1

Trying the configure SSL on Apache2 on Ubuntu server installed Apache

sudo apt install apache2

Opened ufw firewall

sudo ufw allow 'Apache'
ufw allow https

Installed SSL files in /root/cert

 chmod 400 /root/cert/*
  chmod 500 /root/cert/

In /etc/apache2/sites-available found two conf files: domainname.conf and default-ssl.conf DId not know which one to modify, so modified domainname.conf by adding following lines

 <VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /root/cert/ca-bundle.crt
        SSLCertificateKeyFile /root/cert/Private.key
        SSLCertificateChainFile /root/cert/certificate.crt
   </VirtualHost>

apachectl configtest
apachectl restart
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
systemctl enable apache2 --now 
netstat -ntlp |  grep 80
tcp6       0      0 :::80                   :::*                    LISTEN      899/apache2  

netstat -ntlp |  grep 443

returns nothing

Added information - the website DNS resolution has not happened yet, because the nameserver is being changed. So I am checking on localhost. localhost:80 works, localhost:443 does not work gives error: localhost refused to connect

Several questions:

  1. have I switched files SSLCertificateFile SSLCertificateChainFile by mistake since I did not which one was which. Also it has comment statement -----BEGIN CERTIFICATE----- and -----BEGIN CERTIFICATE-----

  2. When I perform

    apache2ctl configtest it says AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1. Set the 'ServerName' directive globally to suppress this message Syntax OK

Is this a problem since nameserver is still pointing to old provider and I am in process of switching to new provider nameserver where the new website is running.

Can anyone help?

2
  • just a thought ... SSL certificates are for a domain ... localhost is not the domain in the certificate ... so ... perhaps that's why whatever you are using to test is refusing to connect? hmm, just read it again, port 443 isn't even open Nov 1, 2023 at 8:15
  • Looks like you are missing the Listen directive for that port somewhere. Nov 1, 2023 at 18:48

4 Answers 4

1

If the Apache process is not listening on port 443 you are missing the Listen 443 directive in your configuration. It should be enabled by default if the ssl module is active, so make sure the module is loaded.

sudo a2enmod ssl
9
  • This command worked. It said Enabling module SSL. Later I ran netstat -ntlp | grep 443 tcp6 0 0 :::443 :::* LISTEN 2897/apache2
    – vrao
    Nov 1, 2023 at 21:08
  • If I run localHost:80 it correctly shows my website. However if I run localhost:443 it shows default ubuntu page. How to switch ubuntu page to my website for port 443?
    – vrao
    Nov 1, 2023 at 21:23
  • Your 443 virtualhost is rather empty. Copy the directives from the 80 virtualhost over. Nov 2, 2023 at 6:16
  • 443 has all the directives from 80 and also inserted SSL commands, but still not working. Should I redirect port 80 to 443 or something?
    – vrao
    Nov 2, 2023 at 16:06
  • How to redirect port 80 to 443
    – vrao
    Nov 2, 2023 at 16:15
2

Also (check other answers) you chould change the files in the config. This:

SSLCertificateFile /root/cert/ca-bundle.crt
SSLCertificateKeyFile /root/cert/Private.key
SSLCertificateChainFile /root/cert/certificate.crt

should be

SSLCertificateFile /root/cert/certificate.crt
SSLCertificateKeyFile /root/cert/Private.key
SSLCertificateChainFile /root/cert/ca-bundle.crt
3
  • I did swap the certs as suggested
    – vrao
    Nov 1, 2023 at 21:03
  • @vrao, check also the answer of Gerald to enable the ssl Nov 1, 2023 at 21:06
  • 1
    Your suggestion helped. But more importantly Gerlad's command helped me enable SSL, so I accepted his answer.
    – vrao
    Nov 1, 2023 at 21:11
0

Configuration from /etc/apache2/sites-available is not included in the apache2.conf, but configuration from /etc/apache2/sites-enabled. Create a symlink using

sudo a2ensite domainname
0
0

It looks like your domainname.conf file is not enabled.

Checkout the /etc/apache2/sites-enabled and to find out which configuration file is enabled.

1
  • it was domainname.conf
    – vrao
    Nov 1, 2023 at 21:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .