Submitted by lp86 on Tue, 10/28/2014 - 11:41
I enabled SSL on a virtual site and was still getting a self signed certificate, after much headscratching I found a default SSL virtual host in "/etc/httpd/conf.d/ssl.conf". I just commented the whole virtualhost block and my virtual server was working properly.
Status:
Active
Comments
Submitted by JamieCameron on Tue, 10/28/2014 - 15:01 Comment #1
That odd - the SSL virtualhost added by Virtualmin should be matched before the default one.
Could you post the <virtualhost> lines for the default and for the domain?
Submitted by lp86 on Tue, 10/28/2014 - 16:42 Comment #2
Virtual Site:
<VirtualHost 1.2.3.4:443>SuexecUserGroup "#500" "#500"
ServerName virtualsite.com
ServerAlias www.virtualsite.com
DocumentRoot /home/serverowner/public_html
ErrorLog /var/log/virtualmin/virtualsite.com_error_log
CustomLog /var/log/virtualmin/virtualsite.com_access_log combined
DirectoryIndex index.html index.htm index.php index.php4 index.php5
<Directory /home/serverowner/public_html>
Options -Indexes +IncludesNOEXEC +SymLinksIfOwnerMatch
allow from all
AllowOverride All Options=Includes,IncludesNOEXEC,Indexes,MultiViews,SymLinksIfOwnerMatch
Require all granted
AddType application/x-httpd-php .php
AddHandler fcgid-script .php
AddHandler fcgid-script .php5
FCGIWrapper /home/serverowner/fcgi-bin/php5.fcgi .php
FCGIWrapper /home/serverowner/fcgi-bin/php5.fcgi .php5
</Directory>
RemoveHandler .php
RemoveHandler .php5
IPCCommTimeout 31
FcgidMaxRequestLen 1073741824
SSLEngine on
SSLCertificateFile /home/serverowner/ssl.cert
SSLCertificateKeyFile /home/serverowner/ssl.key
SSLCACertificateFile /home/serverowner/ssl.ca
SSLProtocol all -SSLv2 -SSLv3
</VirtualHost>
/etc/httpd/conf.d/ssl.conf, I had to comment out all of this to make the virtual site work, I was getting the above virtual sites files, but with the ssl certificate below.
#<VirtualHost _default_:443>
# General setup for the virtual host, inherited from global configuration
#DocumentRoot "/var/www/html"
#ServerName www.example.com:443
# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
#ErrorLog logs/ssl_error_log
#TransferLog logs/ssl_access_log
#LogLevel warn
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
#SSLEngine off
# SSL Protocol support:
# List the enable protocol levels with which clients will be able to
# connect. Disable SSLv2 access by default:
#SSLProtocol all -SSLv2
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
#SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
# Speed-optimized SSL Cipher configuration:
# If speed is your main concern (on busy HTTPS servers e.g.),
# you might want to force clients to specific, performance
# optimized ciphers. In this case, prepend those ciphers
# to the SSLCipherSuite list, and enable SSLHonorCipherOrder.
# Caveat: by giving precedence to RC4-SHA and AES128-SHA
# (as in the example below), most connections will no longer
# have perfect forward secrecy - if the server's key is
# compromised, captures of past or future traffic must be
# considered compromised, too.
#SSLCipherSuite RC4-SHA:AES128-SHA:HIGH:MEDIUM:!aNULL:!MD5
#SSLHonorCipherOrder on
# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A new
# certificate can be generated using the genkey(1) command.
#SSLCertificateFile /etc/pki/tls/certs/localhost.crt
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file. Keep in mind that if
# you've both a RSA and a DSA private key you can configure
# both in parallel (to also allow the use of DSA ciphers, etc.)
#SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
#SSLCACertificateFile /etc/pki/tls/certs/ca-bundle.crt
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# Access Control:
# With SSLRequire you can do per-directory access control based
# on arbitrary complex boolean expressions containing server
# variable checks and other lookup directives. The syntax is a
# mixture between C and Perl. See the mod_ssl documentation
# for more details.
#<Location />
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)/ \
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#</Location>
# SSL Engine Options:
# Set various options for the SSL engine.
# o FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# o ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# o StdEnvVars:
# This exports the standard SSL/TLS related `SSL_*' environment variables.
# Per default this exportation is switched off for performance reasons,
# because the extraction step is an expensive operation and is usually
# useless for serving static content. So one usually enables the
# exportation for CGI and SSI requests only.
# o StrictRequire:
# This denies access when "SSLRequireSSL" or "SSLRequire" applied even
# under a "Satisfy any" situation, i.e. when it applies access is denied
# and no other module can change it.
# o OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
#<Files ~ "\.(cgi|shtml|phtml|php3?)$">
# SSLOptions +StdEnvVars
#</Files>
#<Directory "/var/www/cgi-bin">
# SSLOptions +StdEnvVars
#</Directory>
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# o ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# o ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
# Similarly, one has to force some clients to use HTTP/1.0 to workaround
# their broken HTTP/1.1 implementation. Use variables "downgrade-1.0" and
# "force-response-1.0" for this.
#BrowserMatch "MSIE [2-5]" \
# nokeepalive ssl-unclean-shutdown \
# downgrade-1.0 force-response-1.0
# Per-Server Logging:
# The home of a custom SSL log file. Use this when you want a
# compact non-error SSL logfile on a virtual host basis.
#CustomLog logs/ssl_request_log \
# "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x "%r" %b"
#</VirtualHost>
Submitted by JamieCameron on Tue, 10/28/2014 - 22:12 Comment #3
Ok .. and when you accessed the site, was it via a domain name that resolved to the IP 1.2.3.4 ?
Submitted by lewisjenkins on Fri, 10/31/2014 - 17:11 Comment #4
If it helps, this certainly isn't new. It used to happen to me on Centos 6. I always fixed it exactly the same way, by editing /etc/httpd/conf.d/ssl.conf and removing the < VirtualHost default:443 > ... < /VirtualHost > block. I've just checked my old notes, it was a standard procedure on any new Centos install.
Submitted by endertech_rolmos on Wed, 11/05/2014 - 05:36 Comment #5
I've been experiencing the same issue with many new instances of CentOS 6, I believe for at least the past year.
In the forums I've seen various proposed solutions such as renaming the ssl.conf file but that breaks Apache because ssl.conf is the only config file that loads mod_ssl. "LoadModule ssl_module modules/mod_ssl.so".
It also wouldn't be a good idea because ssl.conf contains directives such as "SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)". The default is no session cache so there will be a performance impact because KeepAlive is off by default.
The "Include conf.d/*.conf" directive occurs around the middle of httpd.conf; much before the NameVirtualHost and VirtualHost directives.
Like lewisjenkins, I've also been commenting out the VirtualHost directive in ssl.conf, but I also need to comment the SSLEngine directive because otherwise it conflicts with other per-vhost SSLEngine directives.