2

EDIT : Problem solved, it was indeed the firewall of the server wich was blocking port 443. Everything is working now

I'm trying to install a self-signed SSL certificate on an apache server running on ubuntu. I allowed the SSL module, edited the default-ssl.conf and put the same IP address as ServerName that i put as CommonName when creating the self-signed certificate. I edited the location of the .crt and .key file in the file. Then I enabled the default-ssl.conf file and restarted apache.

I checked 5 times each steps so i'm pretty sure i didn't make a mistake.

When i try to access https://ip_address it doesn't load. I checked that the 443 port was open. Is there a way to see where the problem is located? I just don't know what to try next. I'm accessing the server via ssh.

here's my current default-ssl.conf :

<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerAdmin admin-server@amatiscontrols.com
        ServerName 54.82.28.171:443

        DocumentRoot /var/www
        <Directory />
                Options FollowSymLinksAllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

        Alias /doc/ "/usr/share/doc/"
        <Directory "/usr/share/doc/">
                Options Indexes MultiViews FollowSymLinks
                AllowOverride None
                Order deny,allow
                Deny from all
                Allow from 127.0.0.0/255.0.0.0 ::1/128
        </Directory>

        #   SSL Engine Switch:
        #   Enable/Disable SSL for this virtual host.
        SSLEngine on

        #   A self-signed (snakeoil) certificate can be created by installing
        #   the ssl-cert package. See
        #   /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
        #   If both key and certificate are stored in the same file, only the
        #   SSLCertificateFile directive is needed.
        SSLCertificateFile    /etc/apache2/ssl/apache.crt
        SSLCertificateKeyFile /etc/apache2/ssl/apache.key

my ports.conf :

NameVirtualHost *:80
NameVirtualHost *:443
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    ErrorLog /var/log/apache2/ssl_access.log
    LogLevel debug
        Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

i also edited /etc/hosts and /etc/hostname and added the ip address

I looked in /var/log/apache2/error.log, there are two lines that may indicate an issue :

RSA server certificate is a CA certificate
RSA server certificate CommonName (CN) `54.82.28.171' does NOT match server name!?

i'm really struggling to find what the issue is. i'm sure it's something stupid but i don't see what!

EDIT :

I was just trying openssl s_client -connect 54.82.28.171:443 i got :

connect: Connection timed out
connect:errno=110

I think it means that the connection is refused, meaning port 443 isn't open? When i said not loading i meant that the browser said "web page inaccessible". when i'm trying to access the same page without https my index.html page is loading

Otherwise theouput of apache2ctl -S :

/usr/sbin/apache2ctl: 87: ulimit: error setting limit (Operation not permitted)
VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
*:443                  is a NameVirtualHost
         default server 54.82.28.171 (/etc/apache2/sites-enabled/default-ssl:3)
         port 443 namevhost 54.82.28.171 (/etc/apache2/sites-enabled/default-ssl:3)
*:80                   is a NameVirtualHost
         default server dash.amatiscontrols.com (/etc/apache2/sites-enabled/000-default:1)
         port 80 namevhost dash.amatiscontrols.com (/etc/apache2/sites-enabled/000-default:1)
         port 80 namevhost amatisdash.com (/etc/apache2/sites-enabled/amatisdash.com:1)
Syntax OK

EDIT : There is a firewall on the server... without 443 open, so it should explains everything. Except i can open theport myself and will have to wait to be sure. Anyway thank you!

Thank you

  • Can you post the output of apache2ctl -S to show the sites your server is listening on? – Christopher Karel Jul 23 '14 at 20:39
  • 2
    Is it possible you have a firewall on this server, or in between you and the server? It certainly looks like the port isn't open, but your apache config seems to indicate otherwise. sudo netstat -lnp | grep 443 would definitely prove you're listening on that port, but doesn't help with the firewall stuff. – Christopher Karel Jul 23 '14 at 21:19
3

Might be helpful to break down what is actually happening when the SSL attempt is made. Time to break out openssl!

Take a look at the following man page for openssl: https://www.openssl.org/docs/apps/s_client.html

Specifically look at the reference provided in the Notes section (just scroll on down). As it states you can try the following:

openssl s_client -connect servername:443

This may provide you with further information on what is failing.

As for the error log entries - the first line is curious... I wonder if perhaps the cert usage is not quite correct... The second line is more common looking, although typically that is caused by connecting based on IP when the cert is issued to an FQDN... I'd start with the openssl connection tests and seeing if you can gather more info.

Last but not least though... you said the page does not load, are you getting an error or is it just displaying a blank page? Just making sure that you are actually presenting something on the page :)

2

ServerName 54.82.28.171:443 is not a valid server name because it is an IP-address and Port and not a fully qualified domain name, it should be something like ServerName www.example.com.

Second your ServerName should be identical to the common name in the SSL certificate, regardless of the fact that your using an IP-address 54.82.28.171:443 != 54.82.28.171 .

The third is the error message which seems to be that your public certificate is not a self signed certificate at all, but a CA certificate. That might be because the common name is not a FQDN but an IP-address , I'm not sure.
You can convert your current certificate /etc/apache2/ssl/apache.crt from the PEM encoding it should be to something a bit more legible with:

openssl x509 -in apache.crt -noout -text

A result that includes something like:

        X509v3 Basic Constraints: 
            CA:TRUE

is a likely reason that Aapche considers the certificate a CA certificate, which is not necessarily wrong with a self signed certificate IIRC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.