0

System: Ubuntu 14.04 server, Apache 2.4, ownCloud 8.2.5, testing environment Raspbian Jessie on Raspberry Pi 3 b. Error in Server's Internet Browser about HTTPS, when accessing https://192.168.1.107 and https://192.168.1.107

Error performing TLS handshake: An unexpected TLS packet was received.

Debugging

  • Command telnet 192.168.1.107 80 just hangs there for HTTP, similarly as telnet 192.168.1.107 443 for HTTPS.
  • Accessing HTTP works when acccessing http://192.168.1.107 and http://192.168.1.107/owncloud in the internet browser, but not by telnet as before
  • Logs /var/log/apache2/error.log has no recent errors. No errors in /var/log/apache2/access.log and not /var/log/apache2/other_vhosts_access.log.

The output of sudo apache2ctl -M |sort is

access_compat_module (shared)
 alias_module (shared)
 auth_basic_module (shared)
 authn_core_module (shared)
 authn_file_module (shared)
 authz_core_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 core_module (static)
 deflate_module (shared)
 dir_module (shared)
 env_module (shared)
 filter_module (shared)
 headers_module (shared)
 http_module (static)
Loaded Modules:
 log_config_module (static)
 logio_module (static)
 mime_module (shared)
 mpm_prefork_module (shared)
 negotiation_module (shared)
 php5_module (shared)
 rewrite_module (shared)
 setenvif_module (shared)
 socache_shmcb_module (shared)
 so_module (static)
 ssl_module (shared)
 status_module (shared)
 unixd_module (static)
 version_module (static)
 watchdog_module (static)

My settings should be the about the same as John's

  1. /etc/apache2/sites-available/: 000-default.conf and 000-default-ssl.conf.
  2. /etc/apache2/sites-enabled/: ln -s /etc/apache2/sites-available/000-default.conf /etc/apache2/sites-enabled/000-default.conf and ln -s /etc/apache2/sites-available/000-default-ssl.conf.
  3. /etc/apache2/conf-available/: owncloud.conf
  4. /etc/apache2/conf-enabled/: ln -s /etc/apache2/conf-available/owncloud.conf /etc/apache2/conf-enabled/owncloud.conf and other symlinks.
  5. error-ssl.log and access-ssl.log used not to mix them with standard logs in sites-available/000-default-ssl.conf.

My ssl certificates and keys are in /etc/ssl/. My /etc/apache2/sites-enabled/000-default.conf where I followed the thread here

SSLEngine on
SSLCertificateFile    /etc/ssl/apache.crt
SSLCertificateKeyFile /etc/ssl/apache.key

where my only difference is that I do not have these lines SSLCertificateChainFile /etc/ssl/subca.crt; SSLCACertificateFile /etc/ssl/ca.crt because I should not have a ChainFile. File /var/www/owncloud/config/config.php is

<?php 
$CONFIG = array ( 
'instanceid' => 'yours', 
'passwordsalt' => 'yours', 
'secret' => 'yours', 
'trusted_domains' => 
array ( 
0 => '192.168.1.107', 
1 => '192.168.1.1', 
2 => 'localhost', 
), 
'datadirectory' => '/var/www/owncloud/data', 
'overwrite.cli.url' => '192.168.1.107/owncloud', 
'dbtype' => 'sqlite3', 
'version' => '8.2.5.2', 
'logtimezone' => 'UTC', 
'installed' => true, 
'memcache.local' => '\\OC\\Memcache\\APCu', 
'theme' => '', 
'loglevel' => 2, 
'maintenance' => false, 
'trashbin_retention_obligation' => 'auto', 
'mail_from_address' => 'masimasi', 
'mail_smtpmode' => 'sendmail', 
'mail_domain' => 'gmail.com', 
'mail_smtpauthtype' => 'LOGIN', 
'mail_smtphost' => 'smtp.gmail.com', 
'mail_smtpport' => '587', 
);

/etc/apache2/sites-available/000-default-ssl.conf is

<IfModule mod_ssl.c> 
<VirtualHost _default_:443> 
ServerAdmin webmaster@localhost 
ServerName localhost 

DocumentRoot /var/www/html 

ErrorLog /var/log/apache2/error.log 
CustomLog /var/log/apache2/access.log combined 

SSLEngine on 
SSLProtocol all -SSLv2 
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIU

SSLCertificateFile /etc/ssl/apache.crt
SSLCertificateKeyFile /etc/ssl/apache.key 

SetEnvIf User-Agent .*MSIE.* nokeepalive ssl-unclean-shutdown 
CustomLog /var/log/apache2/ssl_request_log \ 
   "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" 

