0

I have a web server running on a Raspberry Pi. I am running stunnel on port 443, so I have been working to move my web server to port 8443. I use Let's Encrypt (Certbot) for my SSL certificates, and previously they had been working perfectly.

I have learned how to obtain certificates using the DNS challenge, so having port 443 for authentication is no longer necessary. I believe that I have all of my configuration files set up properly, but I'll insert them below.

Apache is running, and nothing should conflict with it, but whenever I attempt to access my site over HTTPS, Chrome says that the site unexpectedly closed the connection, while Edge says that it uses outdated or unsafe TLS settings.

I've been trying to figure this out for myself but at this point I have no idea what to do.

Ports.conf

# If you just change the port or add more ports here, you will likely also'
# have to change the VirtualHost statement in'
# /etc/apache2/sites-enabled/000-default.conf'
Listen 80
#<IfModule ssl_module>'
#       Listen 8443'
#</IfModule>'
#<IfModule mod_gnutls.c>'
#       Listen 8443'
#</IfModule>'
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet'
<IfModule mod_ssl.c>
Listen 8443
</Ifmodule>

Sample HTTPS VHost Config

<IfModule mod_ssl.c>
<VirtualHost *:8443>
        ServerName mysite.tld
        ServerAdmin myemail@provider.com
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
SSLCertificateFile /etc/letsencrypt/live/mysite.tld/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mysite.tld/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

Sample HTTP Config

<VirtualHost *:80>
        ServerName mysite.tld
        ServerAdmin myemail@provider.com
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
Redirect permanent / https://mysite.tld/
RewriteEngine on
RewriteCond %{SERVER_NAME} =mysite.tld
RewriteRule ^ https://{SERVER_NAME}{REQUEST_URI} [END,QSA,R=permanent]
</VirtualHost>

I have already asked this question on Server Fault, and was redirected here. The answers I did receive began to point me in the right direction, but I still don't know what I can do to fix it. The best response was

If you just visit http://mysite.tld it will redirect you to port 443 (https) where nothing is listening. This explains your error.

Can anyone make sense of this? Thanks!

0

Have you tried to type domain:8443 into your browser?

Every browser has the default to use port 80 for HTTP-Pages and Port 443 for HTTPS-Pages, if you want to give a port explicitely, you have to append the port to the URL using a colon

  • Yes, I forgot to mention that, it does work when I do that, however, I the webpage that appears is not what is located at the DocumentRoot. I believe the other response to this question is correct, but I need some time to try it. – FlyingHazard Nov 29 '17 at 18:52
0

You have specified that Apache should listen to port 8443 only if mod_ssl is loaded (i.e. this Apache has the capability to use SSL/TLS), but in your configuration snippets, nothing seems to tell Apache to actually use SSL/TLS on port 8443.

You do that by adding SSLEngine on to the <VirtualHost> block that is supposed to use SSL/TLS:

<VirtualHost *:8443>
    SSLEngine on
    ServerName mysite.tld
    # etc...

When you redirect a browser to a HTTPS URL without explicitly specifying a port number, the browser will attempt to connect to the default HTTPS port, which is 443. Just like port 80 is used by default for plain HTTP.

You'll need to change your redirection to include the port number:

RewriteRule ^ https://{SERVER_NAME}:8443{REQUEST_URI} [END,QSA,R=permanent]
  • Thanks you @telecoM, this appears to be what my problem is, specifically when the webpage is redirected to port 443. I need to find time to try this out, but I have a feeling this should work. One question that I have for you is does that port number appear in the URL is you are redirected according to that rewrite rule? – FlyingHazard Nov 29 '17 at 18:54
  • Ok, @telecoM, I got the rewrite working, but the page displayed is not what is located at the DocumentRoot, and the port number is displayed in the URL, which is not what I'm going for. Is there any way to change this? – FlyingHazard Nov 29 '17 at 19:43
  • If you don't want the port number visible in the URL, then you must use the standard ports: 80 for HTTP, and 443 for HTTPS. But you said you have stunnel in port 443, so that port is already occupied. – telcoM Nov 30 '17 at 21:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.