1

I'm trying to change my existing apache2 site from http to https with a self-signed cert on Ubuntu 11. The site is currently running with the config at sites-available/default. I've followed the documentation in /usr/share/doc/apache2.2-common/README.Debian.gz which basically says install the ssl-cert package (it was already installed, so I ran sudo make-ssl-cert generate-default-snakeoil --force-overwrite to be sure) and then do:

sudo a2dissite default
sudo a2enmod ssl
sudo a2ensite default-ssl

I updated the sites-available/default-ssl so that DocumentRoot points to /var/siteX.mydomain.com.
I then ran:

sudo service apache2 restart

But my requests to the http version are still succeeding and being served. Requests to the https version just hang indefinitely. What did I miss?

Edit:
FWIW, There are 6 other sites being served by apache2 on this box, in addition to the site that I'm having trouble with. So my sites-enabled directory looks like:

default-ssl (symlink to sites-available/default-ssl - maps to siteX.mydomain.com)
siteA.mydomain.com
siteB.mydomain.com
siteC.mydomain.com
siteD.mydomain.com
siteE.mydomain.com
siteF.mydomain.com

In the other site[A-F].mydomain.com sites, there is no reference to siteX.mydomain.com anywhere, so none of them have been accidentally configured to keep serving traffic to http://siteX.mydomain.com

Edit2:
Here's a snippet from the beginning of my 000-default-ssl config file (everything after this is just the default stuff that I didn't touch):

<IfModule mod_ssl.c>
<VirtualHost _default_:443>
    ServerAdmin webmaster@localhost
    ServerName siteX.mydomain.com:443
    DocumentRoot /var/siteX.mydomain.com
    DirectoryIndex index.php 

Edit3:
Updating with output of grep -v \# 000-default-ssl | grep -Ev '^[ \t]*$'

<IfModule mod_ssl.c>
<VirtualHost _default_:443>
    ServerAdmin webmaster@localhost
    ServerName siteX.mydomain.com:443
    DocumentRoot /var/siteX.mydomain.com

    DirectoryIndex index.php
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/siteX.mydomain.com/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
            Options +ExecCGI
            AddHandler cgi-script .pl
    </Directory>
    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>
    ErrorLog ${APACHE_LOG_DIR}/error.log
    LogLevel warn
    CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
    Alias /doc/ "/usr/share/doc/"
    <Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
        Allow from 127.0.0.0/255.0.0.0 ::1/128
    </Directory>
    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
    SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
        SSLOptions +StdEnvVars
    </Directory>
    BrowserMatch "MSIE [2-6]" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
</IfModule>

Edit4:
This is the contents of ports.conf

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    NameVirtualHost *:443  # I just added this now - still not working !!
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>
13
  • Did you configured any additional sites beyond the "default"?
    – NuTTyX
    Sep 29, 2014 at 17:48
  • Yes, theres 5 or 6 other enabled sites with their respective config files at e.g. sites-enabled/sub.domain.com
    – RTF
    Sep 29, 2014 at 17:54
  • Check your httpd.conf. Should have a Listen at port 80. Comment it out (add # at the begining). Also, check your default-ssl to load before the other sites. Rename it as 000-default-ssl and the others to 001, 002, etc.
    – NuTTyX
    Sep 29, 2014 at 18:21
  • Is it safe to just rename the config files for each site? Is there anything else that needs to be done if I do that? But even if I do prioritize the default-ssl config, why would that matter? There's no other config in that directory that references the site I'm having trouble with, so there should be no conflict. The a2dissite default command disabled the http site/config. Also, my http.conf is completely empty.
    – RTF
    Sep 29, 2014 at 18:25
  • delete the symlink on sites-enabled, rename default-ssl to 000-default-ssl on sites-available and sudo a2ensite 000-default-ssl. Restart apache and test again
    – NuTTyX
    Sep 29, 2014 at 18:30

0

You must log in to answer this question.

Browse other questions tagged .