Apache2 + ssl through NAT

Discussion in 'Server Operation' started by mister.koz, Jun 11, 2008.

  1. mister.koz

    mister.koz New Member

    Sorry if this has been covered before, i searched for a while and couldn't find a solution.

    I have 3 domain names going to 3 external ip addresses going through the NAT to the web server inside. All was good until i wanted the 3 sites to have ssl certs.

    The certs are registerd, the domains are pointed to different IPs and the virtualhosts are workingish.

    It always get the result of the first ssl virtual host.

    I have the external ips resolving to the gate, the gate forwarding to 3 internal ips and the virtual hosts set to accept those internal ips and it still gets the the wrong vhost... any ideas what i am doing wrong?

    Here is the offending NAT line for the 1 of them
    virtual host:
     
  2. falko

    falko Super Moderator ISPConfig Developer

    You need one public IP address per SSL vhost.
     
  3. mister.koz

    mister.koz New Member

    Hey falko,

    Yeah i have a public ip for each domain, each public ip is routed by iptables to a local ip address on the same box (2 virtual) I have done a tcp dump and hit f5 a few times while accessing the 2 domains that have their own certificates and i can see that the requests hit apache with their relevant local ips as they should but the first vhost is the only one that is seen.

    I am using a CMS system that looks at the request URI to decide what site it is so the content is correct but the www.davisnet.co.nz site reports to have the www.weatherdata.co.nz ssl certificate.. its most annoying!

    My only assumption is that there is something wrong with apache or the ssl vhost settings...

    Ps. if i put the last vhost at the start, the problem is inverted...

    Its really annoying!
     
  4. mister.koz

    mister.koz New Member

    Ok, so now i am really confused!

    I have moved the hosted sites to a newer version of apache, running on the Gateway server.

    The gateway has about 15 public ips and 2 private ips.

    It doesn't matter which ip i use, it will always return the first :443 virtual host in the file.

    Apache is listening on all of these IP's :::::443 to be precise. I am totally confused now, in its simplicity it should just work.

    I must be doing something wrong?

    this is the first half of the only /sites-enabled/ file:

    Code:
    <IfModule mod_ssl.c>
    
    AddType application/x-x509-ca-cert .crt
    AddType application/x-pkcs7-crl    .crl
    
    SSLPassPhraseDialog  builtin
    
    SSLSessionCache         dbm:/var/run/ssl_scache
    SSLSessionCacheTimeout  300
    
    SSLMutex  file:/var/run/ssl_mutex
    
    SSLRandomSeed startup builtin
    SSLRandomSeed connect builtin
    </IfModule>
    
    ###
    ### WeatherData vhost
    ###
    
    NameVirtualHost 202.27.218.164:443
    <VirtualHost 202.27.218.164:443>
       ErrorLog /var/log/apache2/s_powersite5-error.log
       SSLEngine on
       SSLCertificateFile    /etc/apache2/ssl/weatherdata.co.nz.crt
       SSLCertificateKeyFile /etc/apache2/ssl/weatherdata.co.nz.key
       SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
       Include /etc/apache2/powersiteInclude
       ServerAlias www.weatherdata.co.nz
       ServerAlias weatherdata.co.nz
    </VirtualHost>
    
    ###
    ### Davisnet vhost
    ###
    
    NameVirtualHost 202.27.218.165:443
    <VirtualHost 202.27.218.165:443>
       ErrorLog /var/log/apache2/s_powersite5-error.log
       SSLEngine on
       SSLCertificateFile    /etc/apache2/ssl/davisnet.co.nz.crt
       SSLCertificateKeyFile /etc/apache2/ssl/davisnet.co.nz.key
       SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
       Include /etc/apache2/powersiteInclude
       ServerAlias www.davisnet.co.nz
       ServerAlias davisnet.co.nz
    </VirtualHost>
    
    anyone got any ideas?
     
  5. falko

    falko Super Moderator ISPConfig Developer

    What's the output of
    Code:
    ifconfig
    ?
     
  6. mister.koz

    mister.koz New Member

    Hey falko,

    To simplify routing i moved the websites to our gateway so now its listening on the public IPs and apache is listening on the right ports.

    Have updated to apache 2.2.3 on the chance that it was the apache version but the problem [persists, it must be a configuration error.

    ifconfig

    Code:
    eth0      Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.218.143  Bcast:202.27.218.191  Mask:255.255.255.192
              inet6 addr: fe80::204:23ff:fec4:5f3a/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:191439541 errors:0 dropped:0 overruns:0 frame:0
              TX packets:183719638 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:100
              RX bytes:3651188107 (3.4 GiB)  TX bytes:1735234654 (1.6 GiB)
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth0:0    Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.219.153  Bcast:202.27.218.191  Mask:255.255.255.255
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth0:1    Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.218.177  Bcast:202.27.218.191  Mask:255.255.255.255
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth0:2    Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.218.178  Bcast:202.27.218.191  Mask:255.255.255.255
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth0:3    Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.218.164  Bcast:202.27.218.191  Mask:255.255.255.255
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth0:4    Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.218.165  Bcast:202.27.218.191  Mask:255.255.255.255
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth0:5    Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.218.166  Bcast:202.27.218.191  Mask:255.255.255.255
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth0:6    Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.218.167  Bcast:202.27.218.191  Mask:255.255.255.255
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth0:7    Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.218.161  Bcast:202.27.218.191  Mask:255.255.255.255
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth0:8    Link encap:Ethernet  HWaddr 00:04:23:C4:5F:3A
              inet addr:202.27.218.162  Bcast:202.27.218.191  Mask:255.255.255.255
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              Base address:0x3080 Memory:d0240000-d0260000
    
    eth1      Link encap:Ethernet  HWaddr 00:04:23:C4:5F:39
              inet addr:10.0.0.1  Bcast:10.0.0.255  Mask:255.255.255.0
              inet6 addr: fe80::204:23ff:fec4:5f39/64 Scope:Link
              UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
              RX packets:266786329 errors:0 dropped:0 overruns:0 frame:0
              TX packets:271779331 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:1000
              RX bytes:2246381457 (2.0 GiB)  TX bytes:2068435776 (1.9 GiB)
              Base address:0x3040 Memory:d0220000-d0240000
    
    lo        Link encap:Local Loopback
              inet addr:127.0.0.1  Mask:255.0.0.0
              inet6 addr: ::1/128 Scope:Host
              UP LOOPBACK RUNNING  MTU:16436  Metric:1
              RX packets:101096 errors:0 dropped:0 overruns:0 frame:0
              TX packets:101096 errors:0 dropped:0 overruns:0 carrier:0
              collisions:0 txqueuelen:0
              RX bytes:9468670 (9.0 MiB)  TX bytes:9468670 (9.0 MiB)
     
  7. falko

    falko Super Moderator ISPConfig Developer

    There's no ServerName directive in your vhosts. Please add one. also, you can put all the ServerAliases in one line:
    Code:
    ServerAlias [url]www.davisnet.co.nz[/url] davisnet.co.nz
     
  8. mister.koz

    mister.koz New Member

    Put those in, it made no difference.

    Cheers for the heads up on the alias by the way, i didn't know that :)

    I am really confused now, i mean the ssl encap should query apache with the requested ip address and shouldn't that resolve the virtual host. Its almost like its getting the request but apache doesn't know which ip is being requested so its returning the first 443 vhost.

    Thank you for you help.
     
  9. mister.koz

    mister.koz New Member

    Ok, just tested accessing the server via ip address, i can confirm that the request is coming through on the correct IP. Regardless of what ip it comes from, it uses the first ssl virtualhost.

    If i change the order of the vhosts the problem is reversed, i.e. the site that reports the wrong cert works fine and the other one that was working fine all of a sudden complains about the wrong cert.

    I have re-written the apache host code and re-vised it allot but it seems to make no difference.

    Code:
    # Use this file if you're adding a domain to PowerSite - you'll need to add an alias for each domain
    # into both of the powersite virtual host statements below (one secure, one normal)
    # see the weatherdata.co.nz as an example
    
    <IfModule mod_ssl.c>
    
    AddType application/x-x509-ca-cert .crt
    AddType application/x-pkcs7-crl    .crl
    
    SSLPassPhraseDialog  builtin
    
    SSLSessionCache         dbm:/var/run/ssl_scache
    SSLSessionCacheTimeout  300
    
    SSLMutex  file:/var/run/ssl_mutex
    
    SSLRandomSeed startup builtin
    SSLRandomSeed connect builtin
    </IfModule>
    
    ###
    ### WeatherData vhost
    ###
    NameVirtualHost 202.27.218.164:443
    <VirtualHost 202.27.218.164:443>
       ServerName weatherdata.co.nz
       ErrorLog /var/log/apache2/s_powersite5-error.log
       SSLEngine on
       SSLCertificateFile    /etc/apache2/ssl/weatherdata.co.nz.crt
       SSLCertificateKeyFile /etc/apache2/ssl/weatherdata.co.nz.key
       SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
       Include /etc/apache2/powersiteInclude
       ServerAlias www.weatherdata.co.nz weatherdata.co.nz
    </VirtualHost>
    
    ###
    ### Davisnet vhost
    ###
    NameVirtualHost 202.27.218.165:443
    <VirtualHost 202.27.218.165:443>
       ServerName davisnet.co.nz
       ErrorLog /var/log/apache2/s_powersite5-error.log
       SSLEngine on
       SSLCertificateFile    /etc/apache2/ssl/davisnet.co.nz.crt
       SSLCertificateKeyFile /etc/apache2/ssl/davisnet.co.nz.key
       SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
       Include /etc/apache2/powersiteInclude
       ServerAlias www.davisnet.co.nz davisnet.co.nz
    </VirtualHost>
    
    It shouldn't be this hard?
     
  10. falko

    falko Super Moderator ISPConfig Developer

    It's working for me. I get two different sites for weatherdata.co.nz and davisnet.co.nz.
     
  11. mister.koz

    mister.koz New Member

    Thats because the CMS uses the request uri to determine the site, so regardless of which virtualhost it finds it will be the right site.

    Because they are both using the first ssl virtual host, the site is correct but its getting the wrong certificate.
     
  12. mister.koz

    mister.koz New Member

    Hey Falko,

    yeah its using the wrong one tho.
     
  13. falko

    falko Super Moderator ISPConfig Developer

    I have no idea why this is happening... :(
     
  14. mister.koz

    mister.koz New Member

    bummer :( neither can i...
     

Share This Page