Apache + SSL: Doesnt work via domain

Question

I'm developing a small website (Magento eshop) on own Debian virtual server. I'm not very advanced in this topic. Server now works fine, the last remaining problem is SSL access via https protocol.

When I access the server via local IP address https://192.168.1.xxx, it works. But when I access it via https://www.mydomain.com, is server unavailable. However http:/ /192.168.1.xxx and http:/ /www.mydomain.com works well.

What can be the problem?

My config files:

ports.conf

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

sites-enabled/magento

NameVirtualHost 192.168.1.124:80
<VirtualHost 192.168.1.124:80>
    ServerName www.mydomain.de
    ServerAdmin [email protected]
    DocumentRoot /var/www/magento
    <Directory /var/www/magento/>
        Options FollowSymLinks
        AllowOverride All
    </Directory>
    ErrorLog /var/log/apache2/error.log
    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn
    CustomLog /var/log/apache2/access.log combined
</VirtualHost>

sites-enabled/magento_ssl

NameVirtualHost *:443
<VirtualHost *:443>
    ServerAdmin [email protected]
    ServerName www.mydomain.de
    ServerAlias *.mydomain.de
    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl/edc.pem
    DocumentRoot /var/www/magento
    <Directory /var/www/magento>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
    LogLevel warn
    ErrorLog /var/log/apache2/ssl-error.log
    CustomLog /var/log/apache2/ssl-access.log combined
</VirtualHost>

Answer 1

To help diagnose, let me ask a few questions.

1. When you said "server unavailable":

   • what is the exact error message on the browser?
   • try running openssl s_client -connect www.mydomain.de:443 (if you're not on a unix box, try it on your vps itself)
   • do you get anything in /var/log/apache2/ssl-access.log or /var/log/apache2/ssl-error.log?

2. When you said it works with https://192.168.1.xxx/:

   • I presume you would at least get a browser warning saying certificate name mismatch.
   • is the browser displaying the correct certificate when you click on the lock icon?

Other things to check:

• make sure you have no proxy configured in the https case
• does /etc/apache2/ssl/edc.pem contain both your cert and private key as well?

Answer 2

Wil Tan: Thanks for response.

1. a) "Classic" Firefox error message - Unable to connect: Firefox can't establish a connection to the server www.mydomain.com

2. b) result of this command: connect: Connection refused connect:errno=29

3. c) both these log files are empty - isn't it strange?

4. Yes, the browser shows warning about this certifica, because it's self-trusted one. That's OK, self-trusted certificate is enought for me

make sure you have no proxy configured in the https case

Yes, there's no proxy for https

does /etc/apache2/ssl/edc.pem contain both your cert and private key as well?

I tried new way to make the certificate - http://grahamc.com/blog/openssl-madness-how-to-create-keys-certificate-signing-requests-authorities-and-pem-files/ So now I have mydomain.com.crt, mydomain.com.key, mydomain.com.pem and mydomain.com.csr files.

New magento_ssl content (the changed part):

SSLEngine On
SSLCertificateKeyFile ssl/mydomain.com.key
SSLCertificateFile ssl/mydomain.com.crt

Best regards

Lukas

Answer 3

This is a general screen which goes from in to out of your local unit.

Check your Security Configurations for Policy Kits and possible Firewall Restrictions for addresses outside the intranet or local network. Local resolution policies can override hosting connections in any OS.

Check your local gateway to check the Security exception over port 433 and HTTPS and see that the traffic is being correctly negotiated. Unless you are doing localhost only development; you may need to check the route of the request, seeing if it isn't being resolved over your DHCP gateway. (Router...)

Check for file logs after connections are made, see if there are any other bits you are or are not seeing. (for instance, client results in error; host did not see client because of namespace resolution difficulties)

Check your VHosts connection, check if the directory permissions and log permissions are equally accessible and or secure for (Deny, Allow...) either connections, they seem to be the most different. Maybe try using a literal name for your NameVirtualHost.

Check to be sure that connections like a local mobile phone or alternate computer (not one running the virtual machines) can see the website. This sometimes occurs with VMWare, Citrix and or other network adapters.

(Other possible conflictions: Are there any other SSL servers running, are there any FTP services which require SSL connections which are overriding your connection?)