1

Conclusion: I believe I mismatched openssl version when I had compiled apache. It works now; and I recompiled it with openssl which is already installed. Thank you for your help, Unbeliever.

Additional Information: I figured out another related settings from server.xml in tomcat connector. So, when domain is wrong, tomcat handle every parts, and domain is not wrong, tomcat and apache handle simultaneously and it could be a problem with different version of openssl.

...or not.


The question is quite weird I know, but I cannot imagine there is a difference.


Basic Information:

Server is correctly working in http:// connection. (domain: test.domain.com) (Apache 2.2.31 (compiled with openssl 1.0.1u), Tomcat (6.0.35, already installed before)

I already have *.domain.com Certification for https:// connection, and I used it already in 'service.domain.com', so "https:// service.domain.com" is working in other server/machine/IP

And finally, I tried to install SSL to " test.domain.com " to allow https:// connection.


Problem:

And I found..

If I set '.conf' wrong,

#Wrong.conf
<VirtualHost *:443>
    ServerName testy.domain.com #whatever, but not 'test.domain.com' 
    ....
</VirtualHost *:443>

is working when I connect https:// test.domain.com. (and it will use default VirtualHost; There is only one *:443, and when I've removed that virtual host, I got error and I couldn't connect.) There is no problem, and I get perfect connection and certification, and I can read the webpage what I want.

However, If I set '.conf' "correctly"

#Correct.conf
<VirtualHost *:443>
    ServerName test.domain.com
    ...
</VirtualHost *:443>

and I CANNOT connect https:// test.domain.com.

Detailed information when I checked with other tools, like curl -verbose,

when I use curl with #Wrong.conf

* TLSv1.2 (OUT), TLS handshake, Client hello (1)
* TLSv1.2 (IN), TLS handshake, Server hello (2)
* TLSv1.2 (IN), TLS handshake, Certificate ....
....
(and succeed)

and when I use curl with #Correct.conf

* TLSv1.2 (OUT), TLS handshake, Client hello (1)
* Unknown SSL protocol error in connection to test.domain.com:443
* Curl_http_done: called premature == 1
0  0  0  0  0  0  0  0  --:--:-- --:--:-- --:--:--  0
* Closing connection 0
curl: (35) Unknown SSL protocol error in connection to test.domain.com:443

Other parts, like "IP", "TCP_NODELAY", even Cipher selection and CAfile are exactly same (double checked, and I haven't changed)


So, back to the first question,

Is there any difference between using "Default Virtual Host" and "Correctly Named Virtual Host"?

And any suggestion?


Update:

I'm sorry for your inconvenience.

When it works; Wrong.conf apachectl -S shows...

VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
*:80     is a NameVirtualHost
    default server what.test.domain.com (/holy/apache/conf/httpd.conf:573)
    port 80 namevhost what.test.domain.com (/holy/apache/conf/httpd.conf:573)
    port 80 namevhost whatever.test.domain.com (/holy/apache/conf/httpd.conf:580)
    ...
    port 80 namvevhost test.domain.com (/holy/apache/conf/httpd.conf:615)
*:443    is a NameVirtualHost
    default server testy.domain.com (/holy/apache/conf/httpd.conf:541)
    port 443 namevhost testy.domain.com (/holy/apache/conf/httpd.conf:541) 
Syntax OK

When it doesn't work; Correct.conf apachectl -S shows...

VirtualHost configuration:
wildcard NameVirtualHosts and _default_ servers:
*:80     is a NameVirtualHost
    default server what.test.domain.com (/holy/apache/conf/httpd.conf:573)
    port 80 namevhost what.test.domain.com (/holy/apache/conf/httpd.conf:573)
    port 80 namevhost whatever.test.domain.com (/holy/apache/conf/httpd.conf:580)
    ...
    port 80 namvevhost test.domain.com (/holy/apache/conf/httpd.conf:615)
*:443    is a NameVirtualHost
    default server test.domain.com (/holy/apache/conf/httpd.conf:541)
    port 443 namevhost test.domain.com (/holy/apache/conf/httpd.conf:541) 
Syntax OK

I didn't make two .conf for this, but I just changed ServerName with my hand (so there is no difference in other area.)


