Witam wszystkich!
Temat zdradza wszystko (nowicjusz). Mam strone na Apachu2, po skonfigurowaniu wszystkiego wedlug tego: http://hallard.me/enable-ssl-for-apache ... 5-minutes/ lub tego: https://www.debian-administration.org/a ... th_Apache2 i wpisaniu https://mojastrona.pl przegladarka wyrzuca mi Page is not available. Walcze z tym juz trzeci dzien i nie moge sobie poradzic. Mial ktos podobny problem?
Problem z ustawieniem SSl na Apache2 w Debianie
-
imperatorus
- Posty: 3
- Rejestracja: 27 października 2014, 18:15
pokaż wynik poleceń:
Kod: Zaznacz cały
cat /etc/apache2/sites-available/default-ssl
cat /var/log/syslog
netstat -lntp
ps aux | grep apache2
-
imperatorus
- Posty: 3
- Rejestracja: 27 października 2014, 18:15
Pokasowalem wszystkie modyfikacje ze wzgledu na to ze nic mi nie dzialalo
cat /etc/apache2/sites-available/default-ssl
netstat -lntp
ps aux | grep apache2
cat /etc/apache2/sites-available/default-ssl
Kod: Zaznacz cały
<IfModule mod_ssl.c><VirtualHost _default:443>
ServerAdmin webmaster@localhost
ServerName www.mojastrona.ddns.net
DocumentRoot /var/www/wallbase
<Directory />
Options FollowSymLinks
AllowOverride None
</Directory>
<Directory /var/www/wallbase>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>
ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
AllowOverride None
Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
Order allow,deny
Allow from all
</Directory>
ErrorLog ${APACHE_LOG_DIR}/error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# A self-signed (snakeoil) certificate can be created by installing
# the ssl-cert package. See
# /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
# If both key and certificate are stored in the same file, only the
# SSLCertificateFile directive is needed.
SSLCertificateFile /etc/apache2/ssl/server.crt
SSLCertificateKeyFile /etc/apache2/ssl/server.key
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
#SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
# Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath /etc/ssl/certs/
#SSLCACertificateFile /etc/apache2/ssl.crt/ca-bundle.crt
# Certificate Revocation Lists (CRL):
# Set the CA revocation path where to find CA CRLs for client
# authentication or alternatively one huge file containing all
# of them (file must be PEM encoded)
# Note: Inside SSLCARevocationPath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCARevocationPath /etc/apache2/ssl.crl/
#SSLCARevocationFile /etc/apache2/ssl.crl/ca-bundle.crl
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# Access Control:
# With SSLRequire you can do per-directory access control based
# on arbitrary complex boolean expressions containing server
# variable checks and other lookup directives. The syntax is a
# mixture between C and Perl. See the mod_ssl documentation
# for more details.
#<Location />
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#</Location>
# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o StrictRequire:
# This denies access when "SSLRequireSSL" or "SSLRequire" applied even
# under a "Satisfy any" situation, i.e. when it applies access is denied
# and no other module can change it.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory /usr/lib/cgi-bin>
SSLOptions +StdEnvVars
</Directory>
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>
</IfModule>
Kod: Zaznacz cały
Active Internet connections (only servers)Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 2442/smbd
tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1752/rpcbind
tcp 0 0 0.0.0.0:49680 0.0.0.0:* LISTEN 1784/rpc.statd
tcp 0 0 192.168.1.136:53 0.0.0.0:* LISTEN 2184/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 2184/named
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2486/sshd
tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 2418/postgres
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 2773/exim4
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 2184/named
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 2442/smbd
tcp 0 0 0.0.0.0:901 0.0.0.0:* LISTEN 2382/inetd
tcp6 0 0 :::139 :::* LISTEN 2442/smbd
tcp6 0 0 :::111 :::* LISTEN 1752/rpcbind
tcp6 0 0 :::80 :::* LISTEN 3173/apache2
tcp6 0 0 :::53 :::* LISTEN 2184/named
tcp6 0 0 :::22 :::* LISTEN 2486/sshd
tcp6 0 0 ::1:5432 :::* LISTEN 2418/postgres
tcp6 0 0 ::1:25 :::* LISTEN 2773/exim4
tcp6 0 0 ::1:953 :::* LISTEN 2184/named
tcp6 0 0 :::443 :::* LISTEN 3173/apache2
tcp6 0 0 :::445 :::* LISTEN 2442/smbd
tcp6 0 0 :::48581 :::* LISTEN 1784/rpc.statd
Kod: Zaznacz cały
root 3173 0.0 0.8 8996 3904 ? Ss 17:35 0:00 /usr/sbin/apache2 -k startwww-data 3178 0.0 0.5 8280 2348 ? S 17:35 0:00 /usr/sbin/apache2 -k start
www-data 3193 0.0 0.7 230588 3164 ? Sl 17:35 0:00 /usr/sbin/apache2 -k start
www-data 3194 0.0 0.7 230700 3400 ? Sl 17:35 0:00 /usr/sbin/apache2 -k start
root 3621 0.0 0.1 3556 740 pts/1 S+ 17:50 0:00 grep apache2
Widać iż apache2 nasłuchuje na porcie. Więc pod tym względem jest ok.
