Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Having some trouble getting SSL working on my server. I only need it for one of my two domains on this box. I have two IPs, and I am using A records on my DNS to point the domains to the different IPs.

Here is my httpd.conf:

NameVirtualHost XX.XX.XXX.X1:80
NameVirtualHost XX.XX.XXX.X2:80
NameVirtualHost XX.XX.XXX.X2:443

    <VirtualHost XX.XX.XXX.X1:80>
    ServerName domain1.com
    ServerAlias .*
    WSGIScriptAlias / /home/domain1/domain1.wsgi 
    </VirtualHost>

<VirtualHost XX.XX.XXX.X2:80>
        ServerName domain2.me
    DocumentRoot /var/www/domain2
</VirtualHost>

 <VirtualHost XX.XX.XXX.X2:443>

ServerName www.domain2.me

DocumentRoot /var/www/domain2
ServerAdmin ruedaminute@gmail.com

SSLEngine ON

SSLCertificateFile /etc/apache2/ssl/domain2.me.ssl/domain2.me.crt

SSLCertificateKeyFile /etc/apache2/ssl/domain2.me.ssl/domain2.me.key

SSLCACertificateFile /etc/apache2/ssl/domain2.me.ssl/gd_bundle.crt

</VirtualHost>   

Hope something obviously wrong jumps out. Here are links to two gists with other configs I've tried. the first just tries to use the snakeoil cert that comes with apache:

Snakeoil Cert

Another failed attempt similar to the one posted here

Basically what happens is that I get a "Page not available" when I pull up https://www.domain2.me.

Thanks in advance.

UPDATE: The issue was iptables not configured to accept traffic on port 443. I am accepting EightBitTony's answer since his config worked perfectly once I fixed my iptables.

share|improve this question
    
Any errors when you start apache services. What is the exact error in your ssl_error logs when you try to access the page ? –  Chakri May 2 '12 at 21:19
    
No errors on apache restart. I have no errors in my ssl error logs either. I tried specifying some ssl logfiles using the ErrorLog and CustomLog directives in my httpd.conf but did not see any errors show up there... –  ruedaminute May 2 '12 at 21:41
    
What's output when you run apache2ctl -S? –  Shane Madden May 2 '12 at 21:44
    
Too long for a comment, here's a gist of the output: gist.github.com/2580917 –  ruedaminute May 2 '12 at 22:05
    
Is your server listening on the right port? i.e. do you have Listen 443 somewhere, and if you do a netstat -an is Apache actually listening on the right port on the right IP address? –  EightBitTony May 2 '12 at 22:50
show 2 more comments

1 Answer

up vote 0 down vote accepted

This setup works for me (and it's the default Debian stuff, almost no changes).

In ports.conf

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

That matches yours.

Then, for each of my virtual hosts (non-SSL),

<VirtualHost *:80>

        ServerName domain.example:80
        DocumentRoot "/some/path/to/html"
        UseCanonicalName Off
        <Directory "/some/path/to/html">
            ... stuff ....
        </Directory>

</VirtualHost>

and SSL

<VirtualHost *:443>

        ServerName ssl-domain.example:443
        UseCanonicalName Off
        DocumentRoot "/some/path/to/ssl-html"

        <Directory "/some/path/to/ssl-html">
           ... stuff ...
        </Directory>

        SSLEngine on
        SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

</VirtualHost>

I think you should use UseCanonicalName Off so that the server generates URL's based on details passed by the client, so it gets the right port and name. Full details here.

Finally, you need to make sure the relevant SSL module is enabled, which I think in your case it is (but this is here for completeness).

Update: As well as listening on the right ports, you also need to ensure iptables isn't blocking or dropping SSL traffic on port 443.

share|improve this answer
    
nope :( thanks for your help and detailed instructions unfortunately there seems to be no change. Man I'm pulling my hair out here! I also just tried: adamstrawson.com/posts/Setting-up-SSL-on-Linux and that didn't work either. I used a gmail email when setting up the cert and didnt provide a password for the cert, is there any way either of those two could be the reason it's not working? –  ruedaminute May 3 '12 at 14:49
    
What exactly do you get back when you try and browse to https : //your.domain.example and what, if anything, is in the apache error log or access log. If the connection isn't going to the right virtualhost the errors will be going to the default log file. –  EightBitTony May 3 '12 at 15:01
    
From my apache error log: [Thu May 03 14:52:59 2012] [notice] Apache/2.2.17 (Ubuntu) PHP/5.3.5-1ubuntu7.7 with Suhosin-Patch mod_ssl/2.2.17 OpenSSL/0.9.8o mod_wsgi/3.3 Python/2.7.1+ configured -- resuming normal operations [Thu May 03 14:53:07 2012] [notice] SIGHUP received. Attempting to restart [Thu May 03 14:53:07 2012] [warn] RSA server certificate CommonName (CN) `PILfix' does NOT match server name!? ----- when I pull up exampledomain.com--- This webpage is not available Google Chrome could not load the webpage because www.exampledomain.com took too long to respond. –  ruedaminute May 3 '12 at 15:08
    
ooookay, I'm an idiot. turns out my iptables were not configured to accept traffic on 443. I changed that and I was good to go. Seems to be somewhat of a common problem on rackspace cloud servers I guess (since newbs like me are setting up their own iptables). Thank you so much for your help, and I'll accept your answer since the configs you put up worked perfectly once I got my iptables sorted. –  ruedaminute May 3 '12 at 15:47
    
Glad it's working, updated the answer to include a comment about iptables. –  EightBitTony May 4 '12 at 7:20
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.