Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've read the Apache documentation on 'port binding' and on 'virtual hosts' but have come no closer to a solution. I also scoured serverfault for answers but all point to the same solution: 'add LISTEN [port number] to your httpd.conf file and restart Apache'. This does not work.

What I am trying to do: make Apache listen to secure connections on port 510 and 443.
What is happening: only port 443 works, both secure and unsecure requests on port 510 fail.

How I have attempted to do this (in my httpd.conf file):

Listen 80
Listen 443
Listen 510

NameVirtualHost *:510

<VirtualHost *:510>
    ServerName samplesite.com
    ServerAlias *.samplesite.com
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile "conf/ssl/_.samplesite.com/_.samplesite.com.crt"
    SSLCertificateKeyFile "conf/ssl/_.samplesite.com/_.samplesite.com.key"
    SSLCertificateChainFile "conf/ssl/_.samplesite.com/gd_bundle.crt"
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    AllowEncodedSlashes On
</VirtualHost>

<VirtualHost *:443>
    ServerName samplesite.com
    ServerAlias *.samplesite.com
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile "conf/ssl/_.samplesite.com/_.samplesite.com.crt"
    SSLCertificateKeyFile "conf/ssl/_.samplesite.com/_.samplesite.com.key"
    SSLCertificateChainFile "conf/ssl/_.samplesite.com/gd_bundle.crt"
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    AllowEncodedSlashes On
</VirtualHost>

Any help would be greatly appreciated.

share|improve this question
    
Have you tried removing NameVirtualHost *:510? –  Kruug Dec 28 '12 at 19:27
    
Apache2 also uses (in linux at least) ports.conf. Did you update that too? –  charlesbridge Dec 28 '12 at 19:30
    
What kind of error do you get? A timeout is different from a connection reset which is different from an HTTP error which is different again from an SSL error. You can't fix a problem until you know what the problem is. –  Ladadadada Dec 28 '12 at 20:26
    
Do you see anything listening on 510 when you run "netstat -ltnup"? Do you have SElinux enabled? (Both of these are applicable only for Linux.) –  hwilbanks Dec 29 '12 at 0:17
    
Can you provide the output of apachectl -S? Are there any errors on the console or in Apache's error log when you start the service? –  Shane Madden Dec 29 '12 at 9:23

2 Answers 2

up vote 0 down vote accepted

There could only two reasons I can think of right now.

  1. You have Selinux enabled on your machine, which is interfering with your settings. To test that, check the output of this command

    # getsebool

If this says something like this:

getsebool:  SELinux is enabled

That simply means that Selinux is enabled. To temporary disable it, use this command:

 # setenforce 0

This will disable your Selinux temporary. Try your apache new port after that.

  1. You have firewall enabled on your machine. Not sure which distro you are using, but try to check your firewall on your machine and allow access to 510 port if you have it enabled.

  2. Also, check the output of the command netstat -npl | grep 510 and see whether after restarting apache, is it really opening a port or not.

share|improve this answer
    
Thanks GeekRide! It was a firewall issue after all. –  user151230 Dec 31 '12 at 19:11
    
You are welcome. Still curious to know why you accepted the answer of Garfield ? –  GeekRide Dec 31 '12 at 21:38

I see that you have enabled NameBased Virtual Hosting for additional SSL Port 510.

NameVirtualHost *:510

SSL is a different entity and does not understand HTTP Host Headers on which Apache Name Based Virtual Host is based on.

Your best bet is to remove "NameVirtualHost *:510"

share|improve this answer
1  
More info –  Garfield Carneiro Dec 28 '12 at 19:41
    
[Wiki Server Name Indication ](en.wikipedia.org/wiki/Server_Name_Indication) –  Garfield Carneiro Dec 28 '12 at 19:45
    
I didn't know about this. So now I've looked at "how to configure SNI in Apache" and everything I've found so far has the exact same syntax to set up a name based vhost, including having the "NameVirtualHost" line. Even the default ssl.conf file on RHEL systems has "NameVirtualHost *:443" in it. So what's the difference (config file wise) between SNI and VHosts? –  Safado Dec 28 '12 at 19:56
1  
If there's only the one vhost on 510, the NameVirtualHost *:510 isn't affecting operation in any way. If there's more than one, SNI won't even kick on unless they have different certificates; name-based virtual hosting on an SSL port with no SNI works just fine, such as with wildcard or subject alt name certificates. –  Shane Madden Dec 29 '12 at 9:22
    
@Safado The config is essentially automatic; it's enabled if your Apache supports it and you have two different SSL certificates configured under vhosts on the same listening port. –  Shane Madden Dec 29 '12 at 9:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.