Make It Tea - public:radio:topics:yaddnet

YaDDNet

anonymous@undisclosed.example.com (Anonymous) — Thu, 04 Jun 2026 20:27:36 +0000

←Radio Topics

YaDDNet

I no longer have anything to do with the running of YaDDNet, the online web-database for Marine DSC Loggings.

This is a collection of information from my time as the creator of YaDDNet.

— John Pumford-Green 26/04/23 13:41

Further Information

http://www.yaddnet.org

YaDDNet Data Backup

anonymous@undisclosed.example.com (Anonymous) — Thu, 04 Jun 2026 06:39:56 +0000

←YaDDNet

YaDDNet Data Backup

Offsite Text file backups of all DSC messages

Alan Spindel initially suggested an offsite backup of the DSC messages in 2019
YaDDNet has had the facility to send copies of each new message out to specified IP addresses via UDP since that time
The DSC messages are sent by UDP as simple plain text, for easy archiving
The archived text file can be used if necessary to rebuild the SQL database table containing the DSC messages in case of disaster
Since I'm now hosting YaDDNet again I decided I should run a UDP log receiver at home to improve the backup provision
The daily archive files will be gzipped and stored on Dropbox
- I could share the link to anyone who is interested in using the saved data

YaDDNet UDP Send to Mirror

In the PyYadd.py function a DSC message is created from the raw incoming data from YaDD (and DSC Decoder) in a standard format.
This involves converting MMSI → Coast or Ship name, finding the [MID] and corresponding country etc.
Prior to using the newly created message to inject new data into the SQL server PyYadd.py calls the function send_to_mirror() to send out the UDP packet to any configured IP addresses
PyYadd.py then inserts the new data in the SQL server
Any addressed & listening UDP clients receive the UDP packets and append them to a log file

def send_to_mirror(data):
    log_data = "[log];"+data
    port = 2505
    host = "aaa.bbb.ccc.ddd.eee"
    host2 = "fff.ggg.hhh.iii"
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.sendto(log_data, (host, port))
    sock.sendto(log_data, (host2, port))
 
    return

Backup UDP receive and logrotate

UDP Listener

#!/usr/bin/env python
#
# udp_logger.py
#
 
import SocketServer
import socket
import threading
 
class ThreadedUDPRequestHandler(SocketServer.BaseRequestHandler):
 
    def handle(self):
        data = self.request[0].strip()
        socket = self.request[1]
        self.write_file(data)
 
    def write_file(self,text):
        filename = '/home/gm4slv/yaddlogs/yaddnet_udp_log.txt'
        f = open(filename, 'a+')
        log = text
        f.write(log+"\n")
        f.close()
        return
 
class ThreadedUDPServer(SocketServer.ThreadingMixIn, SocketServer.UDPServer):
    pass
 
if __name__ == "__main__":
    HOST, PORT = "", 2505
    server = ThreadedUDPServer((HOST, PORT), ThreadedUDPRequestHandler)
    ip, port = server.server_address
    server.serve_forever()
    # Start a thread with the server -- 
    # that thread will then start one
    # more thread for each request
    server_thread = threading.Thread(target=server.serve_forever)
    # Exit the server thread when the main thread terminates
    server_thread.daemon = True
    server_thread.start()
    server.shutdown()

The UDP Log Receiver listens to UDP/2505 for incoming packets from YaDDNet. These are of the form:

[log];2024-04-19 08:43:06;NLD_MB_HF1;2187.5;SEL;002050480;COAST;205;Belgium;Ostende Radio;SAF;636092799;SHIP;636;Liberia;CISNES, D5HF4, Cargo;TEST;NOINF;--;--;REQ;OK
[log];2024-04-19 08:43:28;BDXC-Han-Remote;12577.0;SEL;002241022;COAST;224;Spain;Coruna Radio;SAF;538005991;SHIP;538;Marshall Islands;NAVIG8 VIOLETTE, V7IH3, Tanker;TEST;NOINF;--;--;REQ;OK

each new packet is appended to the running log file /home/gm4slv/yaddlogs/yaddnet_udp_log.txt
the file will grow indefinitely if left to itself!

Logrotate

run by Crontab every day at midnight
copies the current running log to a timestamped file
erases the contents of the running log file
gzips the timestamped copy and moves it to Dropbox

## CRONTAB ENTRY
 
00 00 * * * /home/gm4slv/bin/yaddlog_rotate.sh /dev/null 2>&1

#!/bin/bash
#
# yaddlog_rotate.sh
 
DROPBOX=/home/gm4slv/Dropbox/Yaddlogs/
DIR=/home/gm4slv/yaddlogs
 
INFILE=yaddnet_udp_log.txt
 
TIMESTAMP=`date +%Y%m%d_%H%M`
 
OUTFILE=$TIMESTAMP\_$INFILE
 
cp $DIR/$INFILE $DIR/$OUTFILE
cat /dev/null > $DIR/$INFILE
 
 
gzip $DIR/$OUTFILE
 
mv $DIR/$OUTFILE.gz $DROPBOX

This creates a gzipped log file in my Dropbox of each day's new DSC messages

Starting the UDP Listener at boot-up

crontab entry to start it as a background job at @reboot

#
# CRONTAB ENTRY
#
@reboot python /home/gm4slv/bin/udp_logger.py &

— John Pumford-Green 19/04/24 09:31 BST

Last updated : 04/06/26 07:39 BST

Further Information

YaDDNet

radio, yaddnet

Yaddnet Migration

anonymous@undisclosed.example.com (Anonymous) — Thu, 04 Jun 2026 06:39:56 +0000

←YaDDNet

Yaddnet Migration

My http://www.yaddnet.org DSC database originally ran on various machines in my shack at home. It was migrated to a server donated for the purpose - located in Las Vegas, in 2019. This document records the steps needed to transfer everything and get it running on the new Virtual Private Server. In case it ever needs doing again in future this will help jog my memory of what's involved.

Moving YaddNet to a Virtual Server in the Clouds

Created Thursday 24 October 2019

Server IP: 64.235.39.127

Create SQL database

UPDATE 13/04/24

MIGRATING TO A NEW UBUNTU 20.4 VPS REQUIRED THE FOLLOWING

https://ostechnix.com/how-to-reset-root-password-in-mysql-8-on-ubuntu-linux/

The original Process

1) sort out passwordless root access to MySQL

add skip-grant-tables to end of config file:

(such as….)

/etc/mysql/mysql.conf.d/mysqld.cnf

restart mysqld

$ mysql -u root
mysql>FLUSH PRIVILEGES;
mysql>ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY '';
mysql>quit;

remove skip-grant-tables from /etc/mysql/mysql.conf.d/mysqld.cnf

restart mysqld

2) create blank/empty yadd database

$ mysql -u root

mysql> create database yadd;
mysql> quit;

2a) scp migrate tarfile to remote server

and wait….

2b) untar migrate tarfile

3) use saved schema file to create the tables:

$ mysql -u root yadd < schema.sql

4) import the full database backup:

$ mysql -u root yadd < yadd_xxxxx.sql

and wait……. and wait……

5) test all the data is there…!

Create Web site

6) extract yaddnet files from tarball

7) extract html files into /var/www/

8) permissions/ownership of /var/www/html ? Not Needed

9) apache “sites-enabled” - change virtual server's port? Not needed

Configure auto-start of Input servers

10) /etc/rc.local command to start tmux session

sleep 60; su USER -c /home/USER/yaddnet/tmux_yadd.sh &

11) start tmux session and see if it's working…

12) fire some test packets at it from uCoastTester.py

13) crontab entries

15 */4 * * * /home/USER/yaddnet/purge_err.sh > /dev/null 
* * * * * /home/USER/yaddnet/purge_tmp.sh > /dev/null

Tweaks

14) Character encoding for pages

edit /etc/php/7.2/apache2/php.ini

change default_charset from UTF-8 to ISO-8859-1:

default_charset = "ISO-8859-1"

This renders “degree” signs etc. on web pages correctly.

15) mysql config

add to /etc/mysql/mysql.conf.d/mysqld.conf

sql_mode = "STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION"

restart mysql

This (among other things) allows the group-by queries to work.

16) Open firewalld UDP port 4530 for DSCDecoder (and close unneeded port 9999)

firewall-cmd --permanent --service=yadd --add-port=4530/udp

firewall-cmd --permanent --service=yadd --remove-port=9999/udp

firewall-cmd --complete-reload

Firewall Config - note 21/5/22

While creating this Wiki page, from a previous note in ZimWiki, I wondered about the firewall config, as it appears I didn't explicitly open UDP/50666 for YaDD's traffic, but I added udp/4530 for DSCDecoder.

Looking at /etc/firewalld/services/yadd.xml I see:

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>yadd</short>
  <description>YaDD Service</description>
  <port port="50666" protocol="udp"/>
  <port port="4530" protocol="udp"/>
</service>

so 50666 must have been added when the VPS was built (not my me). I guess I asked for it when the offer to provide the VPS was made, but forgot about DSCDecoder until later.

Get Domain Name

16) Buy domain yaddnet.org from “fasthosts.co.uk” and set DNS record to point host www.yaddnet.org to the new server IP address

£10.79 per year, auto-renew via PayPal.

UPDATE 18/11/19

Received an email from kb7ypf@yahoo.com:

“I have been using yaDD 1.7.1 monitoring and logging GMDSS signals. I have been using it for about two weeks. This morning when I started yaDD it worked great, as usual, however, when I went to the web and accessed the message logging page, I got this message: “Failed to connect to MySQL: Access denied for user 'root'@localhost' …….”

Unattended-Upgrade breaks MySQL

I confirmed the same symptoms…

but it was working this morning?!

SSH'd into the server and couldn't access mysql from the commandline, either, same error.

This reminded me of the behaviour of a “stock” mysql server before doing the steps in 1) above.

Found an entry in /var/log/apt/history.log from 06:25 PST (14:25 UTC)

Start-Date: 2019-11-18  06:25:08
Commandline: /usr/bin/unattended-upgrade
Upgrade: mysql-server-5.7:amd64 (5.7.27-0ubuntu0.18.04.1, 5.7.28-0ubuntu0.18.04.4), mysql-server-core-5.7:amd64 (5.7.27-0ubuntu0.18.04.1, 5.7.28-0ubuntu0.18.04.4)
End-Date: 2019-11-18  06:25:29

Looks like “unattended-upgrade” has upgraded mysql, and also reset the normal permissions/privileges. Bloody Hell!

stop mysql
edit mysqld.cnf to add “skip-grant-tables”
start mysql
log in to mysql “mysql -u root”

$ mysql -u root
mysql>FLUSH PRIVILEGES;
mysql>ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY '';
mysql>quit;

stop mysql
remove “skip-grant-tables” from mysqd.cnf
start mysql
test…

looks like we lost about 1 hour of DSC loggings while the SQL server refused to talk to us, from 14:25 UTC until ~15:30 UTC when I got it running normally again.

…..and relax!

going forward

Have 2 choices - remove unattended-upgrades package and lose all automatic security upgrades OR configure unattended-upgrades to blacklist mysql-server from upgrades.

https://wiki.debian.org/UnattendedUpgrades and https://help.ubuntu.com/community/AutomaticSecurityUpdates

has some helpful info… found where to blacklist individual packages….

service unattended-upgrades stop

edit /etc/apt/apt.conf.d/50unattended-upgrades to blacklist mysql

	// List of packages to not update (regexp are supported)
	Unattended-Upgrade::Package-Blacklist {
			"mysql-server";
			"mysql-server-5.7";
			"mysql-server-core-5.7";
	};

service unattended-upgrades start

check it's running:

gm4slv@lasvegas-nv-datacenter:~$ apt-config dump APT::Periodic::Unattended-Upgrade

APT::Periodic::Unattended-Upgrade "1";

hopefully that will sort it?

Page Updated: 04/06/26 07:39 BST

yaddnet, mysql, apache, linux

YaDDNet : New VPS

anonymous@undisclosed.example.com (Anonymous) — Thu, 04 Jun 2026 07:02:24 +0000

←YaDDNet

YaDDNet : New VPS

Moving YaDDNet from USA to UK

Background

YaDDNet started hosted on a machine in my shed
In 2019 I almost gave up maintaining & hosting it and was approached by Alan Spindel ex. of WLO/Mobile Radio with the offer of a free VPS in the States
I moved everything from my own PC to the new Cloud Server - as documented largely here Yaddnet Migration
It's run quietly and without too may hiccups since 2019 until now, April 13th 2024
Alan has now been asked to contribute financially for continued access to the VPS - up to $200 per month
This is way too much money!
I looked at my current VPS hosted by Fasthosts and they do a VPS with similar specs to the existing USA-based server - for £12 per month
I let Alan know I'd take on the new server and migrate YaDDNet ASAP, and began the process of obtaining server, installing software required, copying YaDDNet Python code, transferring YaDDNet HTML/PHP web pages and then the big job of taking a MYSQL dump of the YaDDNet database and copying it over, and putting it into the new SQL server.
Let the fun begin

New VPS

I bought a VPS L from Fasthosts
- 120GB HDD, 4GB RAM, 2 CPU, Ubuntu 20.4
I copied the yaddnet python code (in a tar-ball) that deals with the network feeds of Yadd and DSCDecoder and injects the resulting data into the MySQLdatabase from the existing server.
I installed the necessary software
- Python2.7
- python-is-python2
- python-dev-is-python2
- MySQL Client
- MySQL Server
- Apache2
- PHP
- Tmux
- Vim
- copied my .bashrc from the old server for colour prompt etc.

Using the previous Yaddnet Migration info Yaddnet Migration I had some guidance of any tweaks needed.
I needed extra Python2 supporting libraries
- For MySQLdb → pip install MySQL-python
- but for pip…. I need pip2… how to get it - it's no longer available from Ubuntu's apt repositories.
  - I found a script get-pip.py at github
    - https://github.com/pypa/get-pip
    - also need python-dev from apt
    - also need my_config.h from where..?
    - finally can pip install MySQL-python

curl https://bootstrap.pypa.io/pip/2.7/get-pip.py --output get-pip.py
sudo python2 get-pip.py
sudo apt-get install python-dev
sudo wget https://raw.githubusercontent.com/paulfitz/mysql-connector-c/master/include/my_config.h -O /usr/include/mysql/my_config.h
sudo pip2 install MySQL-python

at this point I could run the python server code, in a tmux session as usual, using the shell script in the python directory extracted from the tar-ball. All the supporting libraries were there.

MySQL config

My old notes had instructions of how to set MySQL for password-less root access, but I found by trial and error that these steps no longer work in Ubuntu 20.4, with systemd
I found some help online https://ostechnix.com/how-to-reset-root-password-in-mysql-8-on-ubuntu-linux/
- the basic is that it's now necessary to add options to MySQL via systemd
- for skip-grant-tables

$ sudo systemctl stop mysql
$ sudo systemctl status mysql
$ sudo systemctl edit mysql

[Service]
ExecStart=
ExecStart=/usr/sbin/mysqld --skip-grant-tables --skip-networking

$ sudo systemctl daemon-reload
$ sudo systemctl start mysql
$ sudo mysql -u root

mysql> FLUSH PRIVILEGES;
mysql> ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY '';
mysql> exit

$ sudo systemctl revert mysql
$ sudo systemctl daemon-reload
$ sudo systemctl restart mysql

Make database for yadd

$mysql -u root

mysql> create database yadd;
mysql> quit;

Get the data

on the old server

$ mysqldump -u root yadd > yadd_backup.sql

and wait…. and wait…..
eventually there's a 6.2GB sql file containing all the existing data
bzip2 the file to make it smaller (it's about 400MB now) for scp transfer to the new server
send it across:
- scp yaddnet_backup.sql.bz2 gm4slv@109.228.53.165:

on the new server
- bunzip2 yaddnet_backup.sql.bz2
- and wait….and wait
then inject it into the new yadd database

mysql -u root yadd < yaddnet_backup.sql

and wait…. and wait…. and wait
eventually the command returns and the database is restored on the new machine

