Change ssl port of apache2 server. (ERR_SSL_PROTOCOL_ERROR) - apache

I'm developing apache2 environment on my EC2 instance. For security, I want to change ssl port of apache2.
I've already confirmed default ssl port 443 was working by checking page with chrome browser. But after modifying ports.conf like below, I've got an error, ERR_SSL_PROTOCOL_ERROR when accessing this server like https://xxxxxxx:18443/
Are there any settings for changing ssl port?
listening ports
$ ss -lnt
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 *:22 *:*
LISTEN 0 64 *:7777 *:*
LISTEN 0 50 127.0.0.1:3306 *:*
LISTEN 0 128 :::22 :::*
LISTEN 0 128 :::18443 :::*
/etc/apache2/ports.conf
#Listen 80
<IfModule ssl_module>
Listen 18443
</IfModule>
<IfModule mod_gnutls.c>
Listen 18443
</IfModule>
environment
OS: ubuntu 14.04 server (Amazon/EC2 AMI)
apache: Apache/2.4.7 (Ubuntu)
EC2 inbound security policy
Custom TCP rule: TCP, 18443, 0.0.0.0/0
Custom UDP rule: UDP, 18443, 0.0.0.0/0

I found an answer by myself. I also need to edit default-ssl.conf. So I summarize all procedures to set up ssl and changing its port. In this example, I change ssl port to 18443 from 443.
$ sudo apt-get install apache2
$ sudo a2enmod ssl
$ sudo a2ensite default-ssl
$ sudo service apache2 restart
$ ss -lnt
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 :::443 :::*
LISTEN 0 128
Then, try to change ssl port.
$ sudo vi /etc/apache2/ports.conf
<IfModule ssl_module>
Listen 18443
</IfModule>
<IfModule mod_gnutls.c>
Listen 18443
</IfModule>
In this setting, I used default-ssl, so I also have to modify this file.
$ sudo vi /etc/apache2/sites-available/default-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost _default_:18443>
...
Then, you restart apache2 and you can access http://xxxxxx:18443/
$ sudo service apache2 restart

Related

Let's Encrypt Unable to find a virtual host listening on port 80

■Background
trying to get SSL through Let's Encrypt
■Issue
As run the code below,
sudo certbot --apache -d hogehoge.com
I got the port 80 error
Unable to find a virtual host listening on port 80 which is currently needed for Certbot to prove to the CA that you control your domain. Please add a virtual host for port 80.
and unable to resolve this error
■What I have tried
have set up the port 80
vim /etc/httpd/conf/httpd.conf
add the description in the file.
NameVirtualHost *:80
<VirtualHost *:80>
ServerAdmin root#hogehoge
DocumentRoot /var/www/html
ServerName hogehoge
</VirtualHost>
but I still got the same error.
would you kindly tell me the cause and how to make it work?
Default command "sudo certbot renew" error on localhost
(1)Uninstall certbot
(2)Reinstall certbot
(3)Sudo certbot certonly
(4)Select option 1, spin up temporary web server
(5)Ensure port 80 is accessible from outside, port forwarding in router
(6) Ensure all services using port 80 are stopped
Try
RewriteCond %{REQUEST_URI} !.well-known/acme-challenge
Enabling HTTPS on a Single Instance Beanstalk application: Unable to find a virtual host listening on port 80

