* [Comm] ssl with vhost
@ 2005-11-18 9:08 Alexey Morsov
2005-11-18 11:00 ` Alexey Borovskoy
0 siblings, 1 reply; 3+ messages in thread
From: Alexey Morsov @ 2005-11-18 9:08 UTC (permalink / raw)
To: ALTLinux Community
[-- Attachment #1.1: Type: text/plain, Size: 1060 bytes --]
Привет,
Не могу добить проблемы подключения ssl к vhost на apache
(вирт хосты разделяются и работают, но без ssl)
В активе:
vhost, namebased (знаю знаю что ssl будет только у одного, для которого
сертификат)
при старте апача ssl движок пишет что все ок, что все сошлось и
проинициализировалось.
Сертификат создан для CN=localhost, ServerName у апача localhost и
обращаюсь я именно к localhost но ssl сессии не открывается.
443 порт открыт.
В чем еще может быть проблема?
прикладываю свой Vhost.conf и ssl.vhost
PS: вы принципе это мне для отладки локально программирования под сайт.
Сам сайт с ssl работает замечательно. Но хотелось бы выяснить и на будущее
(вдруг виртуальный хостинг сделаю для регионалов)
--
С уважением,
Алексей Морсов
системный администратор ЗАО "ИК "Риком-Траст"
ICQ: 196-766-290
Jabber: samurai@www.fondmarket.ru
www.ricom.ru
www.fondmarket.ru
* gvy раздумывает, чем бы таким стукнуть alterator
<dmi> kick, ban, kill?
<BK_man> alterator: shut up!
<raorn> alterator: quiet
<alterator> OK
[-- Attachment #1.2: ssl.default-vhost.conf --]
[-- Type: text/plain, Size: 6842 bytes --]
##
## SSL Virtual Host Context
##
<VirtualHost 127.0.0.1>
# General setup for the virtual host
DocumentRoot /var/www/html
ServerName localhost
#ServerAdmin you@your.address
ErrorLog logs/ssl-error_log
TransferLog logs/ssl-access_log
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
# See the mod_ssl documentation for a complete list.
#SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
# Server Certificate:
# Point SSLCertificateFile at a PEM encoded certificate. If
# the certificate is encrypted, then you will be prompted for a
# pass phrase. Note that a kill -HUP will prompt again. A test
# certificate can be generated with `make certificate' under
# built time.
SSLCertificateFile conf/ssl/server.crt
# Server Private Key:
# If the key is not combined with the certificate, use this
# directive to point at the key file.
SSLCertificateKeyFile conf/ssl/server.key
# Server Certificate Chain:
# Point SSLCertificateChainFile at a file containing the
# concatenation of PEM encoded CA certificates which form the
# certificate chain for the server certificate. Alternatively
# the referenced file can be the same as SSLCertificateFile
# when the CA certificates are directly appended to the server
# certificate for convinience.
#SSLCertificateChainFile @@ServerRoot@@/conf/ssl/ssl.crt/ca.crt
# Certificate Authority (CA):
# Set the CA certificate verification path where to find CA
# certificates for client authentication or alternatively one
# huge file containing all of them (file must be PEM encoded)
# Note: Inside SSLCACertificatePath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCACertificatePath @@ServerRoot@@/conf/ssl/ssl.crt
#SSLCACertificateFile @@ServerRoot@@/conf/sssl/sl.crt/ca-bundle.crt
# Certificate Revocation Lists (CRL):
# Set the CA revocation path where to find CA CRLs for client
# authentication or alternatively one huge file containing all
# of them (file must be PEM encoded)
# Note: Inside SSLCARevocationPath you need hash symlinks
# to point to the certificate files. Use the provided
# Makefile to update the hash symlinks after changes.
#SSLCARevocationPath @@ServerRoot@@/conf/ssl/ssl.crl
#SSLCARevocationFile @@ServerRoot@@/conf/ssl/ssl.crl/ca-bundle.crl
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional, require and optional_no_ca. Depth is a
