SSL 已停止工作

SSL 已停止工作

我的 SSL 突然停止为我的网站提供服务。这可能是因为我在服务器上安装了 nginx,然后使用 apt-get purge nginx* 卸载了它

大约 30 分钟的时间里,它为页面提供服务,而不是 Apache。在我清除它之后,Apache 几乎恢复正常。它仍然不会提供 SSL 内容,但它将为服务器上的其他虚拟主机提供服务。

我还确保我的端口 80 和 443 是开放的。

我现在启用了 3 个站点。当我启动 Apache 时,我没有收到任何错误消息。以下是 000-default.conf、default-ssl.conf 和 elaan.conf 的内容

000-默认.conf

<VirtualHost *:80>

ServerAdmin [email protected]
DocumentRoot /var/www/html/elaan/

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

默认 SSL 配置文件

<IfModule mod_ssl.c>
<VirtualHost _default_:443>
    ServerAdmin [email protected]
    ServerName elaan.com.tw:443

    DocumentRoot /var/www/html/elaan

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    SSLEngine on

    SSLCertificateFile /etc/apache2/ssl/ssl.crt
    SSLCertificateKeyFile /etc/apache2/ssl/private.key
        SSLCertificateChainFile /etc/apache2/ssl/sub.class1.server.ca.pem


    <FilesMatch "\.(cgi|shtml|phtml|php)$">
            SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
            SSLOptions +StdEnvVars
    </Directory>

    BrowserMatch "MSIE [2-6]" \
            nokeepalive ssl-unclean-shutdown \
            downgrade-1.0 force-response-1.0
    # MSIE 7 and newer should be able to use keepalive
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

</VirtualHost>
</IfModule>

配置文件

<VirtualHost *:80>

ServerAdmin [email protected]
ServerName elaan.com.tw
ServerAlias www.elaan.com.tw
DocumentRoot /var/www/html/elaan

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

当我运行服务 apache2 reload 时,所有这些站点都在 site-enabled 文件夹中,并且 error.log 文件中没有错误消息。

有人可以提供任何想法来进一步测试为什么 Apache 不从 https:// 提供服务吗?

# netstat -tlnp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      1003/sshd       
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1335/sendmail: MTA:
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      1104/mysqld     
tcp        0      0 127.0.0.1:587           0.0.0.0:*               LISTEN      1335/sendmail: MTA:
tcp6       0      0 :::22                   :::*                    LISTEN      1003/sshd       
tcp6       0      0 :::443                  :::*                    LISTEN      1443/apache2    
tcp6       0      0 :::80                   :::*                    LISTEN      1443/apache2 

端口配置文件

Listen 80

<IfModule ssl_module>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

ssl_引擎.log

[Tue Jul 14 12:18:18.811639 2015] [ssl:debug] [pid 11551] ssl_engine_pphrase.c(181): AH02199: SSL not enabled on vhost 127.0.1.1:80, skipping SSL setup
[Tue Jul 14 12:18:18.811892 2015] [ssl:debug] [pid 11551] ssl_engine_pphrase.c(239): AH02202: Init: Read server certificate from '/etc/apache2/ssl/ssl.crt'
[Tue Jul 14 12:18:18.812048 2015] [ssl:info] [pid 11551] AH01887: Init: Initializing (virtual) servers for SSL
[Tue Jul 14 12:18:18.812589 2015] [ssl:info] [pid 11551] AH01876: mod_ssl/2.4.7 compiled against Server: Apache/2.4.7, Library: OpenSSL/1.0.1f
[Tue Jul 14 12:18:18.836129 2015] [ssl:debug] [pid 11552] ssl_engine_pphrase.c(181): AH02199: SSL not enabled on vhost 127.0.1.1:80, skipping SSL setup
[Tue Jul 14 12:18:18.840838 2015] [ssl:debug] [pid 11552] ssl_engine_pphrase.c(239): AH02202: Init: Read server certificate from '/etc/apache2/ssl/ssl.crt'
[Tue Jul 14 12:18:18.841171 2015] [socache_shmcb:debug] [pid 11552] mod_socache_shmcb.c(389): AH00821: shmcb_init allocated 512000 bytes of shared memory
[Tue Jul 14 12:18:18.841180 2015] [socache_shmcb:debug] [pid 11552] mod_socache_shmcb.c(405): AH00822: for 511912 bytes (512000 including header), recommending 32 subcaches, 88 indexes each
[Tue Jul 14 12:18:18.841185 2015] [socache_shmcb:debug] [pid 11552] mod_socache_shmcb.c(438): AH00824: shmcb_init_memory choices follow
[Tue Jul 14 12:18:18.841189 2015] [socache_shmcb:debug] [pid 11552] mod_socache_shmcb.c(440): AH00825: subcache_num = 32
[Tue Jul 14 12:18:18.841193 2015] [socache_shmcb:debug] [pid 11552] mod_socache_shmcb.c(442): AH00826: subcache_size = 15992
[Tue Jul 14 12:18:18.841196 2015] [socache_shmcb:debug] [pid 11552] mod_socache_shmcb.c(444): AH00827: subcache_data_offset = 2128
[Tue Jul 14 12:18:18.841210 2015] [socache_shmcb:debug] [pid 11552] mod_socache_shmcb.c(446): AH00828: subcache_data_size = 13864
[Tue Jul 14 12:18:18.841214 2015] [socache_shmcb:debug] [pid 11552] mod_socache_shmcb.c(448): AH00829: index_num = 88
[Tue Jul 14 12:18:18.841286 2015] [socache_shmcb:info] [pid 11552] AH00830: Shared memory socache initialised
[Tue Jul 14 12:18:18.841290 2015] [ssl:info] [pid 11552] AH01887: Init: Initializing (virtual) servers for SSL
[Tue Jul 14 12:18:18.841851 2015] [ssl:info] [pid 11552] AH01876: mod_ssl/2.4.7 compiled against Server: Apache/2.4.7, Library: OpenSSL/1.0.1f
[Tue Jul 14 12:18:18.844054 2015] [mpm_prefork:notice] [pid 11552] AH00163: Apache/2.4.7 (Ubuntu) PHP/5.5.9-1ubuntu4.9 OpenSSL/1.0.1f configured -- resuming normal operations
[Tue Jul 14 12:18:18.844069 2015] [mpm_prefork:info] [pid 11552] AH00164: Server built: Mar 10 2015 13:05:59
[Tue Jul 14 12:18:18.844085 2015] [core:notice] [pid 11552] AH00094: Command line: '/usr/sbin/apache2'
[Tue Jul 14 12:18:18.844090 2015] [mpm_prefork:debug] [pid 11552] prefork.c(995): AH00165: Accept mutex: fcntl (default: sysvsem)

防火墙状态:

 To                         Action      From
 --                         ------      ----
[ 1] 22                         ALLOW IN    Anywhere
[ 2] 80                         ALLOW IN    Anywhere
[ 3] 443/tcp                    ALLOW IN    Anywhere
[ 4] 443/tcp                    ALLOW OUT   Anywhere (out)
[ 5] 587                        ALLOW OUT   Anywhere (out)
[ 6] 22 (v6)                    ALLOW IN    Anywhere (v6)
[ 7] 80 (v6)                    ALLOW IN    Anywhere (v6)
[ 8] 443/tcp (v6)               ALLOW IN    Anywhere (v6)
[ 9] 443/tcp (v6)               ALLOW OUT   Anywhere (v6) (out)
[10] 587 (v6)                   ALLOW OUT   Anywhere (v6) (out)

答案1

最后,我们将问题追溯到防火墙。我可以通过本地主机命令行进行连接,但无法通过远程机器进行连接。出于某种原因,禁用 ALLOW 443 OUT 规则成功解决了该问题。

相关内容