My VirtualHost redirects for an HTTPS site are broken - apache

Apache/2.2.15, CentOS Linux.
I have a site where I want the whole site to be SSL-encrypted all the time. Normally, I don't use mod_rewrite to do my www/non-www redirects; I just use VirtualHosts and the Redirect directive.
Trying to do this with my HTTPS site, however, is returning a generic SSL connection error in all browsers. Here's my vhost file (domain names and IP addresses changed):
NameVirtualHost 192.168.0.256:80
NameVirtualHost 192.168.0.256:443
<VirtualHost 192.168.0.256:80>
ServerName www.example.com
ServerAlias example.com
Redirect / https://www.example.com/
</VirtualHost>
# ############################
# This block breaks everything
# ############################
<VirtualHost 192.168.0.256:443>
ServerName example.com:443
Redirect / https://www.example.com/
</VirtualHost>
<VirtualHost 192.168.0.256:443>
DocumentRoot /var/www/example_site/htdocs/
ServerName www.example.com:443
ErrorLog /var/www/logs/example_site/error_log
SSLEngine On
SSLCertificateFile /etc/httpd/ssl.crt/www.example.com.crt
SSLCertificateKeyFile /etc/httpd/ssl.key/www.example.com.key
SSLCACertificateFile /etc/httpd/ssl.crt/www.example.com.ca-bundle
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
<Directory /var/www/example_site/htdocs/>
Options FollowSymLinks MultiViews
AllowOverride All
</Directory>
<Files ~ "\.php$">
SSLOptions +StdEnvVars
</Files>
</VirtualHost>
The block marked "This block breaks everything" appears to be the culprit. When that VirtualHost block is commented out, the site loads as expected and everything's fine. But I really want/need to redirect non-www to www, and when that block is enabled, I get this on every attempt to load the site:
Error logs don't seem to show anything useful. Can anyone tell from this what exactly is going wrong?

Port 443 always needs a certificate attached to it. Even if its just a simple redirect. Connect -> SSL -> Data transfer.

Related

SSL redirect fails on firefox and chrome, not edge

I have an SSL certificate from Certbot for "mysite". When I use FF or Chrome to go to mysite (with or without using the http:// prefix) I get to the non-SSL site. No redirect happens. But when I use Edge, my redirect works and I automatically get to https://mysite. In FF, when I get to the non-SSL site then I reload the page, I DO get to the SSL site. In Chrome, I cannot get to the SSL site, even if I enter the https://. The 2 sites are on the same Windows machine (using Apache server) with virtual hosts for ports 80 and 443. What am I missing?
Here are my virtual host directives:
<VirtualHost *:80>
ServerAdmin dforeman#stny.rr.com
DocumentRoot "${djpath}"
ServerName dforeman.homedns.org
Redirect / https://dforeman.homedns.org
ErrorLog "E:/logfiles/new-v80.log"
# CustomLog logs/dummy-host.example.com-access_log common
</VirtualHost>
<VirtualHost _default_:443>
# DO NOT replace _default_ above
# General setup for the virtual host
DocumentRoot "E:/DJs Documents/apublic_html"
ServerName dforeman.homedns.org
ServerAdmin dforeman#stny.rr.com
ErrorLog "E:/logfiles/verror.log"
TransferLog "E:/logfiles/vhttp-access.log"
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
SSLCertificateFile "C:/fullchain.pem"
SSLCertificateKeyFile "C:/privkey.pem"
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "${SRVROOT}/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
</VirtualHost>
Here is what I use in my https forwards:
<VirtualHost *:80>
ServerAdmin dforeman#stny.rr.com
DocumentRoot "${djpath}"
ServerName dforeman.homedns.org
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
ErrorLog "E:/logfiles/new-v80.log"
# CustomLog logs/dummy-host.example.com-access_log common
</VirtualHost>
Note: I don't use .htaccess files to achieve this.

Installed SSL on Apache server, page not responding

My question is about SSL installation. I purchased a new SSL for a website that's hosted on a Ubuntu 16.04 box with Apache 2.4.29. I was able to get this installed and I'm not getting any errors but my page is not redirecting. I've followed some guides (DigitalOcean) but feel as I'm missing something.
I have checked the sites-available files (000-default.conf, default-ssl.conf & example.com.conf) and I'm not seeing anything that's catching my eye, but I feel I migtht be missing something. I've checked the status of Apache and I'm not getting any errors and I've restarted the services several times to no avail.
Here's a general breakdown of what I have. Am I missing something? Is additional information required for setting this up?
000-default.conf
<VirtualHost *:80>
ServerAdmin webmaster#localhost
DocumentRoot /var/www
Redirect "/" "https://example.com/"
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
default-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerAdmin webmaster#localhost
DocumentRoot /var/www
SSLCertificateFile /root/example.com.crt
SSLCertificateKeyFile /root/www.example.com.key
SSLCACertificateFile /root/intermediate.crt
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
</VirtualHost>
</IfModule>4
mydomain.com.conf
<VirtualHost *:443>
ServerAdmin admin#somedomain.com
ServerName mydomain.com
ServerAlias www.example.com
DocumentRoot /var/www/example.com/html
Redirect permanent / https://example.com
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
Here is my attempt at a combined configuration. Note that I do not have your setup to test it, but I have used similar configurations on production servers.
First define your port 80 VirtualHost (000-default.conf in your setup):
Listen 80
<VirtualHost *:80>
Redirect "/" "https://example.com/"
LogLevel debug
ErrorLog "${APACHE_LOG_DIR}/80_error.log"
CustomLog "${APACHE_LOG_DIR}/80_access.log" combined
</VirtualHost>
No need for a DocumentRoot since you redirect everything.
Then comment out default-ssl.conf. This file is an example of what you could do to setup an SSL enabled VirtualHost. If you use that file AND another VirtualHost on port 443, this one will always be used, since Apache uses the first VirtualHost it finds that matches the client's request (here port 443).
Another point, VirtualHost are not "added" to one another. Each is independent of the others and must contain a complete configuration. This means you cannot put some configuration in on VirtualHost on port 443, and some in another and expect it to work.
Then create your example.com.conf file:
Listen 443
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
ServerAdmin admin#example.com
SSLCertificateFile "/root/example.com.crt"
SSLCertificateKeyFile "/root/example.com.key"
SSLCACertificateFile "/root/intermediate.crt"
LogLevel debug
ErrorLog "logs/443_error_log"
CustomLog "logs/443_access_log" combined
DocumentRoot "/var/www/example.com/html"
DirectoryIndex index.html
<Directory "/var/www/example.com/html">
Options Indexes FollowSymLinks
AllowOverride None
Require all granted
</Directory>
</VirtualHost>
Some notes:
I put the LogLevel at debug, so you can troubleshoot, but once it is working, change it to error. Otherwise you will have huge log files quickly!
For the same reason, I split the logs for port 80 and port 443. Each VirtualHost should have its own logs.
The certificate files must match the domain name. Not the filename (although it makes it easier to match), but the certificate itself.
If you want your certificate to cover example.com and www.example.com, both names must be added to the alternate names in the certificate.
I do not understand why you have Redirect permanent / https://example.com in your configuration. You are already in the https, port 443 VirtualHost.
The options based on <FilesMatch> directives in the default ssl configuration can be added if you want.
This setup will ensure that all http requests will be redirected to https://example.com. Then it will use the :443 VirtualHost, use the proper certificate for that domain and serve the content from the DocumentRoot directory.

How disable direct ip access in Apache

I have a website with CloudFlare protection, seems good at too, but if you enter the original IP adress of my server you can enter normally.
I'm using Apache (XAMPP) and SSL (https://)
I want something similar when you enter from the IP address with CloudFlare, which throws error 1003
Edit or create a default vhost and put this inside:
<VirtualHost *:80>
ServerName xxx.xxx.xxx.xxx
Redirect 403 /
DocumentRoot /var/www/html
</VirtualHost>
xxx.xxx.xxx.xxx is your server ip address
After that restart your apache
sudo a2ensite your-vhost.conf
sudo systemctl restart apache2
Hope that helps
You can verify if the domain received in the request matches your site domain. If not, force a redirection to the user. Like so:
RewriteEngine on
RewriteCond %{HTTP_HOST} !^www.example.com
RewriteRule (.*) https://www.example.com$1 [R=301,L]
So IP accesses will be forced back to the domain name.
Obviously, you could return anything, this is just one method I see often.
Under the ubuntu 20.04
Server version: Apache/2.4.41 (Ubuntu)
i just copied my 000-default-ssl.conf as disable-ip.ssl.conf and put below the content
cd /etc/apache2/sites-available
cp 000-default-ssl.conf disable-ip.ssl.conf
content of disable-ip.ssl.conf vhost file
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerAdmin root#localhost
ServerName localhost
ServerAlias XXX.XXX.XX.XX # here write ip adresss of your web site
UseCanonicalName Off
Redirect 403 /
ErrorDocument 403 "Sorry, direct IP access not allowed."
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLEngine on
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
SSLCertificateFile /etc/letsencrypt/live/domain.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domain.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
then
a2ensite disable-ip.ssl.conf
service apache2 restart

