Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to get Apache 2 to use SSL for one of many domains on a server. I don't care about any of the other domains running SSL on the server. I'm trying to do this for a Facebook app. Nothing on the server is listening on port 443 according to http://www.t1shopper.com/tools/port-scan/

The url is facebook.mythinairwireless.com

I followed this guide: http://www.codealpha.net/631/name-based-virtual-hosts-with-ssl-using-apache2-on-ubuntu-lucid/

When I restart apache, I get these log messages:

[Fri Jan 20 20:23:42 2012] [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
[Fri Jan 20 20:23:42 2012] [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
[Fri Jan 20 20:23:42 2012] [notice] Apache/2.2.14 (Ubuntu) PHP/5.3.2-1ubuntu4 with Suhosin-Patch mod_ssl/2.2.14 OpenSSL/0.9.8k configured -- resuming normal operations

My ports.conf file looks like this:

NameVirtualHost *:80
NameVirtualHost *:443

Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

And my config file for the website (aside from some filepaths:

<VirtualHost *:443>
SSLEngine on
SSLCertificateFile obscured

ServerName facebook.mythinairwireless.com
ServerAdmin webmaster@localhost

    DocumentRoot /home/obscured/facebook

ErrorLog /var/log/apache2/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog /var/log/apache2/access.log combined

</VirtualHost>

My configuration for port 80 is in this file as well.

share|improve this question
1  
Is there a chance that a firewall is blocking your portscan? –  becomingwisest Jan 20 '12 at 22:35

2 Answers 2

These are just warnings. You should get your website working with SSL support given that your browser supports SNI (Server Name Indication).

Because of this, it is recommended to configure IP-based virtual hosting for SSL websites instead of Name-based.

share|improve this answer

To check that the ssl module is enabled (it probably is with that warning).

apache2 -t -D DUMP_MODULES -f /etc/apache2/apache2.conf

Note in the above command apache2 might need to be replaced by httpd. The file path at the end should be the main apache configuration file.

It is also possible that your firewall is blocking the port. The next command will allow you to see whether or not it is actually listening. If you get nothing back then no process is listening on 443.

netstat -lpn | grep 443

This is my entire configuration for reference.

Listen 443
NameVirtualHost *:443

<VirtualHost *:443>

    ServerName              sub.domain.com
    DocumentRoot            /home/www/sub.domain.com/

    SSLEngine               on

    SSLCertificateFile      /etc/apache2/ssl/sub.domain.com
    SSLCertificateKeyFile   /etc/apache2/ssl/sub.domain.com

</VirtualHost>

Some additional bits that should already come with the ssl module.

SSLRandomSeed startup builtin
SSLRandomSeed startup file:/dev/urandom 512
SSLRandomSeed connect builtin
SSLRandomSeed connect file:/dev/urandom 512

SSLPassPhraseDialog builtin

SSLSessionCache shmcb:/var/run/apache2/ssl_scache(512000)

SSLSessionCacheTimeout 300

SSLMutex file:/var/run/apache2/ssl_mutex

SSLCipherSuite HIGH:MEDIUM:!ADH

SSLProtocol all -SSLv2
share|improve this answer
    
Hi Yotaware, I ran the first command and SSL is loaded. The second command returned this though: tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 30483/apache2 Shouldn't it be 127.0.0.1:443 on there? Thanks –  James Richard Jan 20 '12 at 22:01
    
@JamesRichard The 0.0.0.0 is correct (it means all IP addresses available on the machine). Check the firewall on the machine and allow port 443. –  diolemo Jan 20 '12 at 22:05
    
The server is a Rackspace Cloud server. There are no iptables setup for a firewall, and I don't believe Rackspace would block it. –  James Richard Jan 21 '12 at 2:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.