Jak się dostajesz na stronę? Wpisujesz https://www.mojastrona.ddns.net
Spróbuj wpisać adres ip.
Zakomentować
Zerknij do katalogu /var/log/apache2/error.log
Jak się dostajesz na stronę? Wpisujesz https://www.mojastrona.ddns.net
Spróbuj wpisać adres ip.
Zakomentować
Kod: Zaznacz cały
# ServerName www.mojastrona.ddns.netZerknij do katalogu /var/log/apache2/error.log
-
imperatorus
- Posty: 3
- Rejestracja: 27 października 2014, 18:15
Dzieki za zainteresowanie
na strone wchodze tak jak napisales: https://mojastrona.ddns.net i pojawia sie: Web page is not available, tak samo jest jak wpisze IP https://111.222.333.444
Moze problem zaczyna sie przy tworzeniu certyfikatu? Jako adres strony Common Name wpisuje po prostu mojastrona.ddns.net.
error.log daje to:
na strone wchodze tak jak napisales: https://mojastrona.ddns.net i pojawia sie: Web page is not available, tak samo jest jak wpisze IP https://111.222.333.444
Moze problem zaczyna sie przy tworzeniu certyfikatu? Jako adres strony Common Name
Kod: Zaznacz cały
openssl req -x509 -nodes -days 1095 -newkey rsa:2048 -out /etc/apache2/ssl/server.crt -keyout /etc/apache2/ssl/server.keyerror.log daje to:
Kod: Zaznacz cały
[Fri Oct 24 13:08:26 2014] [notice] Apache/2.2.22 (Debian) configured -- resuming normal operations[Fri Oct 24 13:40:42 2014] [notice] caught SIGTERM, shutting down
[Fri Oct 24 13:41:32 2014] [notice] Apache/2.2.22 (Debian) configured -- resuming normal operations
[Fri Oct 24 13:51:22 2014] [notice] caught SIGTERM, shutting down
[Fri Oct 24 13:52:11 2014] [notice] Apache/2.2.22 (Debian) configured -- resuming normal operations
[Fri Oct 24 15:11:21 2014] [error] [client 192.168.1.104] File does not exist: /var/www/storage
[Fri Oct 24 15:28:36 2014] [error] [client 192.168.1.139] File does not exist: /var/www/storage
[Fri Oct 24 15:28:36 2014] [error] [client 192.168.1.139] File does not exist: /var/www/storage
[Fri Oct 24 15:28:36 2014] [error] [client 192.168.1.139] File does not exist: /var/www/favicon.ico
[Fri Oct 24 15:31:34 2014] [error] [client 192.168.1.139] File does not exist: /var/www/storage
[Fri Oct 24 15:31:34 2014] [error] [client 192.168.1.139] File does not exist: /var/www/favicon.ico
[Fri Oct 24 16:43:35 2014] [error] [client 192.168.1.104] File does not exist: /var/www/info.php
[Fri Oct 24 16:43:36 2014] [error] [client 192.168.1.104] File does not exist: /var/www/favicon.ico
[Fri Oct 24 16:47:17 2014] [notice] caught SIGTERM, shutting down
[Sat Oct 25 19:40:07 2014] [notice] Apache/2.2.22 (Debian) configured -- resuming normal operations
[Sat Oct 25 19:53:46 2014] [error] [client 192.168.1.104] File does not exist: /var/www/storage
[Sat Oct 25 19:53:46 2014] [error] [client 192.168.1.104] File does not exist: /var/www/favicon.ico
[Sat Oct 25 19:57:09 2014] [error] [client 192.168.1.104] File does not exist: /var/www/storage
[Sat Oct 25 19:57:11 2014] [error] [client 192.168.1.104] File does not exist: /var/www/storage