<FilesMatch "\.(cgi|shtml|phtml|php)$"> 
SSLOptions +StdEnvVars 
</FilesMatch> 
<Directory /usr/lib/cgi-bin> 
SSLOptions +StdEnvVars 
</Directory> 
</VirtualHost> 
</IfModule>

Permissions/owners 644/root:root should be right about SSL

ls -ls /etc/apache2/ssl/ 
total 8 
4 -rw-r--r-- 1 root root 1484 May 31 15:17 apache.crt 
4 -rw-r--r-- 1 root root 1704 May 31 15:17 apache.key

Settings in sites-x where two symlinks

ls -la /etc/apache2/sites-available/ 
total 16 
drwxr-xr-x 2 root root 4096 May 31 21:52 . 
drwxr-xr-x 9 root root 4096 May 31 15:44 .. 
-rw-r--r-- 1 root root 183 May 31 19:43 000-default.conf 
-rw-r--r-- 1 root root 916 May 31 21:50 000-default-ssl.conf
ls -la /etc/apache2/sites-enabled/ 
total 8 
drwxr-xr-x 2 root root 4096 May 31 19:38 . 
drwxr-xr-x 9 root root 4096 May 31 15:44 .. 
lrwxrwxrwx 1 root root 45 May 31 19:35 000-default.conf -> /etc/apache2/sites-available/000-default.conf 
lrwxrwxrwx 1 root root 35 May 31 11:50 000-default-ssl.conf -> ../sites-available/000-default.conf

Settings in conf-x where 7 symlinks

ls -la /etc/apache2/conf-available/ 
total 40 
drwxr-xr-x 2 root root 4096 May 31 20:07 . 
drwxr-xr-x 9 root root 4096 May 31 15:44 .. 
-rw-r--r-- 1 root root 315 Oct 24 2015 charset.conf 
-rw-r--r-- 1 root root 127 Jul 29 2013 javascript-common.conf 
-rw-r--r-- 1 root root 3224 Oct 24 2015 localized-error-pages.conf 
-rw-r--r-- 1 root root 189 Oct 24 2015 other-vhosts-access-log.conf 
-rw-r--r-- 1 root root 410 May 31 19:11 owncloud.conf 
-rw-r--r-- 1 root root 655 Feb 19 2015 phppgadmin.conf 
-rw-r--r-- 1 root root 2190 Nov 28 2015 security.conf
-rw-r--r-- 1 root root 455 Oct 24 2015 serve-cgi-bin.conf
ls -la /etc/apache2/conf-enabled/ 
total 8 
drwxr-xr-x 2 root root 4096 May 31 13:45 . 
drwxr-xr-x 9 root root 4096 May 31 15:44 .. 
lrwxrwxrwx 1 root root 30 May 31 11:50 charset.conf -> ../conf-available/charset.conf 
lrwxrwxrwx 1 root root 44 May 31 11:50 localized-error-pages.conf -> ../conf-available/localized-error-pages.conf 
lrwxrwxrwx 1 root root 46 May 31 11:50 other-vhosts-access-log.conf -> ../conf-available/other-vhosts-access-log.conf 
lrwxrwxrwx 1 root root 31 May 31 13:45 owncloud.conf -> ../conf-available/owncloud.conf 
lrwxrwxrwx 1 root root 33 May 31 12:03 phppgadmin.conf -> ../conf-available/phppgadmin.conf 
lrwxrwxrwx 1 root root 31 May 31 11:50 security.conf -> ../conf-available/security.conf 
lrwxrwxrwx 1 root root 36 May 31 11:50 serve-cgi-bin.conf -> ../conf-available/serve-cgi-bin.conf

JohnOrion's hypothesis about the problem:

you may try setting youself up on a static ip address and setting up the network properly so you can type localhost into the browser on the server machine and it should go to the site .. if it doesnt .. that could be an issue .. if the ssl is looking for localhost but it cant find it becuase for some reason your network doesnt show localhost pointig to your local ip .. that cold be a cause.

My hypothesis about the problem. Output of the command curl --head localhost | grep Server is Server: Apache/2.4.10 where nothing said that SSL modules are correctly loaded. I think this should be done in some cases. Not sure.

Making SSL key/crt

Thread about doing the .key and .crt.

the problem isn't that it was an self signed cert, but the common name have to include the subdomain. i only signed the cert with the common name domain.com but my owncloud is running in cloud.domain.com

Here however about localhost so commonname should only be 192.168.1.107 without a trailing slash, which is now correct in my system.


How do you sign self-certificate for localhost? I include 192.168.1.107/owncloud in the commonname but not sure if it is right.

How can you use self-signed HTTPS with DHCP in ownCloud?

  • we need more information than ... url fails ... why does it fail? what errors do you see on the site .. what errors do you see in the /var/apache2/error.log? Not sure what you are showing in your redirect thing. that shouldn't be in the config.php. Is the server working...can you get to localhost itself? – John Orion May 31 '16 at 16:39
  • 1
    ahh ok so it works but the redirect isnt working properly .. I get it now. Are you sure that redirect is enabled in apache? sudo apache2ctl -M | sort and look under loaded modules to make sure that rewrite_module is showing there. – John Orion May 31 '16 at 16:48
  • actually with Redirect permanent I guess the rewrite module doesn't matter I use rewrite rules for mine – John Orion May 31 '16 at 17:00
  • 1
    ok .. looking though it I noticed one thing .. on your redirect it should read Redirect permanent / https://localhost/ it may be that you didn't have the trailing / at the end so it was trying to access https://localhostownecloud – John Orion May 31 '16 at 17:22
  • I think your server is set up wrong. Is what you printed above the full contents of your /etc/apache2/sites-enabled/000-default.conf .. if you want we can set up a chat and it may be easier to do troubleshooting – John Orion May 31 '16 at 17:38
1

It is probably failing because you have not configured the server for https. Apache configuration for https requires that you listen to port 443 as well as port 80 and configure the server for TLS with a certificate.

(example from apache documentation)

LoadModule ssl_module modules/mod_ssl.so
Listen 443
<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on
    SSLCertificateFile "/path/to/www.example.com.cert"
    SSLCertificateKeyFile "/path/to/www.example.com.key"
</VirtualHost>

Ubuntu documentation for configuring HTTPS

  • Should I put this one to /etc/apache2/sites-enabled/000-default.conf? I am newbie about the topic so I do not know the best practices. – Léo Léopold Hertz 준영 May 31 '16 at 17:53
  • 1
    no this should be a sperate one .. should be 000-default-ssl.conf – John Orion May 31 '16 at 17:59
  • 1
    you want to edit conf files in etc/apache2/sites-available the sites-enabled directory should be links to the conf files in sites-available – John Hall May 31 '16 at 18:06
  • that is incorrect the owncloud.conf is not a site it is a conf. it should be in the conf-available and symlinked to conf-enabled folder. The owncloud install should have done this already so if you have a link to the onwncloud in sites enabled then remove it. it does not need to be there – John Orion May 31 '16 at 18:18
  • basically in sites-enabled you should only have two files that are symlinked to the sites-available folder .. they should be 000-default.conf and 000-default-ssl.conf. as i satated above the owncloud confs are dealt with in the conf-available/conf-enabled folders – John Orion May 31 '16 at 18:26
1

Since you seem to not have a full website enabled and maybe that's why you can't get the redirect to work. I have tried to recreate this issue .. the first problem I found was the redirect was not adding the / which I mentioned. Since that didn't solve the issue I also used the rewrite function to force owncloud to go to https. This is how I managed that:

Go to the directory owncloud is located /var/www/owncloud and open the .htaccess file.

Scroll down to near the bottom where you will see #### DO NOT CHANGE ANYTHING ABOVE THIS LINE #### right under that add the following lines:

<IfModule mod_rewrite.c>
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
</IfModule>

so it should look something like this

Options -Indexes
<IfModule pagespeed_module>
  ModPagespeed Off
</IfModule>
#### DO NOT CHANGE ANYTHING ABOVE THIS LINE ####
#### Part you need to add #####
<IfModule mod_rewrite.c>
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^.*$ https://%{SERVER_NAME}%{REQUEST_URI} [L,R]
</IfModule>
#### end of part you need to add ####
ErrorDocument 403 /owncloud/core/templates/403.php
ErrorDocument 404 /owncloud/core/templates/404.php
<IfModule mod_rewrite.c>
  RewriteRule . index.php [PT,E=PAT

That should use the rewrite rule to force owncloud to run under https

  • all you are adding is the first section i put in .. the second shows it added in the file i have already .. yours may have different things in there but you should have the line that says DO NOT CHANGE .. you just need to add the 4 lines i posted right under that line without effecting any of the other lines in the file – John Orion May 31 '16 at 18:12
  • basically you have it working but your configuration is all messed up and not set up properly. There is a chat room set up now if you would like to join and I could make sure everything is set up properly .. but if its working and you aren't dealing with an actual server but just trying to use owncloud then you are ok the way it is ... but if you wanted to run a website or something else then you will have issues most likely because of the poor configuration – John Orion May 31 '16 at 18:35
  • I took a new approach to solve the case by considering only HTTPS with Apache2. Too complex with ownCloud too. Thread here unix.stackexchange.com/q/291482/16920 where using the guide about setting HTTPS in apache (first link there). – Léo Léopold Hertz 준영 Jun 24 '16 at 21:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.