Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have setup a site through Apache, let's call it http://example.com. The regular site works fine and I can also access it by its IP number http://200.x.x.x. I can also access the secured version at https://200.x.x.x. However, https://example.com doesn't work and give me the following message in Firefox:

Unable to connect
Firefox can't establish a connection to the server at example.com

My apache configuration file for the secured site under sites-enabled is:

<VirtualHost 10.x.x.x:443>
    ServerName example.com
    ServerAlias example.com

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example.com.pem

    # We additionally removed HIGH security as some older MSIE browsers still can't do
    # strong crypto and they timeout
    SSLProtocol -all +SSLv3 +TLSv1
    #SSLCipherSuite SSLv3:+HIGH:+MEDIUM
    SSLCipherSuite HIGH:!SSLv2:!ADH:!aNULL:!eNULL:!NULL
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0

    WSGIDaemonProcess example.com-ssl user=www-data group=www-data processes=3
    WSGIProcessGroup example.com-ssl 
    WSGIScriptAlias / /home/dev/project/example/apache/django.wsgi
</VirtualHost>

The private IP 10.x.x.x gets mapped to 200.x.x.x. Does anyone know what I might be missing? I've done the above for a few other sites and they work fine, I can't pinpoint what's wrong with the above setup.

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Whatever's doing the IP address translation from 200.x.x.x to 10.x.x.x is only doing it for port 80, not port 443.

share|improve this answer
    
bump for womble...I'd check my firewall to verify that you're 1) allowing port 443 into the network and 2) not specifying only port 80 in your NAT rules. Also, you didn't mention whether you had tried it or not, but if you have internal access to the server, make sure that example.com responds correctly to a non-firewalled request. –  Greeblesnort Nov 30 '09 at 21:15
    
Port 443 is allowed in my network. Which file do I have to check on my linux to see the ports in my NAT rules? How do I check whether example.com responds correctly to a non-firewalled request? –  Thierry Lam Nov 30 '09 at 21:37

One possibility is that SSL requires a unique IP address (not just domain name) per vhost, usually.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.