I have ssh access to a server where I want to host my website over https. I am using apache, and so far, the http variant of the site works flawlessly.
It is when trying SSL that things don't work. I cannot load the https site at all. I believe I have narrowed the problem down to the fact that to the outside world, it appears as though port 443 is closed, as can be seen below using nmap.
matthias@outsideworld:~$ nmap domain.com Starting Nmap 6.47 ( http://nmap.org ) at 2016-03-11 15:13 GMT Nmap scan report for domain.com (ip.is.here.yes) Host is up (0.0097s latency). Not shown: 998 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 0.13 seconds
But if I run for example nmap on the server itself through ssh, it looks as though 443 is open,
matthias@server:~$ nmap domain.com Starting Nmap 6.40 ( http://nmap.org ) at 2016-03-11 15:12 GMT Nmap scan report for domain.com (ip.is.here.yes) Host is up (0.00036s latency). rDNS record for ip.is.here.yes: domain.domain.com Not shown: 997 closed ports PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https Nmap done: 1 IP address (1 host up) scanned in 0.05 seconds
It looks like apache is definitely listening on 443,
matthias@server:~$ netstat -ln | grep -E ':80|443' tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN
I wouldn't be asking if I wasn't really stumped. I tried opening the port using iptables, but that didn't seem to do anything either, and ufw is disabled. Here is the current
iptables --list, but I did try some other configurations of that too to no avail.
matthias@server:~$ sudo iptables --list Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:https Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere
Ah and last but not least, here is the mysite.conf file I am using. And fyi this configuration did correctly serve https when used on a local network using a laptop as an access point.
<VirtualHost *:80> <If "req('Host') == '127.0.0.1'" > Redirect "/" "https://local.domain.com/" </If> <ElseIf "req('Host') == 'localhost'" > Redirect "/" "https://local.domain.com/" </ElseIf> <ElseIf "req('Host') == 'domain.com'" > #Redirect "/" "https://domain.com/" </ElseIf> <Else> Redirect "/" "https://ap.domain.com/" </Else> </VirtualHost> IncludeOptional path-to/Local/etc/apache2/vhosts/*.conf #NameVirtualHost *:443 <VirtualHost *:443> ServerAdmin email@example.com <IfModule mod_ssl.c> SSLEngine on SSLCertificateFile path-to-cert.crt SSLCertificateKeyFile path-to-key.key </IfModule> <FilesMatch "\.(cgi|shtml|phtml|php)$"> SSLOptions +StdEnvVars </FilesMatch> <Directory /usr/lib/cgi-bin> SSLOptions +StdEnvVars </Directory> BrowserMatch "MSIE [2-6]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown LogLevel info ErrorLog path-to/Local/Log/error.log CustomLog path-to/Local/Log/access.log combined </VirtualHost> <IfModule mpm_worker_module> ServerLimit 40 StartServers 2 MaxRequestWorkers 1000 MinSpareThreads 25 MaxSpareThreads 75 ThreadsPerChild 25 MaxRequestsPerChild 0 </IfModule>
And all the contents of the 'IncludeOptional/*.conf' files you can see in mysite.conf above,
WSGIDaemonProcess ourapp user=matthias group=matthias processes=2 threads=5 WSGIProcessGroup ourapp WSGIPassAuthorization On # The WSGI directory <Directory path-to/Local/WSGI> Options Indexes FollowSymLinks Includes ExecCGI AllowOverride All Require all granted Allow from all </Directory> # The Backend Stuff WSGIScriptAlias /generate_204 path-to/Local/WSGI/backend_204.wsgi # The Backend Stuff WSGIScriptAlias /backend path-to/Local/WSGI/backend_db.wsgi DocumentRoot path-to/website/app <Directory path-to/website/app> Options Indexes FollowSymLinks Includes ExecCGI AllowOverride All Require all granted Allow from all </Directory> Alias /rootCA.pem path-to/Local/etc/ssl/certs/rootCA.pem <Directory path-to/Local/etc/ssl/certs> Options Indexes FollowSymLinks Includes ExecCGI AllowOverride All Require all granted Allow from all </Directory>
Any idea what's going on?