2

I'm trying to set up SSL, with SNI, in my apache and am getting the often-seen "ssl_error_rx_record_too_long" error in Firefox when accessing the site (https://test.me.dev.xxxx.net), from which I can conclude that the server is listening on port 443, but doesn't know to use SSL on it.

The server is Ubuntu 9.04 with Apache 2.2.11 I enabled SSL in the default way (a2enmod ssl).

Here is my relevant config:

NameVirtualHost *:*
Listen 80

<IfModule mod_ssl.c>
    Listen 443
</IfModule>

...

<VirtualHost *:*>

        DocumentRoot /home
        ServerAlias *.dev.xxxx.net
        UseCanonicalName Off
        # project.user.dev.xxxx.net
        VirtualDocumentRoot /home/%2/dev/%1/web

        SSLEngine On
        SSLCertificateFile /etc/apache2/certs/dev.crt
        SSLCertificateKeyFile /etc/apache2/certs/dev.key

</VirtualHost>

What is wrong?

Improve this question
2

2 Answers 2

Reset to default
2

This is part of my server working config. Hope you will it handy.

<VirtualHost *:80>
    ServerAdmin [email protected]
    ServerName  xxx.com
    ServerAlias www.xxx.com

    DocumentRoot /srv/www/htdocs/xxx.com

    ErrorLog  /var/log/apache2/xxx.com-error_log
    CustomLog /var/log/apache2/xxx.com-access_log vhost_common

    <Directory "/srv/www/htdocs/xxx.com">
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

<VirtualHost *:80>
    ServerName mail.xxx.com
    Redirect / https://mail.xxx.com/
</VirtualHost>

<IfDefine SSL>
<IfDefine !NOSSL>
<VirtualHost _default_:443>
    ServerAdmin [email protected]
    ServerName  mail.xxx.com

    DocumentRoot  /srv/www/htdocs/roundcube

    ErrorLog  /var/log/apache2/roundcube-error_log
    CustomLog /var/log/apache2/roundcube-access_log vhost_common
    CustomLog /var/log/apache2/roundcube-ssl_log ssl_combined

    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile    /etc/ssl/xxx/apache2.crt
    SSLCertificateKeyFile /etc/ssl/xxx/apache2.key
    SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
</VirtualHost>
</IfDefine>
</IfDefine>
Improve this answer
3
  • 1
    So there's no way around duplicating the config for sites that need access via both?
    – Bart van Heukelom
    Feb 26, 2010 at 12:13
  • 1
    If you want to force either SSL or non-SSL you can configure Apache to redirect to the other (i.e. if you force SSL, then have the non-SSL do automatic redirect to the SSL domain). This shortens your config because it's just a one line redirect. Otherwise you should use Include statements as a way to follow DRY principles and shorten the config.
    – Van Gale
    Feb 26, 2010 at 17:15
  • 2
    @Bart van Heukelom: To configure similar virtual hosts, put the common directives in a separate file and use the Include directive. Alternatively, use mod_macro cri.ensmp.fr/~coelho/mod_macro .
    – 200_success
    Jun 20, 2010 at 13:33
0 
<VirtualHost *:443>
</VirtualHost>
Improve this answer
1
  • But I also need sites to be available over normal HTTP
    – Bart van Heukelom
    Feb 25, 2010 at 10:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .