1

I have ssh access to a server where I want to host my website over https. I am using apache, and so far, the http variant of the site works flawlessly.

It is when trying SSL that things don't work. I cannot load the https site at all. I believe I have narrowed the problem down to the fact that to the outside world, it appears as though port 443 is closed, as can be seen below using nmap.

matthias@outsideworld:~$ nmap domain.com

Starting Nmap 6.47 ( http://nmap.org ) at 2016-03-11 15:13 GMT
Nmap scan report for domain.com (ip.is.here.yes)
Host is up (0.0097s latency).
Not shown: 998 closed ports
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds

But if I run for example nmap on the server itself through ssh, it looks as though 443 is open,

matthias@server:~$ nmap domain.com

Starting Nmap 6.40 ( http://nmap.org ) at 2016-03-11 15:12 GMT
Nmap scan report for domain.com (ip.is.here.yes)
Host is up (0.00036s latency).
rDNS record for ip.is.here.yes: domain.domain.com
Not shown: 997 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
80/tcp  open  http
443/tcp open  https

Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds

More details

It looks like apache is definitely listening on 443,

matthias@server:~$ netstat -ln | grep -E ':80|443'
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN

I wouldn't be asking if I wasn't really stumped. I tried opening the port using iptables, but that didn't seem to do anything either, and ufw is disabled. Here is the current iptables --list, but I did try some other configurations of that too to no avail.

matthias@server:~$ sudo iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere 

Ah and last but not least, here is the mysite.conf file I am using. And fyi this configuration did correctly serve https when used on a local network using a laptop as an access point.

<VirtualHost *:80>
    <If "req('Host') == '127.0.0.1'" >
        Redirect "/" "https://local.domain.com/"
    </If>
    <ElseIf "req('Host') == 'localhost'" >
        Redirect "/" "https://local.domain.com/"
    </ElseIf>
    <ElseIf "req('Host') == 'domain.com'" >
        #Redirect "/" "https://domain.com/"
    </ElseIf>
    <Else>
            Redirect "/" "https://ap.domain.com/"
    </Else>
</VirtualHost>

IncludeOptional path-to/Local/etc/apache2/vhosts/*.conf
#NameVirtualHost *:443 

<VirtualHost *:443>
    ServerAdmin webmaster@domain.com
    <IfModule mod_ssl.c>
        SSLEngine on
        SSLCertificateFile path-to-cert.crt
        SSLCertificateKeyFile path-to-key.key
    </IfModule>     

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
        SSLOptions +StdEnvVars
    </Directory>

    BrowserMatch "MSIE [2-6]" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

    LogLevel info
    ErrorLog path-to/Local/Log/error.log
    CustomLog path-to/Local/Log/access.log combined

</VirtualHost>

<IfModule mpm_worker_module>
    ServerLimit          40
    StartServers          2
    MaxRequestWorkers   1000
    MinSpareThreads      25
    MaxSpareThreads      75 
    ThreadsPerChild      25
    MaxRequestsPerChild   0
</IfModule>

And all the contents of the 'IncludeOptional/*.conf' files you can see in mysite.conf above,

WSGIDaemonProcess ourapp user=matthias group=matthias processes=2 threads=5
WSGIProcessGroup ourapp
WSGIPassAuthorization On

# The WSGI directory
<Directory path-to/Local/WSGI>
    Options Indexes FollowSymLinks Includes ExecCGI
    AllowOverride All
    Require all granted
    Allow from all
</Directory>

# The Backend Stuff
WSGIScriptAlias /generate_204 path-to/Local/WSGI/backend_204.wsgi
# The Backend Stuff
WSGIScriptAlias /backend path-to/Local/WSGI/backend_db.wsgi
DocumentRoot path-to/website/app

<Directory path-to/website/app>
    Options Indexes FollowSymLinks Includes ExecCGI
    AllowOverride All
    Require all granted
    Allow from all
</Directory>

Alias /rootCA.pem path-to/Local/etc/ssl/certs/rootCA.pem

<Directory path-to/Local/etc/ssl/certs>
    Options Indexes FollowSymLinks Includes ExecCGI
    AllowOverride All
    Require all granted
    Allow from all
</Directory>

Any idea what's going on?

5
  • From what I see it looks, that everything is set properly. Where do you have your server located? Is it possible that your internet provider, where you have the server located, is blocking port 443? – nobody Mar 11 '16 at 16:04
  • It's possible, I have sent IT at my company (where the site is hosted as a subdomain) an email, and their first response was 'I don't know, can you give me more information', which I did and am waiting a response. If it is blocked by the them, it would mean that they have to selectively allow new subdomains perhaps, since I know there are other https subdomains currently being used. – Matthias Mar 11 '16 at 16:14
  • 1
    I would say it is not a matter of subdomains but the matter of IPs. – nobody Mar 11 '16 at 16:15
  • ah yes, I'm sure you are right about that. – Matthias Mar 11 '16 at 16:17
  • @nobody thank you for your help, you were right, port 443 was blocked by my ISP – Matthias Mar 14 '16 at 15:10
0

Turns out, it was indeed my ISP which hadn't opened port 443. After that was corrected, the site worked as expected.

1
  • This answer saved me hours. Thank you. Then I discovered my ISP doesn't allow us to use 443, as it's reserved for another service... – Jersh Nov 25 '17 at 20:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.