EC2 - httpd service not running with 443 vhosts after installing mod_ssl

Question

I'm experiencing issues with the configuration of mod_ssl on an AWS EC2 instance

It appears I'm at some point where I cannot run httpd service via sudo service httpd restart since I installed the mod24_ssl. I've got no Syntax errors, just a FAILED response when I try to restart httpd :

[ec2]$ sudo service httpd restart
Stopping httpd:    [FAILED]
Starting httpd:    [FAILED]

And I noticed that when I remove the configurations with 443 vhosts in my custom .conf file and in the ssl.conf file everything runs fine

I already verified that I had the localhost.crt and localhost.key that are specified by default in ssl.conf

Before I installed the mod24_ssl package, those vhosts were working fine, I only got errors like "SSL received a record that exceeded the maximum permissible length", wich could be fixed by installing mod_ssl according to several topics I found

I'm trying to have a working SSL configuration to be able to access local addresses over https, doesn't matter if it really works with well signed certificates.

Answer 1

As requested, here are my conf files for apache :

/etc/httpd/conf/httpd.conf (auto generated by AWS services)

ServerRoot "/etc/httpd"

Listen 80

Include conf.modules.d/*.conf

User apache
Group apache

ServerAdmin root@localhost

<Directory />
    AllowOverride none
    Require all denied
</Directory>

DocumentRoot "/var/www/html"

<Directory "/var/www">
    AllowOverride None
    Require all granted
</Directory>

<Directory "/var/www/html">
    Options Indexes FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

<IfModule dir_module>
    DirectoryIndex index.html
</IfModule>

<Files ".ht*">
    Require all denied
</Files>

ErrorLog "logs/error_log"

LogLevel warn

<IfModule log_config_module>
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    <IfModule logio_module>
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>

    CustomLog "logs/access_log" combined
</IfModule>

<IfModule alias_module>
    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>

<IfModule mime_module>
    TypesConfig /etc/mime.types

    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz

    AddType text/html .shtml
    AddOutputFilter INCLUDES .shtml
</IfModule>

AddDefaultCharset UTF-8

<IfModule mime_magic_module>
    MIMEMagicFile conf/magic
</IfModule>

EnableSendfile on

IncludeOptional conf.d/*.conf

/etc/httpd/conf.modules.d/00-ssl.conf (created by installing mod24_ssl package)

LoadModule ssl_module modules/mod_ssl.so

/etc/httpd/conf.d/ssl.conf (created by installing mod24_ssl package)

Listen 443 https

SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog

SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
#SSLRandomSeed startup file:/dev/random  512
#SSLRandomSeed connect file:/dev/random  512
#SSLRandomSeed connect file:/dev/urandom 512

SSLCryptoDevice builtin
#SSLCryptoDevice ubsec

<VirtualHost _default_:443>

    ErrorLog logs/ssl_error_log
    TransferLog logs/ssl_access_log
    LogLevel warn

    SSLEngine on
    SSLProtocol all -SSLv3
    SSLProxyProtocol all -SSLv3
    SSLHonorCipherOrder on
    #SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
    #SSLProxyCipherSuite HIGH:MEDIUM:!aNULL:!MD5
    SSLCertificateFile /etc/pki/tls/certs/localhost.crt
    SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
    #SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
    #SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
    #SSLVerifyClient require
    #SSLVerifyDepth  10
    #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory "/var/www/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>

    BrowserMatch "MSIE [2-5]" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0

    CustomLog logs/ssl_request_log \
              "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

---

With this conf httpd service won't start, but if I remove the <VirtualHost _default_:443> part, it starts perfectly.

---

And finaly I watched my log file /var/log/httpd/error_log and the only thing appearing when I try to start the httpd service is :

AH00016: Configuration Failed

With no more informations

Thx for your help !

Answer 2

I just found another log file that provide more informations apparently :

[Wed Jun 12 08:31:42.263711 2019] [ssl:emerg] [pid 16968] AH02565: Certificate and private key ip-xx-xx-xx-xx.eu-west-3.compute.internal:443:0 from /etc/pki/tls/certs/localhost.crt and /etc/pki/tls/private/localhost.key do not match

Answer 3

I finally solved my problem !

Thx to the log error message, I found a solution to generate a valid certificate, with this command :

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/pki/tls/private/localhost.key -out /etc/ssl/certs/localhost.crt

---

Originaly I was following this article to set up SSL on my EC2 instance : https://docs.aws.amazon.com/fr_fr/AWSEC2/latest/UserGuide/SSL-on-amazon-linux-2.html

In this article, the step to create the certificate tells to use the following commands :

cd /etc/pki/tls/certs
sudo make-dummy-cert localhost.crt

But it seems it's not working (anymore at least)

Thx again for your help, I was so frustrated yesterday I totally forgot to simply consult the logs...