Client Site With SSL Not Working

Discussion in 'Installation/Configuration' started by John.Smith, Apr 3, 2011.

  1. John.Smith

    John.Smith New Member

    I am using ISPConfig Version: 2.2.38 on Fedora 14 x86_64. I log into the ISPConfig control panel as admin at https://server1.example.tld:81/. I click ISP Manager -> Sites Folder -> Site1 -> Basis Tab -> Check SSL -> Save. I am taken back to the ISP Manager home page. I must browse back to Site1 and then click on the SSL tab. I filled in the drop down box and the 5 text fields. I then select create certificate from the drop down box and click save. I am taken back to the ISP Manger home page and I must browse back to Site1, click on the SLL tab, then there are two textareas that are called SSL Request and SSL certificate and are filled in with information. I select save certificate from the drop down box and click save.

    Now when I browse to http://www.site1.com/ everything works normal. When I browse to https://www.site1.com/ I get unable to connect page.

    ---
    [root@pluto ~]# lynx https://www.site.com/

    Looking up www.site1.com
    Making HTTPS connection to www.site1.com
    Alert!: Unable to connect to remote host.

    lynx: Can't access startfile https://www.site1.com/
    ---

    I have replaced my domains with example and site1 for this post.

    Whenever I try to access Site1 using https there doesn't seem to be any errors generated in /var/log/httpd/error_log.

    Can anyone please give me some suggestions as to why I can't access Site1 using SSL, or where to start looking?
     
  2. falko

    falko Super Moderator ISPConfig Developer

    What's the output of
    Code:
    netstat -tap
    ?

    BTW, you don't have to select "Save" again after the initial creation of the certificate. "Save" is needed only if you use the CSR to get an official certificate from a trusted CA. You would then paste the official cert into the form and select "Save". See http://www.howtoforge.com/faq/14_49_en.html
     
  3. John.Smith

    John.Smith New Member

    netstat -tap

    falko,

    Thank you for the reply. Here is my netstat -tap.

    Code:
    [root@pluto ~]# netstat -tap
    Active Internet connections (servers and established)
    Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
    tcp        0      0 *:imap                      *:*                         LISTEN      1617/dovecot        
    tcp        0      0 *:81                        *:*                         LISTEN      1827/ispconfig_http 
    tcp        0      0 pluto.site1.com:domain    *:*                         LISTEN      2150/named          
    tcp        0      0 localhost.localdomai:domain *:*                         LISTEN      2150/named          
    tcp        0      0 *:ssh                       *:*                         LISTEN      1452/sshd           
    tcp        0      0 localhost.localdomain:ipp   *:*                         LISTEN      1236/cupsd          
    tcp        0      0 *:smtp                      *:*                         LISTEN      32696/master        
    tcp        0      0 localhost.localdomain:rndc  *:*                         LISTEN      2150/named          
    tcp        0      0 *:imaps                     *:*                         LISTEN      1617/dovecot        
    tcp        0      0 *:pop3s                     *:*                         LISTEN      1617/dovecot        
    tcp        0      0 *:mysql                     *:*                         LISTEN      1591/mysqld         
    tcp        0      0 *:pop3                      *:*                         LISTEN      1617/dovecot        
    tcp        1      0 pluto.site1.com:35533     24.143.206.49:http          CLOSE_WAIT  2822/clock-applet   
    tcp        0      0 pluto.site1.com:45791     gy-in-f102.1e100.net:http   TIME_WAIT   -                   
    tcp        0      0 *:imap                      *:*                         LISTEN      1617/dovecot        
    tcp        0      0 *:http                      *:*                         LISTEN      1967/httpd          
    tcp        0      0 *:ftp                       *:*                         LISTEN      378/proftpd: (accep 
    tcp        0      0 *:ssh                       *:*                         LISTEN      1452/sshd           
    tcp        0      0 pluto.site1.com:ipp       *:*                         LISTEN      1236/cupsd          
    tcp        0      0 *:smtp                      *:*                         LISTEN      32696/master        
    tcp        0      0 pluto.site1.com:rndc      *:*                         LISTEN      2150/named          
    tcp        0      0 *:imaps                     *:*                         LISTEN      1617/dovecot        
    tcp        0      0 *:pop3s                     *:*                         LISTEN      1617/dovecot        
    tcp        0      0 *:pop3                      *:*                         LISTEN      1617/dovecot        
    
    It appears that it isn't listening for https? How do i configure or start that?

