0

I have a Google Compute instance (Debian 8 and Apache) running using Google Compute protocol forwarding to be able to use multiple external IP addresses with one virtual machine instance:

Google Compute Protocol Forwarding (full article)

Google Compute Engine supports Protocol Forwarding, which lets you create forwarding rule objects that can send packets to a non-NAT’ed target instance. Each target instance contains a single virtual machine instance that receives and handles traffic from the corresponding forwarding rules.

The Problem

I am not able to visit one of the virtual host domains/IP's over port 443. I need this, because I want to enable HTTPS on all these domains.

I have tried multiple options to achieve opening port 443, but none of them works:

Option 1) Virtual name-based hosts:

/etc/apache2/ports.conf

Listen 80

<IfModule ssl_module>
    NameVirtualHost *:443
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    NameVirtualHost *:443
    Listen 443
</IfModule>

/etc/apache2/sites-enabled/example.com.conf

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/website1
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/website1
</VirtualHost>

Option 2) Virtual IP-based hosts:

/etc/apache2/ports.conf

Listen 80

<IfModule ssl_module>
    NameVirtualHost *:443
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    NameVirtualHost *:443
    Listen 443
</IfModule>

<VirtualHost 192.0.2.5>
 DocumentRoot /var/www/website1
 <Directory /var/www/website1>
  Require all granted
 </Directory>
</VirtualHost>

...

Both options work for port 80, but not for port 443.

1

In ports.conf you need

Listen 443

and in /etc/apache2/sites-enabled/example.com.conf you need:

SSLEngine On
SSLCertificateFile      /path/to/file.pem
SSLCertificateKeyFile /path/to/file.key

where file.pem and file.key are certificate and key

  • I have tried Listen 443 already and the problem is that I generate the certificates with Certbot (certbot.eff.org), but when I try to install them, Certbot gives me an error message: "Failed to connect to 192.0.2.5:433". So it is not able to use port 433 to install the certificates. This is a almost paradox right? – Robbert Oct 28 '16 at 11:36
  • Did you do SSLengin on on virtual host. Also run netstat -tnlp | grep 443 until you see something here you won't be able to connect. – Anirudh Malhotra Oct 28 '16 at 11:43
  • Okay, with the SSLengin on without the SSLCertificateFile and SSLCertificateKeyFile . I get at least no results by using netstat -tnlp | grep 443, so that's one step further! Thanks – Robbert Oct 28 '16 at 11:55
  • No you have to have output of netstat -tnlp | grep 443 as something like tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 2341/apache2 also please use sslcertificate and keyfile. – Anirudh Malhotra Oct 28 '16 at 12:03
  • Ok, without SSLEngine on the output of netstat -tnlp | grep 443 is tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 18697/apache2 – Robbert Oct 28 '16 at 12:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.