Web pages

extract the backed-up webpages from the old server and copy them to /var/www/html
To be able to retrieve SQL data via PHP I needed to install more

sudo apt-get install php-mysql

Almost there….
New MYSQL user with a password for PHP data retrieval
- Alan Spindel informed me that there was an update some time ago and it was necessary to create a new MySQL user, with a password, and to modify the PHP files to use it in the PHP → MySQL transactions

CREATE USER 'XXXXX'@'localhost' IDENTIFIED WITH mysql_native_password BY 'YYYYY';
GRANT ALL PRIVILEGES ON *.* TO 'XXXXX'@'localhost' WITH GRANT OPTION;

XXXXX is the username as set in all the PHP files and YYYYY is the password for the user
to perform some of the SQL queries (group-by) - need to alter sql-mode but again the old method using *.cnf files no longer works

# MySQL systemd service file

[Unit]
Description=MySQL Community Server
After=network.target

[Install]
WantedBy=multi-user.target

[Service]
Type=notify
User=mysql
Group=mysql
PIDFile=/run/mysqld/mysqld.pid
PermissionsStartOnly=true
ExecStartPre=/usr/share/mysql/mysql-systemd-start pre
ExecStart=/usr/sbin/mysqld  --sql-mode=STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION
TimeoutSec=infinity
Restart=on-failure
RuntimeDirectory=mysqld
RuntimeDirectoryMode=755
LimitNOFILE=10000

# Set enviroment variable MYSQLD_PARENT_PID. This is required for restart.
Environment=MYSQLD_PARENT_PID=1
~
~

Then

systemctl daemon-reload
systemctl restart mysql

start the Python code to listen for new data

./new_tmux.sh

open firewall for UDP/50666 and UDP/4530
set up my own Yadd receiver pointing at 109.228.53.165 port 50666 and let it send new data….
it's arriving!
Alter DNS for the domain at Fasthosts to point yaddnet.org and www.yaddnet.org → 109.228.53.165
Wait for new data from other YaDD receivers to start arriving as the DNS change propagates….
it's arriving
make /var/www/html/pages/php/test/tmp world read/writable to allow new text files to be written there (eg REU searches etc.)

Clean up

that's everything working correctly
crontab entries to maintain everything

@reboot sleep 60; sudo -u gm4slv /home/gm4slv/yaddnet/tmux_yadd.sh >/dev/null 2>&1
 
 
15 */4 * * * /home/gm4slv/yaddnet/purge_err.sh > /dev/null
* * * * * /home/gm4slv/yaddnet/purge_tmp.sh > /dev/null

get SSL certificates from Fasthost and convert Apache2 to HTTPS, per previous posts
- ssl_install_vps
- vps_tips_tricks
add a PayPal Donate button

install mercurial on new server and make new code repositories

hg init
hg add
hg com -m "first commit, new server"

yaddnet_repo containing the python and various bash scripts for handling incoming data and SQL injection
yaddnet_web_repo containing the html and php web pages

Extra

config directory needs access control via .htaccess and .htpasswd
- first apache2 needs config tweaking

<Directory /path/to/website/database_tweaks/config>
        Options Indexes FollowSymLinks
        AllowOverride All
        Require all granted
</Directory>

.htaccess file in config directory

AuthType Basic
AuthName "Password Protected Area"
AuthUserFile  /path/to/website/database_tweaks/config/.htpasswd
Require valid-user

create a .htpasswd file for the user who can have access to config
restart apache2
to prevent directory file-listing (where there's no index.html file) remove Indexes from apache2.conf

<Directory /var/www/>
        Options  FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

to allow the test directory itself to be listed (I can't be bothered to maintain an index for these scraps of php)

<Directory /var/www/html/pages/php/test/>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
</Directory>

restart apache2

— John Pumford-Green 14/04/24 18:11 BST

Further Information

yaddnet, radio

YaDDNet : Running Costs

anonymous@undisclosed.example.com (Anonymous) — Thu, 04 Jun 2026 18:14:12 +0000

←YaDDNet

YaDDNet : Running Costs

Expected Costs

Costs for 2024

April 2024 → December 31^st 2024

Initial offer price for VPS L = £1.20 per month for first 3 months
- April 2024 : £1.20
- May 2024 : £1.20
- June 2024 : £1.20
VPS L then £12.00 from July 2024 onwards
- 6 months at £12.00 = £72
yaddnet.org domain : annual renewal (due 27/09/24) : £19.19
- Paid 27/09/24
SSL certificate 1 year : £42
- Paid 14/04/24
- renewal due : April 2025

Total Paid for 2024 = £136.79

Costs for 2025

January 1^st 2025 → December 31^st 2025

VPS L price increase 1st April 2025 → £13.44 per month
- Jan, Feb, Mar (@£12 per month) = £36
- April → Dec (@£13.44 per month) = £120.96.
- Total VPS rental for 2025 = £156.96
SSL Certificate renewal due April 2025, estimated cost £42
- renewal complete : March 15^th 2025
- Paid: £42
yaddnet.org domain renewal due Sept. 2025
- Paid : £20.53 27/9/25

Total estimated cost for 2025 = £219.49

Actual Costs 2025

A Negative Balance indicates my personal incurred cost

Date	Item	In Amount	Cost	Balance
01/01/25	2024 Balance Carried Forward	£8.43		£8.43
13/01/25	VPS		£12.00	-£3.57
01/02/25	Donation received	£18.86		£15.29
13/02/25	VPS		£12.00	£3.29
15/03/25	SSL Renewal		£42.00	-£38.71
18/03/25	VPS		£12.00	-£50.71
15/04/25	Donation received	£15.99		-£34.72
16/04/25	VPS		£13.44	-£48.16
23/04/25	Donation Received	£23.65		-£24.51
13/05/25	VPS		£13.44	-£37.95
13/06/25	VPS		£13.44	-£51.39
13/07/25	VPS		£13.44	-£64.83
13/08/25	VPS		£13.44	-£78.27
13/09/25	VPS		£13.44	-£91.71
15/09/25	Donation Received	£14.07		-£77.64
27/09/25	Domain Name renewal		£20.53	-£98.17
16/10/25	VPS		£13.44	-£111.61
18/11/25	VPS		£13.44	-£125.05
17/12/25	VPS		£13.44	-£138.49

Opening Balance	Donations	Costs	Balance
£8.43	£72.57	£219.39	-£138.49

Donations received

To maintain anonymity I don't want to name the donors, but listing with initials allows them to be confident that their kind support has been received.
This is a great community to be involved with, thanks for the support

Year 1 : 2024

Date	Donor	Method	Donation	Fees	Net
14/04/24	GL	Paypal	£5.00	£0.51	£4.49
14/04/24	HJH	Paypal	£10.00	£0.72	£9.28
15/04/24	MB	Paypal	£17.00	£1.01	£15.99
16/04/24	HJH	Paypal	£5.00	£0.51	£4.49
16/04/24	HH	Paypal	£10.00	£0.72	£9.28
21/04/24	CB	Paypal	£40.00	£1.98	£38.02
12/06/24	FW	Paypal	£20.00	£1.28	£18.72
16/08/24	MVV	Paypal	£18.00	£1.05	£16.95
29/11/24	KJ	Paypal	£20.00	£1.28	£18.72
23/12/24	HJH	Paypal	£10.00	£0.72	£9.28

Donations	Paypal Fees	Total Net	Costs	Carried Forward to 2025
£155.00	£9.78	£145.22	£136.79	£8.43

Year 2 : 2025

Date	Donor	Method	Donation	Fees	Net
01/02/25	MB	Paypal	£20.00	£1.14	£18.86
15/04/25	MB	Paypal	£17.00	£1.01	£15.99
24/04/25	HH	Paypal	£25.00	£1.35	£23.65
15/09/25	CDJ	Paypal	£15.00	£0.93	£14.07

Donations	Paypal Fees	Total Net	Costs	Carried Forward to 2026
£77	£4.43	£72.57	tbc	tbc

Further Information

YaDDNet

yaddnet, radio

YaDDNet : VPS SSL Renewal

anonymous@undisclosed.example.com (Anonymous) — Thu, 04 Jun 2026 06:39:56 +0000

←YaDDNet

YaDDNet : VPS SSL Renewal

Renewed SSL certificates for 2025/6

Read the final part about combining the 2 intermediate certificates!

