up vote 0 down vote favorite
share [g+] share [fb]

I have setup a site through Apache, let's call it http://example.com. The regular site works fine and I can also access it by its IP number http://200.x.x.x. I can also access the secured version at https://200.x.x.x. However, https://example.com doesn't work and give me the following message in Firefox:

Unable to connect
Firefox can't establish a connection to the server at example.com

My apache configuration file for the secured site under sites-enabled is:

<VirtualHost 10.x.x.x:443>
    ServerName example.com
    ServerAlias example.com

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example.com.pem

    # We additionally removed HIGH security as some older MSIE browsers still can't do
    # strong crypto and they timeout
    SSLProtocol -all +SSLv3 +TLSv1
    #SSLCipherSuite SSLv3:+HIGH:+MEDIUM
    SSLCipherSuite HIGH:!SSLv2:!ADH:!aNULL:!eNULL:!NULL
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

    WSGIDaemonProcess example.com-ssl user=www-data group=www-data processes=3
    WSGIProcessGroup example.com-ssl 
    WSGIScriptAlias / /home/dev/project/example/apache/django.wsgi
</VirtualHost>

The private IP 10.x.x.x gets mapped to 200.x.x.x. Does anyone know what I might be missing? I've done the above for a few other sites and they work fine, I can't pinpoint what's wrong with the above setup.

link|improve this question
94% accept rate
feedback

2 Answers

up vote 3 down vote accepted

Whatever's doing the IP address translation from 200.x.x.x to 10.x.x.x is only doing it for port 80, not port 443.

link|improve this answer
bump for womble...I'd check my firewall to verify that you're 1) allowing port 443 into the network and 2) not specifying only port 80 in your NAT rules. Also, you didn't mention whether you had tried it or not, but if you have internal access to the server, make sure that example.com responds correctly to a non-firewalled request. – Greeblesnort Nov 30 '09 at 21:15
Port 443 is allowed in my network. Which file do I have to check on my linux to see the ports in my NAT rules? How do I check whether example.com responds correctly to a non-firewalled request? – Thierry Lam Nov 30 '09 at 21:37
feedback
up vote 1 down vote

One possibility is that SSL requires a unique IP address (not just domain name) per vhost, usually.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.