On my production server SSL has stopped working. Everything redirects to http:// from https://

The server is a virtual EC2 instance running in AWS. It's their image running CENTOS and PHP5.3, connecting to mysql.

Previously SSL was working perfectly, leading me to believe my CERT files and httpd.conf file is correct.


I've eliminated the other error log messages and discovered another two that seem relevant. From SSL_ERROR_LOG
[Wed Feb 20 04:01:02 2013] [warn] RSA server certificate CommonName (CN) ip-10-204-201-62 does NOT match server name!?
From apache ERROR_LOG
[Tue Feb 19 16:01:02 2013] [notice] SSL FIPS mode disabled

Below is my httpd.conf entries:
<VirtualHost *:80>
ServerAdmin account@domain.com
DocumentRoot /var/www/html/domain-com
ServerName www.domain.com

NameVirtualHost *:443

<VirtualHost *:443>
ServerName www.domain.com
DocumentRoot /var/www/html/domain-com
SSLCertificatekeyFile /etc/httpd/keys/private.key
SSLCertificateFile /etc/httpd/crts/public.crt
SSLCertificateChainFile /etc/httpd/crts/intermediate.crt

There is an error in my apache logs:
[Tue Feb 19 16:01:02 2013] [notice] Digest: generating secret for digest authentication ...
[Tue Feb 19 16:01:02 2013] [notice] Digest: done
PHP Warning: PHP Startup: Unable to load dynamic library '/usr/lib64/php/modules/pdo_dblib.so' - /usr/lib64/php/modules/pdo_dblib.so: undefined symbol: php_pdo_register_driver in Unknown on line 0
[Tue Feb 19 16:01:02 2013] [notice] SSL FIPS mode disabled
[Tue Feb 19 16:01:02 2013] [notice] Apache/2.2.23 (Unix) DAV/2 PHP/5.3.20 mod_ssl/2.2.23 OpenSSL/1.0.0j-fips configured -- resuming normal operations

Googling shows that this error is often caused by version mismatches.
$ php -v
PHP 5.3.20 (cli) (built: Jan 2 2013 18:43:35) Copyright (c) 1997-2012 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2012 Zend Technologies
with the ionCube PHP Loader v4.2.1, Copyright (c) 2002-2012, by ionCube Ltd., and
with Xdebug v2.2.1, Copyright (c) 2002-2012, by Derick Rethans

Unfortunately I don't have the experience to determine exactly which version of which package might be mismatched if that is, in fact, the issue.

  • 2
    How did you install PHP and the DBLIB module? If from RPMs, which repositories? – mgorven Feb 19 '13 at 16:31
  • I use yum to install all packages. e.g. sudo yum install php, etc. hth. – tedneigerux Feb 19 '13 at 16:35
  • Since things have stopped working, assuming that CERT files and esp. httpd.conf is correct is not a good idea. Something must have changed to cause things to stop working. SSL.conf and httpd.conf configuration lines are required to help with answering the question. – Saurabh Barjatiya Feb 20 '13 at 5:09

Your <VirtualHost> entries don't contain any redirects, so the redirect must be originating elsewhere. Check the web application and configure it appropriately. Also check any other parts of your setup, such as a load balancer or reverse proxy which you forgot to mention.

(The fact that PHP is unable to load a module isn't relevant to the redirection problem.)

  • Nothing of the above was unmentioned. Here is the redirect code: // rewrite base URL to SSL if accessed via SSL if ($_SERVER["SERVER_PORT"] == "443" or (isset($_SERVER['https']) and $_SERVER['HTTPS'] == 'on')) { $config['base_url'] = str_replace('http://','https://',$config['base_url']); } – tedneigerux Feb 20 '13 at 23:56
  • I'm starting to agree it's an application, and not server, issue. I created a new EC2 instance with just apache loaded and with a simple index.html. I then loaded apache similarly*. I pointed the prod domain to it. I then manually browsed to it with forcing https:// (prepending it to the URL). The cert validated perfectly. – tedneigerux Feb 21 '13 at 1:15
  • Additionally I set $_SERVER['HTTPS'] == 'off' and now it goes to http as expected. However, if I then edit the url to https the SSL again loads fine and validates. Heavily leaning towards it being application related. – tedneigerux Feb 21 '13 at 3:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.