Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am running multiple virtual hosts on my apache and I want one virtual host to server ssl.

I have followed the instructions given to me from where I purchased my certificate.

Whenever I visit my site using https, I get an "Unable to connect error" in Firefox.

My ssl.conf which is included by httpd.conf looks like this:

NameVirtualHost xxx.xxx.xxx.xxx:443

<VirtualHost xxx.xxx.xxx.xxx:443>

DocumentRoot "/var/www/html/path/to/dir"
ServerName *.xxx.xxx.com
ServerAlias *.xxx.xxx.com
Alias /path "/var/www/html/development/path/to/somewhere/else"

SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
SSLCertificateFile /etc/ssl/crt/STAR_xxx_xxx_com.crt
SSLCertificateKeyFile /etc/ssl/crt/private.key
SSLCACertificateFile /etc/httpd/conf/STAR_xxx_xxx_com.ca-bundle

<Directory "/var/www/html/path/to/dir">
  Order Deny,Allow 
  Allow from all
  Options -Indexes
  AllowOverride All
</Directory>


</VirtualHost>

What else can I do to solve this?

EDIT Some other thoughts:

  1. I have read that my apache has to be compiled somehow with SSL. Is this an issue?
  2. In some configurations the Listen 443 in enclosed in tags. Is this also an issue?

When I do a lsof -I :443 I get a

COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME

httpd   8872   root    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8874 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8875 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8876 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8877 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8878 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8879 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8880 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8881 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8893 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8894 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   8895 apache    5u  IPv6 78180368       TCP *:https (LISTEN)
httpd   9067 apache    5u  IPv6 78180368       TCP *:https (LISTEN)

I think prolly not waht I expected since I only want one virtual host to listen to 443. Or is this correct?

share|improve this question

migrated from superuser.com Oct 3 '11 at 15:55

This question came from our site for computer enthusiasts and power users.

2  
Please edit your question to include the relevant parts of your configuration, and any errors that Apache puts in its logs during the service's start. –  Shane Madden Oct 3 '11 at 16:06
    
Check whether the server is actually listening on port 443 or not. (With a 'netstat' or similar command.) That will split the problem space in half. –  David Schwartz Oct 3 '11 at 16:21
    
@DavidSchwartz done –  Jeune Oct 3 '11 at 16:24
    
@Jeune: What was the result? Was the server listening on port 443 or not? –  David Schwartz Oct 3 '11 at 16:40
    
@DavidSchwartz updated my post now –  Jeune Oct 3 '11 at 16:41
show 8 more comments

4 Answers

Do you have a line like this in your httpd.conf?

Listen 443
share|improve this answer
    
Yeah I do have that in the ssl.conf which is included by the httpd.conf –  Jeune Oct 3 '11 at 16:17
add comment

Have you tried creating two different tags for http and https? Also, are you pointing to yoru certificates? Your location will vary from mine below.

<VirtualHost *:80>
</VirtualHost>

<VirtualHost *:443>


   SSLEngine on
   SSLCertificateFile /var/cert/domain.net.crt
   SSLCertificateKeyFile /var/cert/domain.key.nopass
   SSLCertificateChainFile /var/cert/gd_bundle_domain.crt
</VirtualHost>
share|improve this answer
    
I do have those things too –  Jeune Oct 3 '11 at 16:25
    
Do I really need separate tags for http and https? Won't just https suffice? –  Jeune Oct 3 '11 at 16:26
    
I think that you would need the separate tags because one is declaring the SSLEngine and the locations for the certificates. –  kobaltz Oct 3 '11 at 16:43
add comment

You may have port 443 closed by your firewall. On Linux you can list rules by running iptables -L

share|improve this answer
    
I tried to scan ports using nmap and port 443 is open –  Jeune Oct 4 '11 at 1:47
    
You have tried to scan ports from localhost or some remote host? –  rvs Oct 4 '11 at 7:17
    
I executed the command in the shell connected to my remote host via ssh. –  Jeune Oct 4 '11 at 9:28
add comment
up vote 0 down vote accepted

Was able to solve this problem by restarting the iptables

service iptables stop
service iptables start
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.