title: Setting up https on Google Compute Engine running WordPress
body: <p>I have set up WordPress on GCE using the marketplace:</p>
  <p><a href="https://cloud.google.com/wordpress/" rel="nofollow noreferrer">https://cloud.google.com/wordpress/</a></p>
  <p>I have set up the domain name to worldbreakersgame.com and reserved a static IP. I then followed the instructions here to set up https:</p>
  <p><a href="https://onepagezen.com/free-ssl-certificate-wordpress-google-cloud-click-to-deploy/" rel="nofollow noreferrer">https://onepagezen.com/free-ssl-certificate-wordpress-google-cloud-click-to-deploy/</a></p>
  <p>One part of the tutorial that did not work, <code>/etc/apache2/sites-available/wordpress.conf</code> did not exist. I edited <code>/etc/apache2/sites-available/wordpress-http.conf</code> instead.</p>
  <p>However, when going to <a href="https://www.worldbreakersgame.com" rel="nofollow noreferrer">https://www.worldbreakersgame.com</a>, I still get the error message that &quot;Your connection is not private&quot;. I think that there is an issue with the certificate I issued through Let's Encrypt/certbot, but I am not sure.</p>
  <p>I tried restarting the apache server again but it does not seem to help.</p>
  <p>Here are the relevant WordPress settings:</p>
  <p><a href="https://i.stack.imgur.com/wYAaD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/wYAaD.png" alt="WordPress Settings" /></a></p>
  <p>And some snippets from the terminal:</p>
  <pre><code>el_ad_david_amir@wordpress-1-vm:~$ lsb_release -a
  No LSB modules are available.
  Distributor ID: Debian
  Description:    Debian GNU/Linux 10 (buster)
  Release:        10
  Codename:       buster
  </code></pre>
  <pre><code>el_ad_david_amir@wordpress-1-vm:~$ sudo ls /etc/letsencrypt/live/worldbreakersgame.com/
  README  cert.pem  chain.pem  fullchain.pem  privkey.pem
  </code></pre>
  <pre><code>el_ad_david_amir@wordpress-1-vm:~$ sudo cat /etc/apache2/sites-available/wordpress-https.conf 
  &lt;VirtualHost *:443&gt;
    ServerAdmin admin@example.com
    DocumentRoot /var/www/html
    SSLEngine on
    SSLCertificateFile &quot;/etc/letsencrypt/live/worldbreakersgame.com/cert.pem&quot;
    SSLCertificateKeyFile &quot;/etc/letsencrypt/live/worldbreakersgame.com/privkey.pem&quot;
    SSLCertificateChainFile &quot;/etc/letsencrypt/live/worldbreakersgame.com/chain.pem&quot;
  
    &lt;Directory /var/www/html&gt;
      Options -Indexes
      AllowOverride FileInfo
    &lt;/Directory&gt;
  &lt;/VirtualHost&gt;
  </code></pre>
  <pre><code>el_ad_david_amir@wordpress-1-vm:~$ sudo cat /etc/apache2/sites-available/wordpress-http.conf 
  &lt;VirtualHost *:80&gt;
  ServerAdmin webmaster@localhost
  DocumentRoot /var/www/html
  
  ServerName www.worldbreakersgame.com
  ServerAlias worldbreakersgame.com
  Redirect permanent / https://www.worldbreakersgame.com/
  
  &lt;Directory /&gt;
  Options FollowSymLinks
  AllowOverride None
  &lt;/Directory&gt;
  &lt;Directory /var/www/html/&gt;
  Options Indexes FollowSymLinks MultiViews
  AllowOverride All
  Order allow,deny
  allow from all
  &lt;/Directory&gt;
  ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
  &lt;Directory &quot;/usr/lib/cgi-bin&quot;&gt;
  AllowOverride None
  Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
  Order allow,deny
  Allow from all
  &lt;/Directory&gt;
  ErrorLog ${APACHE_LOG_DIR}/error.log
  # Possible values include: debug, info, notice, warn, error, crit,
  # alert, emerg.
  LogLevel warn
  CustomLog ${APACHE_LOG_DIR}/access.log combined
  &lt;/VirtualHost&gt;
  </code></pre>
  <p>Finally, here is <code>/etc/apache2/sites-available/default-ssl.conf</code>:</p>
  <pre><code>&lt;IfModule mod_ssl.c&gt;
          &lt;VirtualHost _default_:443&gt;
                  ServerAdmin webmaster@localhost
  
                  &lt;Directory /var/www/html/&gt;
                  Options Indexes FollowSymLinks MultiViews
                  AllowOverride All
                  Order allow,deny
                  allow from all
                  &lt;/Directory&gt;
  
                  DocumentRoot /var/www/html
  
                  # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
                  # error, crit, alert, emerg.
                  # It is also possible to configure the loglevel for particular
                  # modules, e.g.
                  #LogLevel info ssl:warn
  
                  ErrorLog ${APACHE_LOG_DIR}/error.log
                  CustomLog ${APACHE_LOG_DIR}/access.log combined
  
                  # For most configuration files from conf-available/, which are
                  # enabled or disabled at a global level, it is possible to
                  # include a line for only one particular virtual host. For example the
                  # following line enables the CGI configuration for this host only
                  # after it has been globally disabled with &quot;a2disconf&quot;.
                  #Include conf-available/serve-cgi-bin.conf
  
