ssl not working on apache with Ubuntu Natty and multiple domains

Question

Having some trouble getting SSL working on my server. I only need it for one of my two domains on this box. I have two IPs, and I am using A records on my DNS to point the domains to the different IPs.

Here is my httpd.conf:

NameVirtualHost XX.XX.XXX.X1:80
NameVirtualHost XX.XX.XXX.X2:80
NameVirtualHost XX.XX.XXX.X2:443

    <VirtualHost XX.XX.XXX.X1:80>
    ServerName domain1.com
    ServerAlias .*
    WSGIScriptAlias / /home/domain1/domain1.wsgi 
    </VirtualHost>

<VirtualHost XX.XX.XXX.X2:80>
        ServerName domain2.me
    DocumentRoot /var/www/domain2
</VirtualHost>

 <VirtualHost XX.XX.XXX.X2:443>

ServerName www.domain2.me

DocumentRoot /var/www/domain2
ServerAdmin [email protected]

SSLEngine ON

SSLCertificateFile /etc/apache2/ssl/domain2.me.ssl/domain2.me.crt

SSLCertificateKeyFile /etc/apache2/ssl/domain2.me.ssl/domain2.me.key

SSLCACertificateFile /etc/apache2/ssl/domain2.me.ssl/gd_bundle.crt

</VirtualHost>   

Hope something obviously wrong jumps out. Here are links to two gists with other configs I've tried. the first just tries to use the snakeoil cert that comes with apache:

Snakeoil Cert

Another failed attempt similar to the one posted here

Basically what happens is that I get a "Page not available" when I pull up https://www.domain2.me.

Thanks in advance.

UPDATE: The issue was iptables not configured to accept traffic on port 443. I am accepting EightBitTony's answer since his config worked perfectly once I fixed my iptables.

Answer 1

This setup works for me (and it's the default Debian stuff, almost no changes).

In ports.conf

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

That matches yours.

Then, for each of my virtual hosts (non-SSL),

<VirtualHost *:80>

        ServerName domain.example:80
        DocumentRoot "/some/path/to/html"
        UseCanonicalName Off
        <Directory "/some/path/to/html">
            ... stuff ....
        </Directory>

</VirtualHost>

and SSL

<VirtualHost *:443>

        ServerName ssl-domain.example:443
        UseCanonicalName Off
        DocumentRoot "/some/path/to/ssl-html"

        <Directory "/some/path/to/ssl-html">
           ... stuff ...
        </Directory>

        SSLEngine on
        SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

</VirtualHost>

I think you should use UseCanonicalName Off so that the server generates URL's based on details passed by the client, so it gets the right port and name. Full details here.

Finally, you need to make sure the relevant SSL module is enabled, which I think in your case it is (but this is here for completeness).

Update: As well as listening on the right ports, you also need to ensure iptables isn't blocking or dropping SSL traffic on port 443.