You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by David Pratt <fa...@eastlink.ca> on 2006/08/02 03:17:09 UTC
[users@httpd] Vitualhosts ssl and apache2
Hi I have a couple of questions. I am trying to set up my ssl on zope3
with apache2. I have zope (twisted) running on port 8080 and a secure
server running on port 8443. My sites are folders in the zope root. The
virtual host setup is below. The virtual hosts work fine on port 80
using www.mydomain.com and www.mydomain1.com
The virtual hosts fail on https://www.mydomain.com and
https://www.mydomain1.com
In my error log I have the errors:
proxy: error reading status line from remote server 127.0.0.1
proxy: Error reading from remote server returned by /
Can someone provide advice on properly configuring the secure virtual
hosts. Many thanks.
<VirtualHost *:80>
ServerName www.mydomain.com
ServerAlias am11727372.mydomain.com mydomain.com
RewriteEngine On
RewriteRule ^/(.*)
http://127.0.0.1:8080/am11727372/++vh++http:%{SERVER_NAME}:80/++/$1 [L,P]
</VirtualHost>
<VirtualHost *:80>
ServerName www.mydomain1.com
ServerAlias am12704055.mydomain1.com mydomain1.com
RewriteEngine On
RewriteRule ^/(.*)
http://127.0.0.1:8080/am12704055/++vh++http:%{SERVER_NAME}:80/++/$1 [L,P]
</VirtualHost>
<VirtualHost *:443>
ServerName www.mydomain.com
ServerAlias am11727372.mydomain.com mydomain.com
RewriteEngine On
RewriteRule ^/(.*)
http://127.0.0.1:8443/am11727372/++vh++http:%{SERVER_NAME}:443/++/$1 [L,P]
</VirtualHost>
<VirtualHost *:443>
ServerName www.mydomain1.com
ServerAlias am12704055.mydomain1.com mydomain1.com
RewriteEngine On
RewriteRule ^/(.*)
http://127.0.0.1:8443/am12704055/++vh++http:%{SERVER_NAME}:443/++/$1 [L,P]
</VirtualHost>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Vitualhosts ssl and apache2
Posted by David Pratt <fa...@eastlink.ca>.
This seems to be working for me testing the domain using a RewriteCond.
It brings up the message that the cert is not right for host but I am
not bothered by this at the moment. I simply want secure exchange for
login etc until I go from a virtual server with one ip to dedicated with
several ips.
Here I am rewriting from 8080 (regular port) as opposed to 8443 which is
the port the secure twisted server is running on. I can separate this
into separate virtual servers which would likely be best as you have
pointed out.
Regards
David
Vincent Bray wrote:
> On 8/2/06, David Pratt <fa...@eastlink.ca> wrote:
>> Hi Vincent, ok - I am trying something else that I have partially
>> working but I need something to fix my regex to catch to domain
>> properly. So may have need a RewriteCond that can compare domain name
>> coming in.
>>
>> Here is what I have got so far but since my regex is not right for
>> domains - it moves on to the last RewriteRule that I have set up which
>> places it in the zope root - but good thing is that ssl works properly.
>> So I need a proper regex that will catch the domain so it will land on
>> the right rewrite rule. Many thanks.
>
> Hi again,
> It's entirely unclear what you're trying to do here, and why you are
> using mod_rewrite to do it. If you need to differentiate the proxy
> address based on the host name, then you should be using multiple
> vhosts instead. As pointed out earlier though, this can't work on a
> single ip/port.
>
> In any case, if you really want to do this wrong, then
> RewriteCond %{HTTP_HOST} (.+)
> .. will allow you to read the hostname, putting the result in %1 for
> the following rule.
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: Re: [users@httpd] Vitualhosts ssl and apache2
Posted by Vincent Bray <no...@gmail.com>.
On 8/2/06, David Pratt <fa...@eastlink.ca> wrote:
> Hi Vincent, ok - I am trying something else that I have partially
> working but I need something to fix my regex to catch to domain
> properly. So may have need a RewriteCond that can compare domain name
> coming in.
>
> Here is what I have got so far but since my regex is not right for
> domains - it moves on to the last RewriteRule that I have set up which
> places it in the zope root - but good thing is that ssl works properly.
> So I need a proper regex that will catch the domain so it will land on
> the right rewrite rule. Many thanks.
Hi again,
It's entirely unclear what you're trying to do here, and why you are
using mod_rewrite to do it. If you need to differentiate the proxy
address based on the host name, then you should be using multiple
vhosts instead. As pointed out earlier though, this can't work on a
single ip/port.
In any case, if you really want to do this wrong, then
RewriteCond %{HTTP_HOST} (.+)
.. will allow you to read the hostname, putting the result in %1 for
the following rule.
--
noodl
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Vitualhosts ssl and apache2
Posted by David Pratt <fa...@eastlink.ca>.
Hi Vincent, ok - I am trying something else that I have partially
working but I need something to fix my regex to catch to domain
properly. So may have need a RewriteCond that can compare domain name
coming in.
Here is what I have got so far but since my regex is not right for
domains - it moves on to the last RewriteRule that I have set up which
places it in the zope root - but good thing is that ssl works properly.
So I need a proper regex that will catch the domain so it will land on
the right rewrite rule. Many thanks.
Regards,
David
<VirtualHost *:443>
RewriteEngine On
RewriteRule ^.*mydomain\.com/(.*)
http://127.0.0.1:8080/am11727372/++vh++https:www.mydomain.com:443/++/$1
[L,P]
RewriteRule ^.*mydomain1\.com/(.*)
http://127.0.0.1:8080/am12704055/++vh++https:www.mydomain1.com:443/++/$1
[L,P]
RewriteRule ^/(.*)
http://127.0.0.1:8080/++vh++https:%{HTTP_HOST}:443/++/$1 [L,P]
SSLEngine on
SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /usr/local/etc/apache2/ssl.crt/self_signed.cert
SSLCertificateKeyFile /usr/local/etc/apache2/ssl.key/self_signed.key
SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
SSLOptions +StdEnvVars
</Files>
<Directory /usr/local/www/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
</VirtualHost>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: Re: [users@httpd] Vitualhosts ssl and apache2
Posted by Vincent Bray <no...@gmail.com>.
On 8/2/06, David Pratt <fa...@eastlink.ca> wrote:
> Hi Vincent. I had found this example searching more but not sure it is
> of any value.
It may be of value but you should understand what it's doing. With
this setup there are two distinct ssl conversations going on. As
pointed out by the message linked to earier, this is usually
pointless.
--
noodl
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Vitualhosts ssl and apache2
Posted by David Pratt <fa...@eastlink.ca>.
Hi Vincent. I had found this example searching more but not sure it is
of any value.
Regards,
David
<VirtualHost 1.2.3.4:80>
ServerName webmail.example.org
DocumentRoot /var/www/html/exchange
RedirectMatch ^/(index.html?)$
https://webmail.example.org/exchange/
RedirectMatch ^/exchange$ https://webmail.example.org/exchange/
</VirtualHost>
<VirtualHost 1.2.3.4:443>
# This secures the server from being used as a third party
# proxy server
ProxyRequests Off
# Allows the proxying of a SSL connection
SSLProxyEngine On
ProxyVia On
DocumentRoot /home/user/mail_proxy/html/
RequestHeader set Front-End-Https "On"
ServerName mail
# Set up SSL to work with this host
SSLEngine On
SSLCertificateFile /etc/apache/webmail-proxy/server.crt
SSLCertificateKeyFile /etc/apache/webmail-proxy/server.key
SSLProxyMachineCertificateFile
/etc/apache/webmail-proxy/certnew.cer
ProxyPass /exchange/ https://mail-internal/exchange/
ProxyPassReverse /exchange/ https://mail-internal/exchange/
ProxyPass /exchweb/ https://mail-internal/exchweb/
ProxyPassReverse /exchweb/ https://mail-internal/exchweb/
ProxyPass /public/ https://mail-internal/public/
ProxyPassReverse /public/ https://mail-internal/public/
ProxyPreserveHost On
</VirtualHost>
Vincent Bray wrote:
> On 8/2/06, Vincent Bray <no...@gmail.com> wrote:
>> On 8/2/06, David Pratt <fa...@eastlink.ca> wrote:
>> > Hi Vincent. I have NameVirtualHost(s) set up as follows.
>> >
>> > NameVirtualHost *:80
>> > NameVirtualHost *.443
>> >
>> > Sorry I did not include this in my previous message. The twisted SSL
>> > server is pretty much stand alone and uses its own certificate source.
>> > What I want to do is have the server running on localhost:8443 proxied
>> > on 443 for a particular path. Will I still need Apache's SSLEngine for
>> > this?
> Hi,
> Looking in to this a little further (thanks google) has confirmed what
> I thought; that reverse proxying ssl is largely pointless. This rather
> old message explains the scenario:
>
> http://www.squid-cache.org/mail-archive/squid-users/200005/0744.html
>
> That leaves you either, a) forgetting about ssl authentication between
> the user agent and zope, b) exposing zope to the client directly, or
> c) using something at the tcp level to forward the encrypted
> connection to zope's port.
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: Re: Re: [users@httpd] Vitualhosts ssl and apache2
Posted by Vincent Bray <no...@gmail.com>.
On 8/2/06, Vincent Bray <no...@gmail.com> wrote:
> On 8/2/06, David Pratt <fa...@eastlink.ca> wrote:
> > Hi Vincent. I have NameVirtualHost(s) set up as follows.
> >
> > NameVirtualHost *:80
> > NameVirtualHost *.443
> >
> > Sorry I did not include this in my previous message. The twisted SSL
> > server is pretty much stand alone and uses its own certificate source.
> > What I want to do is have the server running on localhost:8443 proxied
> > on 443 for a particular path. Will I still need Apache's SSLEngine for
> > this?
Hi,
Looking in to this a little further (thanks google) has confirmed what
I thought; that reverse proxying ssl is largely pointless. This rather
old message explains the scenario:
http://www.squid-cache.org/mail-archive/squid-users/200005/0744.html
That leaves you either, a) forgetting about ssl authentication between
the user agent and zope, b) exposing zope to the client directly, or
c) using something at the tcp level to forward the encrypted
connection to zope's port.
--
noodl
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: Re: [users@httpd] Vitualhosts ssl and apache2
Posted by Vincent Bray <no...@gmail.com>.
On 8/2/06, David Pratt <fa...@eastlink.ca> wrote:
> Hi Vincent. I have NameVirtualHost(s) set up as follows.
>
> NameVirtualHost *:80
> NameVirtualHost *.443
>
> Sorry I did not include this in my previous message. The twisted SSL
> server is pretty much stand alone and uses its own certificate source.
> What I want to do is have the server running on localhost:8443 proxied
> on 443 for a particular path. Will I still need Apache's SSLEngine for
> this?
Yes you will, as the connection to apache uses the ssl protocol. I
don't know the details of setting up reverse ssl proxies, but I gather
there are extra steps involving SSLProxyEngine. Hopefully somebody
clueful on this subject will jump in now..
--
noodl
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Vitualhosts ssl and apache2
Posted by David Pratt <fa...@eastlink.ca>.
Hi Vincent. I have NameVirtualHost(s) set up as follows.
NameVirtualHost *:80
NameVirtualHost *.443
Sorry I did not include this in my previous message. The twisted SSL
server is pretty much stand alone and uses its own certificate source.
What I want to do is have the server running on localhost:8443 proxied
on 443 for a particular path. Will I still need Apache's SSLEngine for
this?
Regards,
David
Vincent Bray wrote:
> On 8/2/06, David Pratt <fa...@eastlink.ca> wrote:
>> Hi I have a couple of questions. I am trying to set up my ssl on zope3
>> with apache2. I have zope (twisted) running on port 8080 and a secure
>> server running on port 8443. My sites are folders in the zope root. The
>> virtual host setup is below. The virtual hosts work fine on port 80
>> using www.mydomain.com and www.mydomain1.com
>
> [snip]
>
> Hi,
> You have many problems here.. First you don't seem to have any
> NameVirtualHost directives to tell apache to use name virtual hosts.
> Second, when you sort that out you'll find that your vhosts aren't
> even running ssl (no SSLEngine On). Then, you're proxying to
> http://127.0.0.1:8443 meaning that you're speaking the wrong protocol
> to the backend. Of course, you also can't use name virtual hosts over
> ssl on the same ip/port.
>
> Some suggested reading:
> http://www.onlamp.com/pub/a/apache/2005/02/17/apacheckbk.html
> http://httpd.apache.org/docs/2.2/vhosts/
> http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Vitualhosts ssl and apache2
Posted by Vincent Bray <no...@gmail.com>.
On 8/2/06, David Pratt <fa...@eastlink.ca> wrote:
> Hi I have a couple of questions. I am trying to set up my ssl on zope3
> with apache2. I have zope (twisted) running on port 8080 and a secure
> server running on port 8443. My sites are folders in the zope root. The
> virtual host setup is below. The virtual hosts work fine on port 80
> using www.mydomain.com and www.mydomain1.com
[snip]
Hi,
You have many problems here.. First you don't seem to have any
NameVirtualHost directives to tell apache to use name virtual hosts.
Second, when you sort that out you'll find that your vhosts aren't
even running ssl (no SSLEngine On). Then, you're proxying to
http://127.0.0.1:8443 meaning that you're speaking the wrong protocol
to the backend. Of course, you also can't use name virtual hosts over
ssl on the same ip/port.
Some suggested reading:
http://www.onlamp.com/pub/a/apache/2005/02/17/apacheckbk.html
http://httpd.apache.org/docs/2.2/vhosts/
http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts
--
noodl
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org