0

So I am attempting to configure apache to do two things: serve a mod_wsgi application on the host and act as a reverse proxy for a web server running inside a vm on the host. To do this, I am using name-based virtual hosts in apache. This is my vhost configuration:

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /etc/apache2/certs/site1.crt
    SSLCertificateKeyFile /etc/apache2/certs/site1.key
    SSLCACertificateFile /etc/apache2/certs/site1CA.crt

    ServerName site1.com

    Alias /static /static
    <Directory /static>
            Require all granted
    </Directory>
    <Directory /wsgi/files >
            <Files wsgi.py>
                    Require all granted
            </Files>
    </Directory>

    WSGIDaemonProcess webapp python-path=/wsgi/files
    WSGIProcessGroup webapp
    WSGIScriptAlias / /wsgi/files/wsgi.py

</VirtualHost>

<VirtualHost *:443>
    ProxyPreserveHost On
    ProxyPass / https://<local vm ip>/
    ProxyPassReverse / https://<local vm ip>/
    ServerName site2.com
    SSLProxyEngine On
    ProxyRequests Off
    ProxyPreserveHost On
    SSLCertificateFile /etc/apache2/certs/site2.crt
    SSLCertificateKeyFile /etc/apache2/certs/site2.key
    SSLCACertificateFile /etc/apache2/certs/site2CA.crt
</VirtualHost>

The output of apache2 -S is:

<host ip>:443        is a NameVirtualHost
     default server site1.com (/etc/apache2/sites-enabled/vhosts.conf:1)
     port 443 namevhost site1.com (/etc/apache2/sites-enabled/vhosts.conf:1)
     port 443 namevhost site2.com (/etc/apache2/sites-enabled/vhosts.conf:29)

I have confirmed that the DNS entry for site1.com and site2.com are the same ip. But when I try to navigate to site1.com, it always brings up site2.com. However, if on the host server I do curl https://site1.com it correctly shows site1.com.

Does anyone know what might be causing this?

1
  • If I disable https on site1.com and have it listen on port 80, it works correctly.
    – Sam B
    Mar 1, 2017 at 17:56

1 Answer 1

0

The problem turned out to be an iptables NAT rule that forwarded all traffic over port 443 to site2.com, which is why that was getting served regardless.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .