Client Website Down Due to SSL Error – Limited Access, Need Advice

trellis
1

One of my client’s websites is currently down due to an SSL error. I believe it’s the same issue reported here: Let’s Encrypt Certificate Renewal Fails in Trellis with KeyError: 'contact'

Unfortunately, I’m on holiday and don’t have my laptop with me. It’s at home, not at the office, and I’m the only developer in my agency.

I’m trying to figure out the best course of action given the situation. These are the options I’m currently considering:

  1. Cut the holiday short, get an early flight, and return home.
  2. Ask a colleague to go to my house to collect my laptop, and then guide them remotely through what needs to be done.
  3. Look into whether there’s any way to troubleshoot or renew the certificate without access to my usual development environment (Vagrant, Trellis, SSH setup).
  4. ??? (Open to any other suggestions)

So here’s the million-dollar question: is there any way to resolve this remotely, using just a phone or a borrowed computer, without having access to my fully configured laptop?

I know this might sound like a strange or even stupid scenario, but unfortunately, this is the reality I’m in.

Any advice, workarounds, or creative ideas would be hugely appreciated. :folded_hands:

2

You will need root access to the machine to edit the renewal script and reload the Nginx service

3

Trying to think of another option… if you have access to make DNS changes you could potentially throw Cloudflare in front the site w/ SSL/TLS mode to “Full” in proxied mode?

If you’re limited to your phone and you can somehow reset the root password to the server, then you can SSH into the server (there’s some mobile apps for SSH) and…

  1. cd /var/lib/letsencrypt/
  2. Edit renew-certs.py to remove line 35 that starts with '--contact (Remove Let's Encrypt contact email support by swalkinshaw · Pull Request #1558 · roots/trellis · GitHub)
  3. Save the file and service nginx reload

DigitalOcean supports both resetting the root password as well as the ability to load a remote console

4

Thank you so much, I will try the second option

5

Maybe a silly question, but if I go ahead with the steps you suggested (changing the root password and fixing the issue), will everything still work the same once I’m back home?

I usually connect via SSH using my key (the droplet is hosted on DigitalOcean), so I assume that will still function as normal?

Just want to double-check if there’s anything else I should keep in mind; there’s a big announcement planned for the website on my first day back, and we’re expecting a lot of traffic. I’ve told my boss that, worst case, the site will be live again by the time I return, so I won’t have much time to deal with any unexpected issues then.

6

Doing this directly through SSH will work until the server is re-provisioned without making that change in your Trellis setup.

When you get back to a machine, you will want to update your Trellis install so that any further re-provisions don’t overwrite your change.

7

Thanks, that all makes sense.

My main doubt is about changing the root password on the DigitalOcean droplet (never done this before); will I still be able to connect, re-provision, and deploy as usual using trellis-cli, or will I need to update any Trellis settings or take additional steps?

I will own you a beer if I will be able to fix this from my phone remotely :raising_hands: