![非标准端口上的 SSL?](https://linux22.com/image/586488/%E9%9D%9E%E6%A0%87%E5%87%86%E7%AB%AF%E5%8F%A3%E4%B8%8A%E7%9A%84%20SSL%EF%BC%9F.png)
我在一台服务器上有两个不同的站点:a.com
和b.com
。
如果我在 ssl 端口上使用名为 virtualhost 的虚拟主机,IE 将无法工作。
因此,我决定使用端口 444 进行 SSL 连接b.com
。但是,似乎所有浏览器都给出了错误消息:
Chrome: Error 107 ssl protocol error
Firefox: Error code: ssl_error_rx_record_too_long
Epiphany: SSL handshake failed
嗯。。我不知道为什么,但我确实看到过一些网站可以像这样访问https://example.com:1443
。
或者我遗漏了什么?
端口.conf:
NameVirtualHost *:80
Listen 80
<IfModule mod_ssl.c>
# If you add NameVirtualHost *:443 here, you will also have to change
# the VirtualHost statement in /etc/apache2/sites-available/default-ssl
# to <VirtualHost *:443>
# Server Name Indication for SSL named virtual hosts is currently not
# supported by MSIE on Windows XP.
NameVirtualHost *:443
NameVirtualHost *:444
Listen 443
Listen 444
</IfModule>
<IfModule mod_gnutls.c>
Listen 443
Listen 444
</IfModule>
b.地点:
<VirtualHost *:444>
ServerName www.b.com:444
ServerAdmin [email protected]
LogLevel error
ErrorLog /var/log/apache2/b_error.log
CustomLog /var/log/apache2/b_access.log combined
DocumentRoot ...
<Directory ...>
Options Indexes FollowSymLinks MultiViews
AllowOverride None
Order allow,deny
allow from all
</Directory>
SSLEngine on
SSLCertificateFile /etc/ssl/certs/b.crt
SSLCertificateKeyFile /etc/ssl/private/b.pem
</VirtualHost>
CA 配置文件生成证书:
[ca]
default_ca = CA_default
[CA_default]
x509_extensions = root_ca_extensions
[req]
default_bits = 4096
default_keyfile =
distinguished_name = req_distinguished_name
attributes = req_attributes
prompt = no
x509_extensions = v3_ca
req_extensions = v3_req
[req_distinguished_name]
C = ...
ST = ..
O = ...
OU = ..
CN = ...
emailAddress = [email protected]
[req_attributes]
[root_ca_extensions]
basicConstraints = CA:true
[v3_ca]
basicConstraints = CA:true
[v3_req]
basicConstraints = CA:false
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names
[alt_names]
DNS.1 = b.com
DNS.2 = www.b.com
答案1
答案是肯定的。
这是我的错误,我已经127.0.0.1 www.b.com
在 中设置了/etc/hosts
。然后,无论我如何更改远程服务器中的 apache 配置文件,我的浏览器总是解析www.b.com
到我的本地主机,而那里有一个损坏的证书。
答案2
不能 100% 确定这是否是问题所在。但请尝试从 ServerName 行中删除 :444,使其看起来像
ServerName www.b.com
由于浏览器连接到该端口,因此不需要该端口,但无论使用哪个端口,主机头仍然是 www.b.com。