                  #   SSL Engine Switch:
                  #   Enable/Disable SSL for this virtual host.
                  SSLEngine on
  
                  #   A self-signed (snakeoil) certificate can be created by installing
                  #   the ssl-cert package. See
                  #   /usr/share/doc/apache2/README.Debian.gz for more info.
                  #   If both key and certificate are stored in the same file, only the
                  #   SSLCertificateFile directive is needed.
                  #SSLCertificateFile     /etc/ssl/certs/ssl-cert-snakeoil.pem
                  #SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
                  SSLCertificateFile &quot;/etc/letsencrypt/live/worldbreakersgame.com/cert.pem&quot;
                  SSLCertificateKeyFile &quot;/etc/letsencrypt/live/worldbreakersgame.com/privkey.pem&quot;
                  SSLCertificateChainFile &quot;/etc/letsencrypt/live/worldbreakersgame.com/chain.pem&quot;
  
                  #   Server Certificate Chain:
                  #   Point SSLCertificateChainFile at a file containing the
                  #   concatenation of PEM encoded CA certificates which form the
                  #   certificate chain for the server certificate. Alternatively
                  #   the referenced file can be the same as SSLCertificateFile
                  #   when the CA certificates are directly appended to the server
                  #   certificate for convinience.
                  #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
  
                  #   Certificate Authority (CA):
                  #   Set the CA certificate verification path where to find CA
                  #   certificates for client authentication or alternatively one
                  #   huge file containing all of them (file must be PEM encoded)
                  #   Note: Inside SSLCACertificatePath you need hash symlinks
                  #                to point to the certificate files. Use the provided
                  #                Makefile to update the hash symlinks after changes.
                  #SSLCACertificatePath /etc/ssl/certs/
                  #SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
  
                  #   Certificate Revocation Lists (CRL):
                  #   Set the CA revocation path where to find CA CRLs for client
                  #   authentication or alternatively one huge file containing all
                  #   of them (file must be PEM encoded)
                  #   Note: Inside SSLCARevocationPath you need hash symlinks
                  #                to point to the certificate files. Use the provided
                  #                Makefile to update the hash symlinks after changes.
                  #SSLCARevocationPath /etc/apache2/ssl.crl/
                  #SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
  
                  #   Client Authentication (Type):
                  #   Client certificate verification type and depth.  Types are
                  #   none, optional, require and optional_no_ca.  Depth is a
                  #   number which specifies how deeply to verify the certificate
                  #   issuer chain before deciding the certificate is not valid.
                  #SSLVerifyClient require
                  #SSLVerifyDepth  10
  
                  #   SSL Engine Options:
                  #   Set various options for the SSL engine.
                  #   o FakeBasicAuth:
                  #        Translate the client X.509 into a Basic Authorisation.  This means that
                  #        the standard Auth/DBMAuth methods can be used for access control.  The
                  #        user name is the `one line' version of the client's X.509 certificate.
                  #        Note that no password is obtained from the user. Every entry in the user
                  #        file needs this password: `xxj31ZMTZzkVA'.
                  #   o ExportCertData:
                  #        This exports two additional environment variables: SSL_CLIENT_CERT and
                  #        SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
                  #        server (always existing) and the client (only existing when client
                  #        authentication is used). This can be used to import the certificates
                  #        into CGI scripts.
                  #   o StdEnvVars:
                  #        This exports the standard SSL/TLS related `SSL_*' environment variables.
                  #        Per default this exportation is switched off for performance reasons,
                  #        because the extraction step is an expensive operation and is usually
                  #        useless for serving static content. So one usually enables the
                  #        exportation for CGI and SSI requests only.
                  #   o OptRenegotiate:
                  #        This enables optimized SSL connection renegotiation handling when SSL
                  #        directives are used in per-directory context.
                  #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
                  &lt;FilesMatch &quot;\.(cgi|shtml|phtml|php)$&quot;&gt;
                                  SSLOptions +StdEnvVars
                  &lt;/FilesMatch&gt;
                  &lt;Directory /usr/lib/cgi-bin&gt;
                                  SSLOptions +StdEnvVars
                  &lt;/Directory&gt;
  
                  #   SSL Protocol Adjustments:
                  #   The safe and default but still SSL/TLS standard compliant shutdown
                  #   approach is that mod_ssl sends the close notify alert but doesn't wait for
                  #   the close notify alert from client. When you need a different shutdown
                  #   approach you can use one of the following variables:
                  #   o ssl-unclean-shutdown:
                  #        This forces an unclean shutdown when the connection is closed, i.e. no
                  #        SSL close notify alert is send or allowed to received.  This violates
                  #        the SSL/TLS standard but is needed for some brain-dead browsers. Use
                  #        this when you receive I/O errors because of the standard approach where
                  #        mod_ssl sends the close notify alert.
                  #   o ssl-accurate-shutdown:
                  #        This forces an accurate shutdown when the connection is closed, i.e. a
                  #        SSL close notify alert is send and mod_ssl waits for the close notify
                  #        alert of the client. This is 100% SSL/TLS standard compliant, but in
                  #        practice often causes hanging connections with brain-dead browsers. Use
                  #        this only for browsers where you know that their SSL implementation
                  #        works correctly.
                  #   Notice: Most problems of broken clients are also related to the HTTP
                  #   keep-alive facility, so you usually additionally want to disable
                  #   keep-alive for those clients, too. Use variable &quot;nokeepalive&quot; for this.
                  #   Similarly, one has to force some clients to use HTTP/1.0 to workaround
                  #   their broken HTTP/1.1 implementation. Use variables &quot;downgrade-1.0&quot; and
                  #   &quot;force-response-1.0&quot; for this.
                  # BrowserMatch &quot;MSIE [2-6]&quot; \
                  #               nokeepalive ssl-unclean-shutdown \
                  #               downgrade-1.0 force-response-1.0
  
          &lt;/VirtualHost&gt;
  &lt;/IfModule&gt;
  
  # vim: syntax=apache ts=4 sw=4 sts=4 sr noet
  </code></pre>