transfersite timeout/wsdl error

Bug reports
1

trying to transfer between two servers using transfersite.

From one of my servers (sourcehost.redacted.tld) i can transfer fine to one server (okayhost.redacted.tld). However i have another server where the transfer fails on account creation. It shows a timeout error message. As per another thread mentioning a similar timeout isuse, i have tried to manually approve the cert chain with no success. (cpcmd ssl:trust-endpoint)

apnscp_php bin/scripts/transfersite.php -s targethost.redaced.tld exampledomain.tld
beginning migration: exampledomain.tld (stage 0)
creating site on targethost.redaced.tld
WARNING: SoapClient::__construct(): SSL operation failed with code 1. OpenSSL Error messages:
error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed 
[/usr/local/apnscp/lib/Util/API.php:71]
         0. SoapClient->__construct("https://targethost.redaced.tld:2083/apnscp.wsdl", [connection_timeout:30, location:"https://targethost.redaced.tld:2083/soap?authkey=redacted", uri:"urn:net.apnscp.api", trace:false, stream_context:stream-context])
            [/usr/local/apnscp/lib/Util/API.php:71]
         1. Util_API::create_client("redacted", "targethost.redaced.tld:2083")
            [/usr/local/apnscp/lib/CLI/Transfer.php:545]
         2. CLI_Transfer->_api_key_valid()
            [/usr/local/apnscp/lib/CLI/Transfer.php:515]
         3. CLI_Transfer->_create_api_client()
            [/usr/local/apnscp/lib/CLI/Transfer.php:147]
         4. CLI_Transfer->process()
            [/usr/local/apnscp/bin/scripts/transfersite.php:233]
ERROR  : unknown(): migration failed - unhandled exception
         0. Error_Reporter::add_error("migration failed - unhandled exception", )
            [/usr/local/apnscp/lib/log_wrapper.php:72]
         1. error("migration failed - unhandled exception")
            [/usr/local/apnscp/bin/scripts/transfersite.php:247]
unknown(): migration failed - unhandled exception

the interesting thing is, that the site appears in nexus on the destination server, but nothing happens beyond the creation. (For retries, i have to manually remove the site from nexus on the destination server).

2

In additon to
cpcmd ssl:trust-endpoint ....

i have checked:
curl -k https://<IP>:2083/apnscp.wsdl
and i am getting valid xml back.

References:

3

via https://stackoverflow.com/questions/68062111/error1416f086ssl-routinestls-process-server-certificatecertificate-verify-fa

It turned out that I had an incomplete certificate in my Apache configuration. I only had the certificate itself, not also its intermediate.

Ensure target is on latest release (#e10fcbc1), run cpcmd letsencrypt:renew, then wait for panel to restart.

Ref: LE Certificate Chain Issues

4

negative. Looks like that there is a cert chain reference is missing from the new code as well.

# cpcmd scope:get cp.update-policy
edge-major

# cpcmd misc_cp_version
revision: e10fcbc17eedca9d8e3f2da549e19cc7b781e8e2
timestamp: 1783621327
ver_maj: 3
ver_min: 2
ver_patch: 48
ver_pre: 72-ge10fcbc17
dirty: false
debug: false

# cpcmd letsencrypt:renew
WARNING: Module\Support\Letsencrypt::getSanFromCertificate(): Rejecting certificate. Authority fingerprint `1F:2F:35:BE:46:14:82:CD:40:B1:AE:79:2C:55:78:FA:F7:D4:68:FB' does not match acceptable values
WARNING: Letsencrypt_Module::renew(): Certificate is not Let's Encrypt
----------------------------------------
MESSAGE SUMMARY
Reporter level: WARNING
WARNING: Module\Support\Letsencrypt::getSanFromCertificate(): Rejecting certificate. Authority fingerprint `1F:2F:35:BE:46:14:82:CD:40:B1:AE:79:2C:55:78:FA:F7:D4:68:FB' does not match acceptable values
WARNING: Letsencrypt_Module::renew(): Certificate is not Let's Encrypt
----------------------------------------
1

references:

5

Run upcp on target server, then cpcmd letsencrypt:renew again. Changed bootstrap code for server certificate that uses the same code pathway as letsencrypt:renew.