Update: Logs

Sorry for late. Finally I got some differences for this problem. Thank you, Unbeliever.

In the 'working-scenario', I can see what I have imagine

[debug] ssl_engine_kernel.c(1961): [client (**My IP**)] No matching SSL virtual host for servername test.domain.com found (using default/first virtual host)
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 read client hello A
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 write server hello A
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 write change cipher spec A
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 write finished A
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 flush data

...

[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 read finished A
[debug] ssl_engine_kernel.c(1838): OpenSSL: Handshake: done
[info] Connection: Client IP: (**My IP**), Protocol: TLSv1.2, Cipher: ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)

But I found quite suspicious parts in 'not-working-scenario'.

1) Start with double handshake.

[info] [client (**My IP**)] Connection to child 0 established (server test.domain.com:443)
[info] [client (**My IP**)] Connection to child 1 established (server test.domain.com:443)
[info] Seeding PRNG with 144 bytes of entropy
[info] Seeding PRNG with 144 bytes of entropy
[debug] ssl_engine_kernel.c(1834): OpenSSL: Handshake: start
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: before/accept initialization
[debug] ssl_engine_kernel.c(1834): OpenSSL: Handshake: start
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: before/accept initialization

2) no part of these successful handshaking (this log is from working scenario)

[debug] ssl_engine_kernel.c(1961): [client (**My IP**)] No matching SSL virtual host for servername test.domain.com found (using default/first virtual host)
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 read client hello A
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 write server hello A
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 write change cipher spec A
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 write finished A
[debug] ssl_engine_kernel.c(1842): OpenSSL: Loop: SSLv3 flush data
[info] [client (**My IP**)] Connection to child 4 established (server **testy**.domain.com:443)

3) many Segmentation fault

[notice] child pid 4683 exit signal Segmentation fault (11)
[notice] child pid 4684 exit signal Segmentation fault (11)
[notice] child pid 4685 exit signal Segmentation fault (11)
[notice] child pid 4686 exit signal Segmentation fault (11)
[notice] child pid 4687 exit signal Segmentation fault (11)

4) Proxy log

[debug] proxy_util.c(1901): proxy: grabbed scoreboard slot 0 in child 4727 for worker proxy:reverse
[debug] proxy_util.c(1921): proxy: worker proxy:reverse already initialized
[debug] proxy_util.c(2017): proxy: initialized single connection worker 0 in child 4727 for (*)
[info] [client (**My IP**)] Connection to child 5 established (server test.domain.com:443)
[info] Seeding PRNG with 144 bytes of entropy
[debug] proxy_util.c(1901): proxy: grabbed scoreboard slot 0 in child 4728 for worker proxy:reverse
[debug] proxy_util.c(1921): proxy: worker proxy:reverse already initialized
[debug] proxy_util.c(2017): proxy: initialized single connection worker 0 in child 4728 for (*)
[notice] child pid 4727 exit signal Segmentation fault (11)
[debug] proxy_util.c(1901): proxy: grabbed scoreboard slot 0 in child 4729 for worker proxy:reverse
[debug] proxy_util.c(1921): proxy: worker proxy:reverse already initialized
[debug] proxy_util.c(2017): proxy: initialized single connection worker 0 in child 4729 for (*)
  • 1
    When troubleshooting virtual hosts, always always start with the output of apachectl -S. Please add the output from this command to your post for your two scenarios. – Unbeliever Nov 16 '16 at 11:28
  • OK, thanks for adding the extra output. You only have one SSL vhost, so all HTTPS requests to the IP address of your server will land on that vhost. When it doesn't work what do you get in the Apache error log? – Unbeliever Nov 17 '16 at 8:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.