Golang webapp with Apache multiple VirtualHosts

Unfortunately I've not been able to deploy a basic Golang WebApp on production server. After going through many documentation and tutorials I understood that I need to run Golang WebApp as a Daemon.
First things first: the production server is a single IP running Ubuntu 16.04 with Apache based multiple VirtualHosts /etc/apache2/sites-enabled/.
Golang environment vars
# set golang environment vars
export GOROOT=/usr/local/go
# set multiple gopaths seperated by ":"
export GOPATH=/var/www/go_projects/gotest.domain2.com
export PATH=$GOPATH/bin:$GOROOT/bin:$PATH
# set PATH so it includes user's private bin directories
PATH="$HOME/bin:$HOME/.local/bin:$PATH"
Systemd Daemon file
[Unit]
Description=GoTest Webserver
[Service]
Type=simple
WorkingDirectory=/var/www/go_projects/gotest.domain2.com
ExecStart=/var/www/go_projects/gotest.domain2.com/main #binary file
[Install]
WantedBy=multi-user.target
VirtualHost Conf
<VirtualHost *:80>
ServerName gotest.domain.com
DocumentRoot /var/www/go_projects/gotest.domain2.com
<Directory /var/www/go_projects/gotest.domain2.com>
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
Go file
package main
import (
"fmt"
"log"
"net/http"
)
func handler(w http.ResponseWriter, r *http.Request) {
fmt.Fprintf(w, "Hello World %s!", r.URL.Path[1:])
}
func main() {
http.HandleFunc("/", handler)
log.Fatal(http.ListenAndServe(":8080", nil))
}
The program on http://gotest.domain2.com unfortunately is not executed. It rather lists the content of DocumentRoot
Manual run returns
admin#xyz:/var/www/go_projects/gotest.domain2.com$ ./main
2018/02/18 15:52:58 listen tcp :8080: bind: address already in use
What am I missing or is my deployment approach principally wrong?
Cheers!
EDIT:
As suggested from Michael Ernst, I tried altering the port/proxy settings and here is the result:
http://gotest.domain2.com leads to 503 Service Unavailable
Following is the outcome of sudo netstat -talpen
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State User Inode PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 16367 1250/sshd
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 0 473536 26340/master
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 0 16604 1417/dovecot
tcp 0 0 0.0.0.0:2000 0.0.0.0:* LISTEN 5001 17289 1652/asterisk
tcp 0 xx.xx.xx.xx:22 xx.xx.xx.xx:6126 ESTABLISHED 0 615988 13025/sshd: admin [
tcp6 0 0 :::22 :::* LISTEN 0 16369 1250/sshd
tcp6 0 0 :::25 :::* LISTEN 0 473537 26340/master
tcp6 0 0 :::3306 :::* LISTEN 111 17564 1391/mysqld
tcp6 0 0 :::143 :::* LISTEN 0 16605 1417/dovecot
tcp6 0 0 :::80 :::* LISTEN 0 612412 12554/apache2
tcp6 0 0 xx.xx.xx.xx:80 xx.xx.xx.xx:6128 FIN_WAIT2 0 0 -
tcp6 0 0 xx.xx.xx.xx:80 xx.xx.xx.xx:6129 ESTABLISHED 33 615029 12561/apache2
Any idea where the problem lies?
As for configuring apache:
You need to start the go application and in the apache configuration reverse proxy the request to the port 8080 ( which the go daemon you wrote listens to ).
The go application needs to be always running so you might want to boot it at system start. Unlike php, which is called from apache, go should run as binary that is always there.
As for your port issue:
Make sure that your application is not yet started and that no other application is listening to port 8080. ( you can use netstat -talpen to see that )
Edit:
Port 8080 is often a http proxy. Is there are proxy or another application running on this point?
Edit:
You can configure your apache like that:
<VirtualHost *:80>
ProxyPreserveHost On
ProxyRequests Off
ServerName www.example.com
ServerAlias example.com
ProxyPass / http://localhost:8080/
ProxyPassReverse / http://localhost:8080/
</VirtualHost>
You might also want to make the port of your go-application configurable so you don't need to re-compile the code in case you need to change the port. Also you can bind to the localhost interface so, in case you don't have a firewall configured, people can only access the go application over apache and not directly talk with the go application
// define the flag
port := flags.Int("port", 8080, "port to listen on")
// parse the flags
flags.Parse();
// here you might want to add code to make sure the port is valid.
// start webserver
log.Fatal(http.ListenAndServe("localhost:"+strconv.Atoi(*port), nil))

NGINX reverse proxy change port 80 to 8080

I am trying to install and configure Varnish 3 on Centos 6.6
The problem is Nginx is running as reverse proxy on ports 80 and 8080.
Apache is running on port 7080
I did all the changes in conf files of nginx however it is still listening on ports 80 and 8080 that's why varnish is not working.
How can I change the nginx port from 80 to 8080?
netstat -tulpn gives the following: (the x are the ip address of the server)
tcp 0 0 xx.xxx.xx.xx:80 0.0.0.0:* LISTEN 17048/nginx
tcp 0 0 xx.xxx.xx.xx:8080 0.0.0.0:* LISTEN 17048/nginx
Edit the file /etc/nginx/sites-enabled/default or wherever your listen directive is:
https://stackoverflow.com/a/12800469
Then restart server!

remove port number 8069 from the url

I am using centos 6. I want to remove the port from url
that is,I want to use http://www.website.com/ insted of http://www.website.com:8069/ so i tried to create the virtualhost.
I opened the file /etc/httpd/conf/httpd.conf
and added the line
Listen 80
NameVirtualHost *:80
<VirtualHost *:80>
DocumentRoot "/var/www/vhosts/website.com/httpdocs"
ServerName www.website.com
ServerAlias website.com
ProxyPass / http://www.website.com:8069/
ProxyPassReverse / http://www.website.com:8069/
</VirtualHost>
and restarted the server
/sbin/service httpd restart
but its not working
it is not giving any error and nor working
The only solution if you want to use http://www.website.com/ is to open port 80 on the server or server's router.
you should check via netstat if the apache process is listening to port 80 via
netstat -tulpn
next to check is local firewall. Check with
iptables -L
if the command lists entries iptables is active. You can turn it of with
/etc/init.d/iptables stop
or add an entry for port 80
/etc/sysconfig/iptables
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
if that doesn't help you should check the apache logs under
/var/log/httpd/

amazon ec2 how to setup https?

I have read the amazon ec2 guide for setup https and finished several steps. But it still not working.
sign a SSL certification, I use self-signed cert.
use aws iam to upload the SSL cert to amazon server.
In ec2 control platform, add port 80 and port 443 in the current security group's inbound
create new load balancer, add http with port 80, the port 443 and https with the uploaded cert in the new load balancer, and assign current instance in the load balancer
Last, I have check the instance's security group and make sure it is right. I reboot the instance and the https does not work. The health check can pass in checking port 80. But it does not pass in checking port 443.
Do I miss any step?
I know this post is a year old, but I recently had similar issues and hope that someone might find this useful.
I see you are using a load balancer. You have to do the following:
Step 1
Make sure that port 443 is open on your EC2 instance and not being blocked by a firewall. You can run
sudo netstat -tlnp
on linux to check which ports are open. The output should look something like this:
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 937/sshd
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1060/mysqld
tcp6 0 0 :::22 :::* LISTEN 937/sshd
tcp6 0 0 :::443 :::* LISTEN 2798/apache2
tcp6 0 0 :::80 :::* LISTEN 2798/apache2
Step 2
Make sure your security groups are setup as follows:
EC2 (INBOUND)
HTTP TCP 80 LOAD BALANCER
HTTPS TCP 443 LOAD BALANCER
Load Balancer (Outbound)
HTTP TCP 80 EC2 Instance
HTTPS TCP 443 EC2 Instance
Step 3
Make sure your EC2 instance is listening on port 443 (/etc/apache2/ports.conf) :
Listen 80
Listen 443
If you are using a virtual host, make sure it looks like this:
<VirtualHost *:80>
DocumentRoot /var/www/html/mysite.com
ServerName mysite.com
ServerAlias www.mysite.com
<Directory /var/www/html/mysite.com>
AllowOverride All
RewriteEngine On
Require all granted
Options -Indexes +FollowSymLinks
</Directory>
</VirtualHost>
<VirtualHost *:443>
DocumentRoot /var/www/html/mysite.com
ServerName mysite.com
ServerAlias www.mysite.com
SSLEngine on
SSLCertificateFile /usr/local/ssl/public.crt
SSLCertificateKeyFile /usr/local/ssl/private/private.key
SSLCACertificateFile /usr/local/ssl/intermediate.crt
</VirtualHost>
Step 4
Upload your certificate files in .pem format using the following commands:
aws iam upload-server-certificate --server-certificate-name my-server-cert
--certificate-body file://my-certificate.pem --private-key file://my-private-key.pem
--certificate-chain file://my-certificate-chain.pem
Step 4
Create a listener on the Load Balancer which has the EC2 instance attached to it. The listener is for HTTPS and port 443. The listener will ask for a certificate and it will have the one you added from the aws cli already listed. If it is not listed, log out of the AWS console and log back in.
After, this, traffic via HTTPS will start flowing to your EC2 instance.
I had similar issues, and posted my question and answer here: HTTPS only works on localhost