel.

aaP_zwj1021

aaPanel_Kern So what is causing my issue here????

aaPanel_Kern

What port is used?

aaP_zwj1021

aaPanel_Kern port 8443 is used, this is an allowed port by Cloudflare

aaPanel_Kern

Is it normal to directly use the server's IP + port to access?
Do you restrict IP access?

aaP_zwj1021

aaPanel_Kern I don't now if it's normal to just access the backoffice with only IP+port but it isn't what I'm planning on doing, thus I'm asking here why aapanel isn't allowing domain + port access with Cloudflare products used, and how to make this work? Haven't restricted any IPs.

aaPanel_Kern

Yes, there is no limit. It is recommended that you first confirm whether aapanel can be accessed normally.

aaP_zwj1021

aaPanel_Kern Oh yes, the panel can be accessed no problem if I use the IP, but not the domain.

aaPanel_Kern

This indicates that there is a problem with the connection between CloudFlare and aapanel. Try adjusting the SSL/TLS configuration.

aaP_zwj1021

aaPanel_Kern

Hello, we tested Full (Strict)
Regardless of whether it is a website or aapanel, as long as the self-signed certificate of the Origin Server under SSL/TLS is used, a CF 526 error will occur.
Normal after adjusting to Full

aaP_zwj1021

aaPanel_Kern But Full isn't really secure. Also, my apache has no log! Where is the apache log file??

aaP_zwj1021

aaPanel_Kern I did a manual install of the server without AApanel and the Origin Server works with Full Strict no issue at all, so is this something caused by aapanel?

aaPanel_Kern

As long as SSL is configured, it is safe. How did you set it up without aapanel?
apache error log/www/wwwlogs/error_log

aaP_zwj1021

aaPanel_Kern In my error log I see the following for a few times then php 8.3 dies and I have to manually restart php. Is this an attack of some sort or is this a normal part of aapanel?

[core:error] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh)
[core:error] AH10244: invalid URI path (/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh)
[core:error] AH10244: invalid URI path (/../../../../../mnt/mtd/Config/Account1)

aaPanel_Kern

Hello, the log shows that the path is invalid and will not be forwarded to php. It is recommended that you check whether you are being attacked? Or is it caused by too many users?
Also check whether the system forced php to close.
dmesg|grep -iE "kill|nginx|mysql|oom"

aaP_zwj1021

aaPanel_Kern I'm using apache, is this command still good or is there a different command for apache?

aaPanel_Kern

is command still good

aaP_zwj1021

aaPanel_Kern Nothing happened after I entered this into SSH though