Apache HTTPD偶尔会提供旧的/过期的证书

我有三个主机在同一台服务器上（单个IP）：

domain1.com
domain2.com
domain3.com

他们每个人都应该使用最近在2017年4月发布的Let's Encrypt证书。

但是，偶尔服务器似乎会提供旧的（过期的）证书。在domain1.com情况下，一个实际上仍然有效的StartSSL证书（07.2016 – 07 – 2017）被提供，而另外两个主机服务期满。让我们从2017年1月开始encryption证书。

下面是这些主机是如何基本上设置（当然有不同的主机名）为certbot：

 <VirtualHost *:443> ServerName domain1.com ServerAlias www.domain1.com SSLEngine on SSLProtocol all -SSLv2 -SSLv3 SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA SSLHonorCipherOrder on SSLCompression off SSLOptions +StrictRequire SSLCertificateFile /etc/letsencrypt/live/domain1.com/fullchain.pem SSLCertificateKeyFile /etc/letsencrypt/live/domain1.com/privkey.pem DocumentRoot /opt/lucee/tomcat/webapps/domain1.com/ <IfModule mod_headers.c> RequestHeader set HTTPS "1" </IfModule> <IfModule mod_proxy.c> ProxyPassMatch ^/(.*)$ http://127.0.0.1:8500/$1 </IfModule> CustomLog ${APACHE_LOG_DIR}/access_kwaschny.log custom_access </VirtualHost>

fullchain.pem和privkey.pem是符号链接，并指向每个主机的archive文件夹中的最新文件（最高索引）。我解决了这个链接，看起来很好。

apache2ctl -S

 VirtualHost configuration: *:80 is a NameVirtualHost default server localhost (/etc/apache2/sites-enabled/000-default.conf:1) port 80 namevhost localhost (/etc/apache2/sites-enabled/000-default.conf:1) port 80 namevhost domain1.com (/etc/apache2/sites-enabled/000-default.conf:8) alias www.domain1.com port 80 namevhost mmosvc.com (/etc/apache2/sites-enabled/000-default.conf:17) alias www.mmosvc.com port 80 namevhost domain3.com (/etc/apache2/sites-enabled/000-default.conf:26) alias www.domain3.com port 80 namevhost www.domain2.com (/etc/apache2/sites-enabled/000-default.conf:35) alias domain2.com port 80 namevhost forum.domain2.com (/etc/apache2/sites-enabled/000-default.conf:44) port 80 namevhost downloads.domain2.com (/etc/apache2/sites-enabled/000-default.conf:69) port 80 namevhost images.domain2.com (/etc/apache2/sites-enabled/000-default.conf:82) *:443 is a NameVirtualHost default server domain1.com (/etc/apache2/sites-enabled/001-domain1.com.conf:3) port 443 namevhost domain1.com (/etc/apache2/sites-enabled/001-domain1.com.conf:3) alias www.domain1.com port 443 namevhost www.domain2.com (/etc/apache2/sites-enabled/002-www.domain2.com.conf:3) alias domain2.com port 443 namevhost domain3.com (/etc/apache2/sites-enabled/003-domain3.com.conf:3) alias www.domain3.com ServerRoot: "/etc/apache2" Main DocumentRoot: "/var/www/html" Main ErrorLog: "/var/log/apache2/error.log" Mutex default: dir="/var/lock/apache2" mechanism=fcntl Mutex mpm-accept: using_defaults Mutex watchdog-callback: using_defaults Mutex rewrite-map: using_defaults Mutex ssl-stapling-refresh: using_defaults Mutex ssl-stapling: using_defaults Mutex proxy: using_defaults Mutex ssl-cache: using_defaults PidFile: "/var/run/apache2/apache2.pid" Define: DUMP_VHOSTS Define: DUMP_RUN_CFG User: name="www-data" id=33 Group: name="www-data" id=33

certbot证书

 ------------------------------------------------------------------------------- Found the following certs: Certificate Name: www.domain2.com Domains: www.domain2.com Expiry Date: 2017-07-02 23:03:00+00:00 (VALID: 75 days) Certificate Path: /etc/letsencrypt/live/www.domain2.com/fullchain.pe m Private Key Path: /etc/letsencrypt/live/www.domain2.com/privkey.pem Certificate Name: domain3.com Domains: domain3.com Expiry Date: 2017-07-02 23:01:00+00:00 (VALID: 75 days) Certificate Path: /etc/letsencrypt/live/domain3.com/fullchain.pem Private Key Path: /etc/letsencrypt/live/domain3.com/privkey.pem Certificate Name: domain1.com Domains: domain1.com Expiry Date: 2017-07-02 23:03:00+00:00 (VALID: 75 days) Certificate Path: /etc/letsencrypt/live/domain1.com/fullchain.pem Private Key Path: /etc/letsencrypt/live/domain1.com/privkey.pem -------------------------------------------------------------------------------

这里可能是什么问题？我一直认为服务器由于SNI而返回多个证书，但为什么Apache HTTPD混合了不同的证书？这些甚至从哪里来？（是的，我重新启动并重新加载Apache几次。）

我find了原因。我有多个Apache运行的实例。重新启动/重新加载通过terminal只重新启动其中的一些。这就解释了为什么有时旧的证书，有时候是新的证书。我必须杀死所有的stream程才能拿起新的证书，现在又重新开始了。