5

I have set up a ubuntu (14.04.2) apache2 (2.4.7) server for SSL, but the certificate doesnt seem to be found. Ubuntu is running on an EC2 instance with static IP, enabled 443 port and domain name theaudioserver.com with DNS record to that static IP. Here is how I set up my server:

  • Created key: openssl genrsa 2048 > privatekey.pem
  • Generated certificate request: openssl req -new -key privatekey.pem -out csr.pem
  • bought a CA SSL certificate with the csr and saved keys to server.crt and server_bundle.crt
  • added ssl.conf file in /etc/apache2/sites-available, which is configured for SSL:
    SSLStaplingCache shmcb:/tmp/stapling_cache(128000) <VirtualHost *:443>
    SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH SSLProtocol All -SSLv2 -SSLv3 SSLHonorCipherOrder On Header always set
    Strict-Transport-Security "max-age=63072000; includeSubdomains;
    preload" Header always set X-Frame-Options DENY Header always set
    X-Content-Type-Options nosniff
    SSLCompression off SSLUseStapling on
    ServerName theaudioserver.com
    SSLEngine on
    SSLCertificateFile /home/ubuntu/certs/server.crt
    SSLCertificateKeyFile /home/ubuntu/certs/privatekey.pem
    SSLCertificateChainFile /home/ubuntu/certs/server_bundle.crt

    DocumentRoot /var/www/html/
</VirtualHost>
  • added SSL with sudo a2enmod ssl
  • restarted apache2 successfully (without any error in the log)
  • I also checked if apache2 is listening to 443 and it seems to listen correclty: sudo netstat -anp | grep apache gives: tcp6 0 0 :::443 :::* LISTEN 3138/apache2

But when I test my domain, the certificate doesn't seem to be found.

On ssllabs.com, I get No SSL certificates were found on theaudioserver.com. Make sure that the name resolves to the correct server and that the SSL port (default is 443) is open on your server's firewall.

When accessing the server via https://52.24.39.220, I get a name mismatch error since I am not accessing via the domain name, but this shows that the server firewall on EC2 seems to be set up correctly.

What am I doing wrong here?

  • I for one can't even establish a remote connection to theaudioserver.com on port 443 to that is the first place to start looking (maybe after you verify from your own server that something is indeed listening to port 443 e.g. with openssl s_client -connect theaudioserver.com:443 ) – HBruijn Dec 27 '15 at 9:20
  • thanks, it seems apache2 is listening to 443 correctly, see my edit in the question. any other ideas? – user2212461 Dec 27 '15 at 10:17
  • cipherli.st – Michael Hampton Dec 27 '15 at 10:20
  • @MichaelHampton I added the config parameters from cipherli.st (see my edit in the question), it didn't solve the problem. Any other ideas? – user2212461 Dec 27 '15 at 11:18
  • connect: Connection refused – Saravanan Nandhan Nov 16 '17 at 13:41
2

I am not getting any connection at all to your server on port 443 it feels like a firewall issue. Have you opened port 443 in you EC2 security group firewall. Have you opened it in your host's firewall ?


Update;

Your DNS is setup incorrectly

dig +short theaudioserver.com
52.25.39.220

Whereas you say you can connect via 52.24.39.220.

| improve this answer | |
  • see my edit, when I access the server via h t t p s : / / I P , i can access it, so the firewall on EC2 seems to be set up correctly. any other ideas? – user2212461 Dec 27 '15 at 20:37
0

Use a .htaccess file in your website's root directory to redirect requests coming in on the non-secure port to the secure port i.e. http:// -> https://

The file should contain something like this:

RewriteEngine on
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]

You'll need to edit default in sites-available to contain:

DocumentRoot /var/www/html
<Directory />
    Options FollowSymLinks
    AllowOverride All
</Directory>
<Directory /var/www/html>
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Order allow,deny
    allow from all
</Directory>

This allows .htaccess to work on that directory and all contained directories, hence your whole site.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.