0

I've read the Apache documentation on 'port binding' and on 'virtual hosts' but have come no closer to a solution. I also scoured serverfault for answers but all point to the same solution: 'add LISTEN [port number] to your httpd.conf file and restart Apache'. This does not work.

What I am trying to do: make Apache listen to secure connections on port 510 and 443.
What is happening: only port 443 works, both secure and unsecure requests on port 510 fail.

How I have attempted to do this (in my httpd.conf file):

Listen 80
Listen 443
Listen 510

NameVirtualHost *:510

<VirtualHost *:510>
    ServerName samplesite.com
    ServerAlias *.samplesite.com
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile "conf/ssl/_.samplesite.com/_.samplesite.com.crt"
    SSLCertificateKeyFile "conf/ssl/_.samplesite.com/_.samplesite.com.key"
    SSLCertificateChainFile "conf/ssl/_.samplesite.com/gd_bundle.crt"
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    AllowEncodedSlashes On
</VirtualHost>

<VirtualHost *:443>
    ServerName samplesite.com
    ServerAlias *.samplesite.com
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile "conf/ssl/_.samplesite.com/_.samplesite.com.crt"
    SSLCertificateKeyFile "conf/ssl/_.samplesite.com/_.samplesite.com.key"
    SSLCertificateChainFile "conf/ssl/_.samplesite.com/gd_bundle.crt"
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    AllowEncodedSlashes On
</VirtualHost>

Any help would be greatly appreciated.

5
  • Have you tried removing NameVirtualHost *:510?
    – Kruug
    Dec 28, 2012 at 19:27
  • Apache2 also uses (in linux at least) ports.conf. Did you update that too? Dec 28, 2012 at 19:30
  • What kind of error do you get? A timeout is different from a connection reset which is different from an HTTP error which is different again from an SSL error. You can't fix a problem until you know what the problem is.
    – Ladadadada
    Dec 28, 2012 at 20:26
  • Do you see anything listening on 510 when you run "netstat -ltnup"? Do you have SElinux enabled? (Both of these are applicable only for Linux.)
    – hwilbanks
    Dec 29, 2012 at 0:17
  • Can you provide the output of apachectl -S? Are there any errors on the console or in Apache's error log when you start the service? Dec 29, 2012 at 9:23

2 Answers 2

0

There could only two reasons I can think of right now.

  1. You have Selinux enabled on your machine, which is interfering with your settings. To test that, check the output of this command

    # getsebool

If this says something like this:

getsebool:  SELinux is enabled

That simply means that Selinux is enabled. To temporary disable it, use this command:

 # setenforce 0

This will disable your Selinux temporary. Try your apache new port after that.

  1. You have firewall enabled on your machine. Not sure which distro you are using, but try to check your firewall on your machine and allow access to 510 port if you have it enabled.

  2. Also, check the output of the command netstat -npl | grep 510 and see whether after restarting apache, is it really opening a port or not.

1
  • You are welcome. Still curious to know why you accepted the answer of Garfield ?
    – Napster_X
    Dec 31, 2012 at 21:38
0

I see that you have enabled NameBased Virtual Hosting for additional SSL Port 510.

NameVirtualHost *:510

SSL is a different entity and does not understand HTTP Host Headers on which Apache Name Based Virtual Host is based on.

Your best bet is to remove "NameVirtualHost *:510"

6
  • 1
    More info Dec 28, 2012 at 19:41
  • [Wiki Server Name Indication ](en.wikipedia.org/wiki/Server_Name_Indication) Dec 28, 2012 at 19:45
  • I didn't know about this. So now I've looked at "how to configure SNI in Apache" and everything I've found so far has the exact same syntax to set up a name based vhost, including having the "NameVirtualHost" line. Even the default ssl.conf file on RHEL systems has "NameVirtualHost *:443" in it. So what's the difference (config file wise) between SNI and VHosts?
    – Safado
    Dec 28, 2012 at 19:56
  • 1
    If there's only the one vhost on 510, the NameVirtualHost *:510 isn't affecting operation in any way. If there's more than one, SNI won't even kick on unless they have different certificates; name-based virtual hosting on an SSL port with no SNI works just fine, such as with wildcard or subject alt name certificates. Dec 29, 2012 at 9:22
  • @Safado The config is essentially automatic; it's enabled if your Apache supports it and you have two different SSL certificates configured under vhosts on the same listening port. Dec 29, 2012 at 9:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .