Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running ubuntu server 12.04. I want to secure access to a python app via apache ssl proxy. I have

sudo a2ensite erp.mydomain.com

And I have in /etc/hosts

127.0.0.1 mydomain.com erp.mydomain.com
  • -http://erp.mydomain.com redirects to -https://erp.mydomain.com OK
  • -https://erp.mydomain.com proxy to -https://erp.mydomain.com/web/webclient/home OK
  • -http://mydomain.com goes to my regular website in /var/www/ OK
  • https://mydomain.com redirects to http://mydomain.com/web/webclient/home leading to error: "The requested URL /web/webclient/home was not found on this server." Not OK

I don't understand this redirection, any pointers would help. Here is my erp.mydomain.com file:

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
ServerName erp.mydomain.com
Redirect / https://erp.mydomain.com/
    DocumentRoot /var/www
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

</VirtualHost>

<IfModule mod_ssl.c>

<VirtualHost *:443>
    ServerAdmin webmaster@localhost
ServerName erp.mydomain.com
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
ProxyRequests Off
ProxyPass        /   http://127.0.0.1:8069/
ProxyPassReverse /   http://127.0.0.1:8069/
SetEnv proxy-nokeepalive 1  
    DocumentRoot /var/www
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>

    SSLEngine on

    SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
    SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
        SSLOptions +StdEnvVars
    </Directory>

    BrowserMatch "MSIE [2-6]" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
    # MSIE 7 and newer should be able to use keepalive
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

</VirtualHost>
</IfModule>
share|improve this question

2 Answers 2

If you don't have a

<VirtualHost *:443>
    ServerName mydomain.com
    ...
</VirtualHost>

block in your regular mydomain.com site file, then the problem is that Apache will serve the first virtualhost configured when there are no other matches. Add a virtualhost for that servername and it should be solved.

If you do, then you may be having a problem with SNI not properly working, either on the client side (not supported in IE-on-XP) or on the server side (12.04 should have a proper version of OpenSSL though). In this case, if SSLStrictSNIVHostCheck is off, the client is served the default first vhost, rather than an error message.

Finally, make sure you have setup name-based vhosts on both *.80 and *.443:

NameVirtualHost *:80
NameVirtualHost *:443
share|improve this answer

It is more like your website is sending an HTTP redirect to the client. As the server and the client both do not know about the proxy it just escapes.

Use a rewrite rule similar to this

    ReWriteEngine On
    RewriteRule ^/web/webclient/home/(.*) https://%{HTTP_HOST}/web/webclient/home

So when the redirect is sent, it is detected and re-written to point back to the https server before the client sees it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.