    Thanks,
    John
     
    Last edited: May 24, 2011
  4. falko

    falko Super Moderator ISPConfig Developer

    Can you post your /etc/httpd/conf/httpd.conf? What's the output of
    Code:
    ls -la /etc/httpd/conf/
    ?
     
  5. John.Smith

    John.Smith New Member

    Code:
    [root@pluto ~]# ls -la /etc/httpd/conf/
    total 136
    drwxr-xr-x. 3 root root  4096 Apr  5 02:28 .
    drwxr-xr-x. 4 root root  4096 Apr  4 23:18 ..
    -rw-r--r--  1 root root 35976 Apr  5 01:47 httpd.conf
    -rw-r--r--  1 root root 35932 Mar 31 07:30 httpd.conf.31-03-11_07-30-18
    -rw-r--r--  1 root root 34464 Mar 31 07:30 httpd.conf.orig
    -rw-r--r--  1 root root 12958 Oct 27 06:05 magic
    drwxr-xr-x  2 root root  4096 Apr  3 03:57 vhosts
    
     
  6. falko

    falko Super Moderator ISPConfig Developer

    What's in your /etc/httpd/conf/httpd.conf? Do you have
    Code:
    Listen 443
    anywhere in your configuration?
     
  7. John.Smith

    John.Smith New Member

    No, I don't have that line. I'm pretty certain you don't want me to paste the 1058 lines in that file. Do you? It conatins a line towards the end that reads

    Code:
    Include /etc/httpd/conf/vhosts/Vhosts_ispconfig.conf
    
    I looked in the /etc/httpd/conf/vhosts/Vhosts_ispconfig.conf file , and all of my domains use port 80, except for the one that I setup to use SSL.

    I put

    in the /etc/httpd/conf/httpd.conf file, and restarted everything. Now it gives me this error,

    Code:
    [root@pluto ~]# lynx https://www.site1.com/
    
    Looking up www.site1.com
    Making HTTPS connection to www.site1.com
    Retrying connection without TLS.
    Looking up www.site1.com
    Making HTTPS connection to www.site1.com
    Alert!: Unable to make secure connection to remote host.
    
    lynx: Can't access startfile https://www.site1.com/
    
    What next?
     
    Last edited: May 24, 2011
  8. falko

    falko Super Moderator ISPConfig Developer

  9. John.Smith

    John.Smith New Member

    I reversed my previous step, by removing the Listen 443 line back out of my /etc/httpd/conf/httpd.conf file. Then I typed yum install mod_ssl. Then restarted. Now I can access the site using https. Now I have a new problem. I am hosting 8 competitors web sites. Only site1 requires to be able to connect using https. Whenever anyone accesses the other 7 web sites using https, they are connected securely to site1. I visit https://www.site2.com/ and site1's web site displays. Since they are competitors, this is bad. When I access any of the sites using http then everything is fine.

    What can I do now to fix the new problem?
     
    Last edited: Apr 7, 2011
  10. falko

    falko Super Moderator ISPConfig Developer

    You could set up a default SSL vhost that catches all connections that are not targeted at your SSL site.
     
  11. John.Smith

    John.Smith New Member

    1) Is this how ISPConfig is designed to work by default? If you set up site1 to use ssl then anyone trying to access any of the other sites securely will have site1's site displayed on their screen?

    2) Please explain how to set up a default SSL vhost that catches all connections that are not targeted at your SSL site.
     
  12. John.Smith

    John.Smith New Member

    1) Yes, no, maybe?
     
  13. till

    till Super Moderator Staff Member ISPConfig Developer

    Thats how the SSL protocol and apache are designed, its not specific to ispconfig. For that reason, you should not run other sites on the same IP address that you use for a ssl site.

    There is no such thing as a ssl default vhost as ssl sites are IP based and you have to use a dedicated IP address for them.
     
  14. John.Smith

    John.Smith New Member

    The information being presented couldn't be more contradictory.

    In the past I have never had a server that acted this way. If a person tried to visit a web site that didn't have an SSL cert then the user wouldn't have a different web site displayed. I will continue to work on this problem if anyone has any suggestions.

    Thanks.
     
  15. John.Smith

    John.Smith New Member

    This is solved.

    I setup a default SSL host by adding another web site. I made this web appear first in the httpd.conf file. Whatever web appears first in your conf file will automatically be the default web.

    Thanks everyone.
     

Share This Page