PHP & Magento Developer in Minnesota

Thank you for visiting my website. I’m Nick Bartlett and have over ten years professional experience as a web developer with both frontend and backend skills. I’m one of a handful of Zend PHP 5 certified engineers in Minnesota and have years of experience contracting for local and remote companies.  If you or your company needs help with any of the below areas, please contact me through this website or email nick at bartlett dot com.

  1. Object Oriented PHP 5
  2. High performance, high traffic PHP websites
  3. MySQL 5
  4. JavaScript / Jquery
  5. HTML/CSS
  6. Magento
  7. WordPress
  8. Zend Framework
  9. Yii Framework

Certbot auto-renew didn’t work because nginx wasn’t reloaded

Two sites on my server (Debian on nginx) are using certbot SSL certificates and I was greeted with a browser notice that one of them was expired. Certbox creates a cron job to do automatic renewal of the SSL and it works, but an nginx reload needs to occur afterward for the new cert to take effect. This is not automatically configured when you install Certbot, which creates this cron job at /etc/cron.d/certbot

0 */12 * * * root test -x /usr/bin/certbot && perl -e 'sleep int(rand(3600))' && certbot -q renew

To solve, add this at the end of the cron job command so have nginx reloaded after each successful SSL renewal

--renew-hook "/etc/init.d/nginx reload"

The final cron command is

0 */12 * * * root test -x /usr/bin/certbot && perl -e 'sleep int(rand(3600))' && certbot -q renew --renew-hook "/etc/init.d/nginx reload"

Alternatively, you can add a line for each domain separately under the renewalparams section of the file /etc/letsencrypt/renewal/yourdomain.com.conf:

[renewalparams]
renew_hook = service nginx reload

Adding lets encrypt certbot to your site

For fun today I installed certbot, formally known as Let’s Encrypt, on one of my personal projects in order to get a free SSL cert for the site. It was pretty straight forward and worked very well! Below are notes and tips that may help your install.

My server is running Debian Linux with an nginx web server.

  1. Go to https://certbot.eff.org/ and enter your flavor of linux and type of server. If you’re unsure what distro/flavor of linux you have, type this on the command line “cat /etc/issue” .
  2. For my combination, the fully automated solution was not available. Their automated solution will prompt you for which sites on your server you want to install the certificate for, and then it will edit your nginx conf files for each site so the certificate is used. I haven’t tried this myself, but automated things like this make me weary, so I probably would have done the manual install anyway.

  3. The next step was to follow the instructions on the following page as the root user https://certbot.eff.org/lets-encrypt/debianjessie-nginx. I won’t go through them in detail as it really is just following their instructions and commands provided. I did add the Jessie backports as described here https://backports.debian.org/Instructions/. I used the webroot install approach.
  4. I initially had some trouble because one of my sites is using the Yii framework and I didn’t point the certbot certonly command at the webroot, but instead at the code root of the framework. The process will create a .well-known directory and it must be within the webroot so it can be authenticated. The .well-known directory will be empty and it’s OK to have it owned by the root user and group. A successful run of the certbot certonly command will result in a message like “Congratulations! Your certificate and chain have been saved…”
  5. The next thing is to configure your nginx conf file to use the new cert. Also don’t forget to change your conf file to listen to port 443 instead of port 80.
    server {
    	listen 443;
    	ssl on;
    
    	server_name example.com;
    
    	ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    	ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    
    	....
    

    Then restart nginx. You may also need to make application changes so the site uses an HTTPS domain depending on the framework or type of application you have.

  6. Last thing to know is the certbot certonly command will create a cron job for you at /etc/cron.d/certbot with the below contents that tries to auto renew twice per day
    0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(3600))' && certbot -q renew
    

Magento Error Warning: mcrypt_generic_deinit(): Could not terminate encryption specifier

I ran into the below error today while working with Magento 1 and registering a customer during checkout.

[10-Apr-2018 13:49:47] WARNING: [pool www] child 1731 said into stderr: "NOTICE: PHP message: PHP Fatal error:  Uncaught exception 'Exception' with message 'Warning: mcrypt_generic_deinit(): Could not terminate encryption specifier  in /var/www/myproject/htdocs/lib/Varien/Crypt/Mcrypt.php on line 135' in /var/www/myproject/htdocs/app/code/core/Mage/Core/functions.php:245"
[10-Apr-2018 13:49:47] WARNING: [pool www] child 1731 said into stderr: "Stack trace:"
[10-Apr-2018 13:49:47] WARNING: [pool www] child 1731 said into stderr: "#0 [internal function]: mageCoreErrorHandler(2, 'mcrypt_generic_...', '/var/www/myproject...', 135, Array)"
[10-Apr-2018 13:49:47] WARNING: [pool www] child 1731 said into stderr: "#1 /var/www/myproject/htdocs/lib/Varien/Crypt/Mcrypt.php(135): mcrypt_generic_deinit(Resource id #180)"
[10-Apr-2018 13:49:47] WARNING: [pool www] child 1731 said into stderr: "#2 /var/www/myproject/htdocs/lib/Varien/Crypt/Mcrypt.php(54): Varien_Crypt_Mcrypt->_reset()"
[10-Apr-2018 13:49:47] WARNING: [pool www] child 1731 said into stderr: "#3 [internal function]: Varien_Crypt_Mcrypt->destruct()"
[10-Apr-2018 13:49:47] WARNING: [pool www] child 1731 said into stderr: "#4 {main}"
[10-Apr-2018 13:49:47] WARNING: [pool www] child 1731 said into stderr: "  thrown in /var/www/myproject/htdocs/app/code/core/Mage/Core/functions.php on line 245"

The problem is the encryption key in app/etc/local.xml was empty. Add one to solve the problem.


The Phoenix Project book take aways

I just finished listening to the audio book of the Phoenix project. I had a few primary take aways from this book:
1. Reduce WIP (work in progress). I’ve been on projects in my career where when we’d get blocked on doing some work, we needed to keep the team busy so we’d pull in other work. Soon enough you’d have 100 initiatives going on at once that you’re able to devote to each only ten minutes per week. In this project we paused for two weeks where no new work was added and we just focused on completing the work already in progress. It reduces context switching and allows more work to get completed.

2. Automated builds and deployments. I’ve also been on teams where this has been done and it’s fantastic. Building and maintaining the tool itself takes effort, so plan for that. But, once it’s finished you can deploy all day with consistency and accuracy.

3. Identify your workflow’s constraint (bottleneck). Any improvements to the workflow that are not at the constraint are worthless.

4. Unplanned work prevents you from meeting your goals. Minimize this.

Here are a couple great resources for notes and take aways https://lalitkale.wordpress.com/2014/08/04/book-notes-the-phoenix-project-a-novel-about-it-devops-and-helping-your-business-win/ and https://uptakedigital.zendesk.com/hc/en-us/articles/115000524374-4-Types-of-Work-in-IT-The-Phoenix-Project-


How to update google compute engine instance

My google compute engine instance is running Debian.  As I’ve read, those running Centos and Redhat linux have a nightly yum update, but not servers running Debian Linux.  If you’re unsure which version of linux you have, run

cat /proc/version

My Debian Linux Google compute engine has apt-get installed and not yum. Run this command to have it check for and print updates; it won’t install them.

apt list --upgradable

If you haven’t upgraded software in a while, you’ll see a long list of packages that need to be updated.

There are a few different ways to install the updates as described here https://cloud.google.com/compute/docs/security-bulletins and here https://askubuntu.com/questions/194651/why-use-apt-get-upgrade-instead-of-apt-get-dist-upgrade . I usually run

apt-get -y dist-upgrade

Afterward if you run “apt list –upgradable” again it’ll just say “Listing… Done” since nothing needs to be updated.