15/03/25 : SSL certificates

Renewed SSL certificates available for download on Fasthosts account
- Download “Certificate” and rename → signed.crt
- Download both “Intermediate Certificates”
  - not sure why there are 2 intermediate certificates
  - rename one as ca.pem.1
  - renmame other as ca.pem.2
Use WinSCP to copy the 3 certificates to the Yaddnet VPS
Log on to yaddnet vps via SSH
- copy existing certificates in /usr/local/ssl from
  - signed.crt → signed.crt.old
  - ca.pem → ca.pem.old
- copy new certificates from home directory to /usr/local/ssl
- for clarity this gives new files
  - /usr/local/ssl/signed.crt
  - /usr/local/ssl/ca.pem.1
  - /usr/local/ssl/ca.pem.2
  - copy ca.pem.2 → ca.pem
- Restart Apache
  - service apache2 restart
- browse to https://www.yaddnet.org/index.php?
- site loads correctly
  - check site security

swap ca.pem files (copy ca.pem.1 → ca.pem)
Restart Apache
browse to https://www.yaddnet.org/index.php?
site loads correctly
security also valid

Different intermediate CA.pem certificates

I used openssl to inspect the two different intermediate certificates

gm4slv@yaddnet2:~ $ openssl x509 -in ca.pem -noout -text > /home/gm4slv/capemold.txt

for ca.pem.1

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            39:72:44:3a:f9:22:b7:51:d7:d3:6c:10:dd:31:35:95
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = GB, ST = Greater Manchester, L = Salford, O = Comodo CA Limited, CN = AAA Certificate Services
        Validity
            Not Before: Mar 12 00:00:00 2019 GMT
            Not After : Dec 31 23:59:59 2028 GMT
        Subject: C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority

or ca.pem.2

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            7d:5b:51:26:b4:76:ba:11:db:74:16:0b:bc:53:0d:a7
        Signature Algorithm: sha384WithRSAEncryption
        Issuer: C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
        Validity
            Not Before: Nov  2 00:00:00 2018 GMT
            Not After : Dec 31 23:59:59 2030 GMT
        Subject: C = GB, ST = Greater Manchester, L = Salford, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA

and for completeness the old original ca.pem from prior to the renewal

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            0d:e0:ff:b5:ee:62:cb:61:10:9f:60:8c:9c:ed:5e:d3
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = DigiCert Global Root G2
        Validity
            Not Before: Nov 27 12:46:40 2017 GMT
            Not After : Nov 27 12:46:40 2027 GMT
        Subject: C = US, O = DigiCert Inc, OU = www.digicert.com, CN = Encryption Everywhere DV TLS CA - G2

It appears that the certificate (ca.pem.2) from “Sectigo” has the longest validity, and that this is the more recent/appropriate one, so I've made it the certificate in use

sudo cp ca.pem.2 ca.pem

sudo service apache2 restart

UPDATE ON TWO INTERMEDIATE CERTIFICATES 5/7/25

I've discovered that the 2 Intermediate Certificates are necessary to complete the chain of authority.

What should be done is to join them together into one ca.pem file (and in the correct order…. )

Don't rename the 2 files as ca.pem.1 and ca.pem.2 per the above

Transfer them both with their original names and then cat them together

[root@yaddnet2:/home/g4slv/ssl]# cat 397A66CC2756362E0DAA87CA6EABE3B1.cer 7D5B5126B476BA11DB74160BBC530DA7.cer > ca.pem
 
[root@yaddnet2:/home/g4slv/ssl]# cp ca.pem /usr/local/ssl
 
[root@yaddnet2:/home/g4slv/ssl]# systemctl restart apache2

Check correct SSL operation at https://www.ssllabs.com/ssltest/analyze.html

— John Pumford-Green 15/03/25 06:36 GMT

Further Information

yaddnet, radio