Apache 2.0 -- Trouble with Virtual hosts + SSL

External Since: Jul 24, 2003 Posts: 3

I'm having a hard time making HTTPS work on a RedHat 9 server,
running apache 2.0.40-21.3

I'm talking about an *actual* server (and not an exercise I'm
doing on my home machine). I got a GeoTrust certificate, but
there simply is no way that I can make it work.

I already succeeded in setting up multiple virtual hosts (same
IP, different domain names). Then, I want the name
secure.mydomain.com to be used as the secure host, so I edited
the default /etc/httpd/conf.d/ssl.conf file and put the following:

<VirtualHost _default_:443>

# With the actual IP instead of _default_, I get an error message
# when running apachectl startssl

# General setup for the virtual host
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log

ServerAdmin admin.TakeThisOut@mydomain.com
DocumentRoot /home/websites/secure.mydomain.com
ScriptAlias /cgi-bin/ "/home/websites/secure.mydomain.com/cgi-bin/"
ServerName secure.mydomain.com:443

# I tried with and without the above lines (putting them in the
# VirtualHost block in the httpd.conf file). Same result Sad

SSLCertificateFile /etc/httpd/conf/mydomain.com.crt
SSLCertificateKeyFile /etc/httpd/conf/mydomain.com.key

# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on

.....

And the rest is pretty much unchanged.

I run apachectl stop, then apachectl startssl, and they run
without error messages. But the HTTPS part does not work; I
get this output from a wget command:

[root]# wget https://secure.mydomain.com/index.html
--19:44:26-- https://secure.mydomain.com/index.html
=> `index.html'
Resolving secure.mydomain.com... done.
Connecting to secure.mydomain.com[xx.xx.xx.xx]:443... connected.

Unable to establish SSL connection.

Unable to establish SSL connection.

(I manually modified the actual domain name, and the actual IP
address; but otherwise, this is copy-n-pasted output from the
command).

If I try from the browser (Mozilla), I get a dialog box saying
"Connection refused when attempting to contact secure.mydomain.com"

If I point the browser (or wget) to: http://secure.mydomain.com
(i.e., http instead of https), then I get the right index.html
file (the one corresponding to that domain name).

The certificate files are in the right place, owned by root with
permission 600. I temporarily changed the permissions to 644, but
it makes no difference. (all the directories in the path have
permission XX5 -- i.e., others always have read and execute
permission for all the directories in the path to the certificate
files)

What am I missing, or doing wrong?

BTW, the module mod_ssl is being loaded, and the right config
file is being read -- I tried putting a deliberate error, and
apachectl startssl reports it)

Thanks for any help/pointers,

Carlos
--

External Since: Jul 29, 2003 Posts: 2

You might try logging in as root and using "service httpd restart"
in order to restart the whole apache server.
if that does not work put your IP address providing it is static in place of
_default_ on the VirtualHost line.

If that does not work make sure that the SSL port is open and accessible
through a possible firewall (443). use "nmap <SERVER NAME> and see if it
lists SSL 443.
if not the reconfigure the firewall or add "Listen 443" to your VirtualHost
Block

"Carlos Moreno" <moreno_at_mochima_dot_com.TakeThisOut@xx.xxx> wrote in message
news:rR_Ta.6515$MS5.126400@wagner.videotron.net...
> I'm having a hard time making HTTPS work on a RedHat 9 server,
> running apache 2.0.40-21.3
>
> I'm talking about an *actual* server (and not an exercise I'm
> doing on my home machine). I got a GeoTrust certificate, but
> there simply is no way that I can make it work.
>
> I already succeeded in setting up multiple virtual hosts (same
> IP, different domain names). Then, I want the name
> secure.mydomain.com to be used as the secure host, so I edited
> the default /etc/httpd/conf.d/ssl.conf file and put the following:
>
>
>
> <VirtualHost _default_:443>
>
> # With the actual IP instead of _default_, I get an error message
> # when running apachectl startssl
>
>
> # General setup for the virtual host
> ErrorLog logs/ssl_error_log
> TransferLog logs/ssl_access_log
>
>
> ServerAdmin admin.TakeThisOut@mydomain.com
> DocumentRoot /home/websites/secure.mydomain.com
> ScriptAlias /cgi-bin/ "/home/websites/secure.mydomain.com/cgi-bin/"
> ServerName secure.mydomain.com:443
>
> # I tried with and without the above lines (putting them in the
> # VirtualHost block in the httpd.conf file). Same result Sad

>
> SSLCertificateFile /etc/httpd/conf/mydomain.com.crt
> SSLCertificateKeyFile /etc/httpd/conf/mydomain.com.key
>
>
>
>
> # SSL Engine Switch:
> # Enable/Disable SSL for this virtual host.
> SSLEngine on
>
>
> ....
>
> And the rest is pretty much unchanged.
>
> I run apachectl stop, then apachectl startssl, and they run
> without error messages. But the HTTPS part does not work; I
> get this output from a wget command:
>
<font color=purple> > [root]# wget <a style='text-decoration: underline;' href="https://secure.mydomain.com/index.html</font" target="_blank">https://secure.mydomain.com/index.html</font</a>>
<font color=purple> > --19:44:26-- <a style='text-decoration: underline;' href="https://secure.mydomain.com/index.html</font" target="_blank">https://secure.mydomain.com/index.html</font</a>>
> => `index.html'
> Resolving secure.mydomain.com... done.
> Connecting to secure.mydomain.com[xx.xx.xx.xx]:443... connected.
>
> Unable to establish SSL connection.
>
> Unable to establish SSL connection.
>
>
> (I manually modified the actual domain name, and the actual IP
> address; but otherwise, this is copy-n-pasted output from the
> command).
>
> If I try from the browser (Mozilla), I get a dialog box saying
> "Connection refused when attempting to contact secure.mydomain.com"
>
<font color=purple> > If I point the browser (or wget) to: <a style='text-decoration: underline;' href="http://secure.mydomain.com</font" target="_blank">http://secure.mydomain.com</font</a>>
> (i.e., http instead of https), then I get the right index.html
> file (the one corresponding to that domain name).
>
> The certificate files are in the right place, owned by root with
> permission 600. I temporarily changed the permissions to 644, but
> it makes no difference. (all the directories in the path have
> permission XX5 -- i.e., others always have read and execute
> permission for all the directories in the path to the certificate
> files)
>
> What am I missing, or doing wrong?
>
> BTW, the module mod_ssl is being loaded, and the right config
> file is being read -- I tried putting a deliberate error, and
> apachectl startssl reports it)
>
> Thanks for any help/pointers,
>
> Carlos
> --
>