Can't get SSL to work

Question

I'm trying to get Apache 2 to use SSL for one of many domains on a server. I don't care about any of the other domains running SSL on the server. I'm trying to do this for a Facebook app. Nothing on the server is listening on port 443 according to http://www.t1shopper.com/tools/port-scan/

The url is facebook.mythinairwireless.com

I followed this guide: http://www.codealpha.net/631/name-based-virtual-hosts-with-ssl-using-apache2-on-ubuntu-lucid/

When I restart apache, I get these log messages:

[Fri Jan 20 20:23:42 2012] [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
[Fri Jan 20 20:23:42 2012] [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
[Fri Jan 20 20:23:42 2012] [notice] Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k configured -- resuming normal operations

My ports.conf file looks like this:

NameVirtualHost *:80
NameVirtualHost *:443

Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

And my config file for the website (aside from some filepaths:

<VirtualHost *:443>
SSLEngine on
SSLCertificateFile obscured

ServerName facebook.mythinairwireless.com
ServerAdmin webmaster@localhost

    DocumentRoot /home/obscured/facebook

ErrorLog /var/log/apache2/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog /var/log/apache2/access.log combined

</VirtualHost>

My configuration for port 80 is in this file as well.

Answer 1

These are just warnings. You should get your website working with SSL support given that your browser supports SNI (Server Name Indication).

Because of this, it is recommended to configure IP-based virtual hosting for SSL websites instead of Name-based.

Answer 2

To check that the ssl module is enabled (it probably is with that warning).

apache2 -t -D DUMP_MODULES -f /etc/apache2/apache2.conf

Note in the above command apache2 might need to be replaced by httpd. The file path at the end should be the main apache configuration file.

It is also possible that your firewall is blocking the port. The next command will allow you to see whether or not it is actually listening. If you get nothing back then no process is listening on 443.

netstat -lpn | grep 443

---

This is my entire configuration for reference.

Listen 443
NameVirtualHost *:443

<VirtualHost *:443>

    ServerName              sub.domain.com
    DocumentRoot            /home/www/sub.domain.com/

    SSLEngine               on

    SSLCertificateFile      /etc/apache2/ssl/sub.domain.com
    SSLCertificateKeyFile   /etc/apache2/ssl/sub.domain.com

</VirtualHost>

Some additional bits that should already come with the ssl module.

SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512

SSLPassPhraseDialog builtin

SSLSessionCache shmcb:/var/run/apache2/ssl_scache(512000)

SSLSessionCacheTimeout 300

SSLMutex file:/var/run/apache2/ssl_mutex

SSLCipherSuite HIGH:MEDIUM:!ADH

SSLProtocol all -SSLv2