apache2 virtualhost configuration with two subdirectories

I'm running Apache 2.4 on Ubuntu 14.04 server. It's purpose is a mail server so it has postfix, dovecot and roundcube on it (amongst other things). I'm trying, and failing, to configure Apache to serve the pages that I want.
I have an SSL certificate installed and working correctly. I want to force all access over HTTPS so I have:
<VirtualHost *:80>
Redirect / https://mailserver.hni.ae/
</VirtualHost>
Both sets of files to be served are under /var/www/html, the first being /var/www/html/A and the other /var/www/html/B (let's say). I have configured my /etc/apache2/sites-available/000-default.conf (which has a symlink to ./sites-enabled) to be:
<VirtualHost *:443>
SSLEngine On
SSLCertificateFile /etc/ssl/private/mycert.crt
SSLCertificateKeyFile /etc/ssl/private/mycert.key
ServerAdmin webmaster#mydomain.com
ServerName www.mydomain.com
DocumentRoot /var/www/html/
DirectoryIndex index.php
<Directory /var/www/html/A>
Options FollowSymLinks
AllowOverride None
Order Allow,Deny
Allow from all
</Directory>
<Directory /var/www/html/B>
Options FollowSymLinks
AllowOverride None
Order Deny,Allow
Deny from All
Allow from 192.168.1.1
</Directory>
LogLevel warn
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
And that works. I can go to www.mydomain.com/B and it serves the login page for those pages (only when I access from the specified IP address), and www.mydomain.com/A and login to the pages from app A.
My problem: I want to be able to go to www.mydomain.com/C and just plain www.mydomain.com and be redirected to www.mydomain.com/A but when I use Redirect ... the server gets into a loop and tries to serve www.mydomain.com/AAAAAAA.... I suspect I should use the RedirectMatch temp ^/$... directive but can't get that to work either. Maybe something to do with the Redirect for :80 to :443 clashing? There is no .htaccess involved as I'm using AllowOverride None.
I've read the Apache 2.4 documentation thoroughly but just can't figure it out. Any suggestions?
You can use a RewriteRule. Add this to your VirtualHost:
RewriteEngine On
RewriteRule ^/(C/?|)$ /A [R,L]
Make sure mod_rewrite is enabled too.
Explanation:
Regex ^/(C/?|)$ will match /C optionally followed by a /, or just / i.e. the root of www.mydomain.com

hosting multiple SSL certs on apache

I hope someone can give me a hand with this. I have 2 IPs that I can use to do this and need to host 2 different secure (SSL) domains on the same Apache server. I've read that as of Apache 2.2.something that a single IP can be used, using some sort of add-in but I want to keep this as simple as possible and am willing to use both IPs to accomplish this task. I already have the 2 signed certificates for the domains.
This setup that I am posting here, works, but the issue I am having is that when I go to domain2.net, I receive a browser warning telling me that the cert does not match the domain but matches domain1.com
I'm using CentOS 5 and Apache 2.2.3. CentOS has a ssl.conf file and these lines are what I believe are giving me trouble:
SSLCertificateFile /etc/pki/tls/certs/domain1.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/domain1.com.key
I was under the impression that I could override these values in the virtual host containers and reference the keys that I need but it doesn't appear that way. When I comment these two lines out in the ssl.conf file, Apache won't restart. The ssl_log hints: SSLCertificateKeyFile
These are my virtual containers:
<VirtualHost 2.2.2.2:443>
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/domain2.net.crt
SSLCertificateKeyFile /etc/pki/tls/private/domain2.net.key
DocumentRoot "/var/www/domain2"
ServerName domain2.net
ServerAlias domain2.net
DirectoryIndex "index.php"
<Directory /var/www/html/domain2>
Options -Indexes FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
<VirtualHost 1.1.1.1:444>
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/domain1.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/domain1.com.key
DocumentRoot "/var/www/html"
ServerName domain1.com
ServerAlias domain1.com
DirectoryIndex "index.php"
<Directory /var/www/html>
Options -Indexes FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
How can I get these two domains to work using SSL? I've also tried to use the same port for the different IPs but again, Apache won't restart.
I'm truly lost on this so if someone could lend a hand, I'd really appreciate it.
Great question!
I was able to get two SSL certificates working on the same server. You should be able to do what you are trying to do.
The things in your configuration that stand out as odd to me:
I'd suggest using port 443 for both SSL-protected sites. You should have a specific instruction in apache's conf files somewhere for listening on port 443. For me it is located in /etc/apache2/ports.conf
Listen 443
.
It seems odd that you have ServerName and ServerAlias both using the same domain per virtual host. Try making the ServerAlias different or leaving it out:
ServerName domain1.com
ServerAlias www.domain1.com
.
I am assuming that you replaced your IPs and domains in your posted conf. Even if they are not the actual IPs you are using, you might want to double check that they can get you to the right place outside of SSL (since obviously SSL is not working).
.
Check the apache2 error log for more information. For me the log is located at: /var/log/apache2/error.log . You can set it with:
ErrorLog /var/log/apache2/error.log
And finally, for your reference here is my ssl-default (ssl.conf). I replaced my domains and IPs with the ones you used in your example conf. I have multiple subdomains working with NameVirtualHost since I have a wildcard cert:
<IfModule mod_ssl.c>
<Directory />
Options FollowSymLinks
AllowOverride All
</Directory>
<Directory /var/www/>
Options FollowSymLinks MultiViews
AllowOverride All
Order allow,deny
allow from all
</Directory>
NameVirtualHost 1.1.1.1:443
NameVirtualHost 2.2.2.2:443
ErrorLog /var/log/apache2/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog /var/log/apache2/ssl_access.log combined
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
# 1.1.1.1 = domain1.com
<VirtualHost 1.1.1.1:443>
ServerName www.domain1.com
ServerAdmin admin#domain1.com
SSLEngine on
SSLCertificateKeyFile /var/www/ssl/domain1.key
SSLCertificateFile /var/www/ssl/wildcard.domain1.crt
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
DocumentRoot /var/www/domain1/www.domain1.com/web
DirectoryIndex index.php index.html
</VirtualHost>
<VirtualHost 1.1.1.1:443>
ServerName secure.domain1.com
ServerAdmin admin#domain1.com
SSLEngine on
SSLCertificateKeyFile /var/www/ssl/domain1.key
SSLCertificateFile /var/www/ssl/wildcard.domain1.crt
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
DocumentRoot /var/www/domain1/secure.domain1.com/
DirectoryIndex index.php index.html
</VirtualHost>
# 2.2.2.2 = *.domain2.com
<VirtualHost 2.2.2.2:443>
ServerName admin.domain2.com
ServerAdmin admin#domain2.com
SSLEngine on
SSLCertificateKeyFile /var/www/ssl/domain2.key
SSLCertificateFile /var/www/ssl/domain2.crt
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
LogLevel warn
CustomLog /var/log/apache2/access.log combined
ErrorLog /var/log/apache2/error.log
DocumentRoot /var/www/domain2/secure.domain2.com/web
DirectoryIndex index.php index.html
php_flag display_errors on
php_value error_reporting 7
</VirtualHost>
</IfModule>
I hope this helps!!
You don't need a separate ssl.config file, but if you want to use one, then put your SSL <VirtualHost XXX:443> containers in your ssl.conf file rather than in your httpd,conf file.
The other option which we use on our site is to put the settings from the ssl.conf file in our httpd.conf file and rename the ssl.conf file to something like ssl.conf.bak (to keep it for reference).
It might help to put this Apache command before the first Virtual Host:
SSLStrictSNIVHostCheck on
This enabled me to have several different domains each with its own keys running on the same IP without getting confused.