1

I have a server running Ubuntu 18.04 with .NET Core 2.1, Kestrel and Apache2. I am using LetsEncrypt for SSL and the domain was set up with SSL. Prior to installing .NET Core and hosting the project on this site, it was a static index.html site. After following this guide: https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-apache?view=aspnetcore-2.2, I've been unable to get the domain to redirect to the Kestrel service that's been configured. I can access it just fine on the server.

Apache error.log:

[Sat Apr 20 02:08:12.950750 2019] [ssl:warn] [pid 7473] AH01909: ct.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Apr 20 02:08:13.001939 2019] [ssl:warn] [pid 7474] AH01909: ct.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Apr 20 02:08:13.007430 2019] [mpm_prefork:notice] [pid 7474] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g configured -- resuming normal operations
[Sat Apr 20 02:08:13.007467 2019] [core:notice] [pid 7474] AH00094: Command line: '/usr/sbin/apache2'
[Sat Apr 20 02:08:18.723565 2019] [autoindex:error] [pid 7483] [client 50.88.218.180:10635] AH01276: Cannot serve directory /var/www/ct.com/public_html/ps/publish/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive

virtual host config - ct.com.conf:

<VirtualHost *:*>
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
</VirtualHost>

<VirtualHost *:80>
ServerAdmin webmaster@localhost
ServerName ct.com
ServerAlias www.ct.com

ProxyPreserveHost On
ProxyPass / http://127.0.0.1:5000/
ProxyPassReverse / http://127.0.0.1:5000/

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =ct.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

LetsEncrypt config:

/etc/apache2/sites-available# cat ct.com-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerAdmin webmaster@localhost
        ServerName ct.com
        ServerAlias www.ct.com
        DocumentRoot /var/www/ct.com/public_html/ps/publish

        <Directory /var/www/ct.com/public_html/ps/publish>
            AllowOverride All
            Require all granted
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.

# RewriteCond %{SERVER_NAME} =ct.com
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/www.ct.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.ct.com/privkey.pem
</VirtualHost>
</IfModule>

Recently removed Indexes from the Apache2.conf:

<Directory /var/www/>
    Options FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

Does anyone see anything wrong of why my server won't serve any requests to my currently running site over SSL? I have other websites that work fine over SSL.

Update 4/23: Here is the access.log when I try to hit the endpoint using Postman: xx.xxx.xx.xx - - [23/Apr/2019:18:24:12 +0000] "GET /api/Main/TestCall HTTP/1.1" 404 3805 "-" "PostmanRuntime/7.6.1"

Update 4/23 (2):

Apache access.log shows the same error as above. Apache error.log is as follows:

[Wed Apr 24 00:13:25.017062 2019] [ssl:warn] [pid 4117] AH01909: localhost:443:0 server certificate does NOT include an ID whic matches the server name
[Wed Apr 24 00:13:25.022627 2019] [mpm_prefork:notice] [pid 4117] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g configured -- resuming normal operations

New ct.com.conf 4/24:

<VirtualHost *:*>
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
</VirtualHost>

<VirtualHost *:80>
ServerAdmin webmaster@localhost
ServerName ct.com
ServerAlias www.ct.com
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]


ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
LogLevel debug
</VirtualHost>

<VirtualHost *:443>
ServerAdmin webmaster@localhost
ServerName ct.com
ServerAlias www.ct.com

ProxyPreserveHost On
ProxyPass / http://127.0.0.1:5123/
ProxyPassReverse / http://127.0.0.1:5123/

SSLEngine On
SSLProtocol all -SSLv2

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
LogLevel debug
#RewriteEngine on
#RewriteCond %{SERVER_NAME} =ct.com
#RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,R=permanent]
#RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:!RC4+RSA:+HIGH:+MEDIUM:!LOW:!RC4
SSLCertificateFile /etc/letsencrypt/live/www.ct.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.ct.com/privkey.pem
</VirtualHost>

Error.log with debug level

tail -f /var/log/apache2/error.log
[Wed Apr 24 16:01:15.260207 2019] [mpm_prefork:notice] [pid 19201] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g configured -- resuming normal operations
[Wed Apr 24 16:01:15.260232 2019] [core:notice] [pid 19201] AH00094: Command line: '/usr/sbin/apache2'
[Wed Apr 24 16:01:45.298236 2019] [proxy:debug] [pid 19233] proxy_util.c(1785): AH00925: initializing worker http://127.0.0.1:5123/ shared
[Wed Apr 24 16:01:45.299302 2019] [proxy:debug] [pid 19233] proxy_util.c(1827): AH00927: initializing worker http://127.0.0.1:5123/ local
[Wed Apr 24 16:01:45.299451 2019] [proxy:debug] [pid 19233] proxy_util.c(1878): AH00931: initialized single connection worker in child 19233 for (127.0.0.1)
[Wed Apr 24 16:01:58.912849 2019] [autoindex:error] [pid 19211] [client 50.88.218.180:28627] AH01276: Cannot serve directory /var/www/ct.com/public_html/ps/publish/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Wed Apr 24 16:01:59.408882 2019] [autoindex:error] [pid 19211] [client 50.88.218.180:28627] AH01276: Cannot serve directory /var/www/ct.com/public_html/ps/publish/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Wed Apr 24 16:02:05.322145 2019] [proxy:debug] [pid 19245] proxy_util.c(1785): AH00925: initializing worker http://127.0.0.1:5123/ shared
[Wed Apr 24 16:02:05.324374 2019] [proxy:debug] [pid 19245] proxy_util.c(1827): AH00927: initializing worker http://127.0.0.1:5123/ local
[Wed Apr 24 16:02:05.324607 2019] [proxy:debug] [pid 19245] proxy_util.c(1878): AH00931: initialized single connection worker in child 19245 for (127.0.0.1)
  • It doesn't seem that my reverse proxy is directing traffic to the kestrel server. Then again, I'm not sure based on the logs above. Is more info needed? I'm really not certain what to do from here. – joshdeco Apr 20 at 19:09
0

You copied the wrong example. Your ProxyPass is defined in your non-SSL <VirtualHost *:80> which redirects to https.

Move the proxy stuff to your <VirtualHost *:443>. See the SSL example in the Microsoft guide.

Also change your RewriteRule and remove the NE flag. I guess you don't need it here.
Or use the rule from the SSL example:

RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

And there's something wrong with the certificate...

  • After modifying the ct.com-le-ssl.conf file, I was able to get this working. I'm going to mark your question as the answer for all of your help today. It was much appreciated. I'd upvote, but my reputation isn't high enough. – joshdeco Apr 24 at 23:20
  • Nice you got it working! – Freddy Apr 25 at 0:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.