0

I have a page to load as https://218.251.240.118:8080/login ... but I am getting ssl connection error. Below are the configuration file details :

apache httpd.conf file (since the file was big I am posting only uncommented lines)

ServerRoot "/usr/local/apache22-publisher"
Listen 80
User apache
Group apache
</IfModule>
</IfModule>
ServerAdmin you@example.com
ServerName pro-pcrawler101d:80
DocumentRoot "/usr/local/apache22-publisher/htdocs"

<Directory />
Options FollowSymLinks
AllowOverride None
Order deny,allow
Deny from all
</Directory>


<Directory "/data/publisher_files">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all

</Directory>

<IfModule dir_module>
DirectoryIndex index.html
</IfModule>

Alias /icons/ "/data/icons/"

<Directory "/data/icons">
Options Indexes MultiViews
AllowOverride None
Order allow,deny
Allow from all
</Directory>

ScriptAlias /cgi-bin/ "/data/cgi-bin/"
<Directory "/data/cgi-bin">
AllowOverride None
Options None
Order allow,deny
Allow from all
</Directory>

Alias /error/ "/data/error/"

<IfModule mod_negotiation.c>
<IfModule mod_include.c>
<Directory "/data/error">
AllowOverride None
Options IncludesNoExec
AddOutputFilter Includes html
AddHandler type-map var
Order allow,deny
Allow from all
LanguagePriority en es de fr
ForceLanguagePriority Prefer Fallback
</Directory>

<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all

</Directory>

DirectoryIndex index.html index.html.var

ServerSignature Off
<FilesMatch "^\.ht">
Order allow,deny
Deny from all
Satisfy All
</FilesMatch>
Alias /publisher /data/publisher_files
Alias /rcr /data/publisher_files
Include conf/extra/httpd-ssl.conf

<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>

here is my httpd-ssl.conf file (since the file was big I am posting only uncommented lines):

Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl 
SSLPassPhraseDialog builtin
SSLSessionCache "shmcb:/usr/local/apache22-      publisher/logs/ssl_scache(512000)"
SSLSessionCacheTimeout 300
SSLMutex "file:/usr/local/apache22-publisher/logs/ssl_mutex"
<VirtualHost _default_:443>
DocumentRoot "/data/publisher_files"

ServerName pro-pcrawler101zd:443
ServerAdmin you@example.com
ErrorLog "/usr/local/apache22-publisher/logs/error_log"
TransferLog "/usr/local/apache22-publisher/logs/access_log"

SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
SSLCertificateFile "/usr/local/apache22-publisher/conf/server.crt"
SSLCertificateKeyFile "/usr/local/apache22-publisher/conf/server.key"
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "/usr/local/apache22-publisher/cgi-bin">
SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog "/usr/local/apache22-publisher/logs/ssl_request_log" \
"t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x "%r" %b"

ProxyPass /rcr ajp://127.0.0.1:8009/rcr
ProxyPassReverse /rcr ajp://127.0.0.1:8009/rcr

</VirtualHost>

Tried restarting tomcat and httpd service, no changes.tomcat and httpd are running and listening on respective ports.Any help would be greatly appreciated.Thanks.

  • I see a few issues (but it could just be your extracted sections), in your http.conf, your ifmodule sections appear unbalanced. – Progrock Dec 4 '15 at 8:51
  • How are you mapping your port 8080 to internal 443? Can you connect locally? Have you checked the logs? – Progrock Dec 4 '15 at 8:51
  • Hi progrock, there is nothing in the logs. I dont know how 8080 is getting mapped, tomcat is something new for me. – Negi Anurag Dec 7 '15 at 2:45
  • this is what im getting internally [ ~]# wget 10.40.5.32:8080/login --2015-12-07 11:48:04-- 10.40.5.32:8080/login Connecting to 10.40.5.32:8080... connected. Unable to establish SSL connection. – Negi Anurag Dec 7 '15 at 2:48
0

What SSL connection error are you getting?

Things to check:

  • Is you TLS/SSL cert signed by a CA that you trust in the browser that you are trying to pull it up on?
  • Does the cert have the ip address as the cn or a subjectAltName?
  • I don't see a CA bundle. Do you have a cert bundle that has all the intermediate/CA certs that are needed for your cert?
|improve this answer|||||
  • please lemme know how can I check these things – Negi Anurag Dec 7 '15 at 2:46
  • this is what im getting internally [ ~]# wget 10.40.5.32:8080/login --2015-12-07 11:48:04-- 10.40.5.32:8080/login Connecting to 10.40.5.32:8080... connected. Unable to establish SSL connection. – – Negi Anurag Dec 7 '15 at 2:49
  • openssl verify /etc/pki/tls/cert.pem /etc/pki/tls/cert.pem: /C=US/O=RSA Data Security, Inc./OU=Secure Server Certification Authority error 10 at 0 depth lookup:certificate has expired OK – Negi Anurag Dec 7 '15 at 4:19
  • So you found that it was expired? – Wren T. Dec 7 '15 at 23:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.