# number which specifies how deeply to verify the certificate
# issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth 10
# Access Control:
# With SSLRequire you can do per-directory access control based
# on arbitrary complex boolean expressions containing server
# variable checks and other lookup directives. The syntax is a
# mixture between C and Perl. See the mod_ssl documentation
# for more details.
#<Location />
#SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
# and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
# and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
# and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
# and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
# or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#</Location>
# SSL Engine Options:
# Set various options for the SSL engine.
# FakeBasicAuth:
# Translate the client X.509 into a Basic Authorisation. This means that
# the standard Auth/DBMAuth methods can be used for access control. The
# user name is the `one line' version of the client's X.509 certificate.
# Note that no password is obtained from the user. Every entry in the user
# file needs this password: `xxj31ZMTZzkVA'.
# ExportCertData:
# This exports two additional environment variables: SSL_CLIENT_CERT and
# SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
# server (always existing) and the client (only existing when client
# authentication is used). This can be used to import the certificates
# into CGI scripts.
# CompatEnvVars:
# This exports obsolete environment variables for backward compatibility
# to Apache-SSL 1.x, mod_ssl 2.0.x, Sioux 1.0 and Stronghold 2.x. Use this
# to provide compatibility to existing CGI scripts.
# StrictRequire:
# This denies access when "SSLRequireSSL" or "SSLRequire" applied even
# under a "Satisfy any" situation, i.e. when it applies access is denied
# and no other module can change it.
# OptRenegotiate:
# This enables optimized SSL connection renegotiation handling when SSL
# directives are used in per-directory context.
#SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire
# SSL Protocol Adjustments:
# The safe and default but still SSL/TLS standard compliant shutdown
# approach is that mod_ssl sends the close notify alert but doesn't wait for
# the close notify alert from client. When you need a different shutdown
# approach you can use one of the following variables:
# ssl-unclean-shutdown:
# This forces an unclean shutdown when the connection is closed, i.e. no
# SSL close notify alert is send or allowed to received. This violates
# the SSL/TLS standard but is needed for some brain-dead browsers. Use
# this when you receive I/O errors because of the standard approach where
# mod_ssl sends the close notify alert.
# ssl-accurate-shutdown:
# This forces an accurate shutdown when the connection is closed, i.e. a
# SSL close notify alert is send and mod_ssl waits for the close notify
# alert of the client. This is 100% SSL/TLS standard compliant, but in
# practice often causes hanging connections with brain-dead browsers. Use
# this only for browsers where you know that their SSL implementation
# works correctly.
# Notice: Most problems of broken clients are also related to the HTTP
# keep-alive facility, so you usually additionally want to disable
# keep-alive for those clients, too. Use variable "nokeepalive" for this.
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
# Per-Server Logging:
# The home of a custom SSL log file. Use this when you want a
# compact non-error SSL logfile on a virtual host basis.
CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
[-- Attachment #1.3: Vhosts.conf --]
[-- Type: text/plain, Size: 1535 bytes --]
# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, in addition to the default. See also the VirtualHost command
#Listen 192.168.0.0:80
# VirtualHost: Allows the daemon to respond to requests for more than one
# server address, if your server machine is configured to accept IP packets
# for multiple addresses. This can be accomplished with the ifconfig
# alias flag, or through kernel patches like VIF.
# Any httpd.conf or srm.conf directive may go into a VirtualHost command.
# See also the BindAddress entry.
NameVirtualHost 127.0.0.1
<VirtualHost 127.0.0.1>
ServerName localhost
DocumentRoot /var/www/html
</VirtualHost>
<VirtualHost 127.0.0.1>
ServerName www.localhost
DocumentRoot /var/www/ricomtrust
DirectoryIndex index.shtml index.html
ScriptAlias /RicomTrust/ /var/www/ricomtrust/cgi-bin/
AddType text/html .shtml
AddHandler server-parsed .shtml
</VirtualHost>
<Directory /var/www/ricomtrust>
Options +Includes
</Directory>
################# IP-based Virtual Hosts
#<VirtualHost www.localhost>
#ServerAdmin webmaster@www.localhost
#DocumentRoot /var/www/ricomtrust
#ServerName www.localhost
#ErrorLog logs/www.localhost-error_log
#TransferLog logs/www.localhost-access_log
#ScriptAlias /cgi-bin/ /var/www/ricomtrust/cgi-bin/
#</VirtualHost>
################# Named VirtualHosts
#NameVirtualHost 127.0.0.1
#<VirtualHost 127.0.0.1>
#ServerName www.localhost
#ServerPath /var/www/ricomtrust
#DocumentRoot /var/www/ricomtrust
#</VirtualHost>
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 481 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Comm] ssl with vhost
2005-11-18 9:08 [Comm] ssl with vhost Alexey Morsov
@ 2005-11-18 11:00 ` Alexey Borovskoy
2005-11-18 14:05 ` Alexey Morsov
0 siblings, 1 reply; 3+ messages in thread
From: Alexey Borovskoy @ 2005-11-18 11:00 UTC (permalink / raw)
To: ALT Linux Community
[-- Attachment #1: Type: text/plain, Size: 954 bytes --]
* Пятница 18 Ноябрь 2005 21:08 Alexey Morsov
> Привет,
>
> Не могу добить проблемы подключения ssl к vhost на apache
> (вирт хосты разделяются и работают, но без ssl)
> В активе:
> vhost, namebased (знаю знаю что ssl будет только у одного, для
> которого сертификат)
> при старте апача ssl движок пишет что все ок, что все сошлось
> и проинициализировалось.
> Сертификат создан для CN=localhost, ServerName у апача
> localhost и обращаюсь я именно к localhost но ssl сессии не
> открывается. 443 порт открыт.
>
> В чем еще может быть проблема?
>
> прикладываю свой Vhost.conf и ssl.vhost
>
> PS: вы принципе это мне для отладки локально программирования
> под сайт. Сам сайт с ssl работает замечательно. Но хотелось бы
> выяснить и на будущее (вдруг виртуальный хостинг сделаю для
> регионалов)
<VirtualHost ip:443>
<VirtualHost ip:80>
а не просто
<VirtualHost ip>
--
Алексей.
GPG key fingerprint
949B BC0E 2C44 7528 4F63 2753 E37A 9E3F 11F3 BDE1
[-- Attachment #2: signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [Comm] ssl with vhost
2005-11-18 11:00 ` Alexey Borovskoy
@ 2005-11-18 14:05 ` Alexey Morsov
0 siblings, 0 replies; 3+ messages in thread
From: Alexey Morsov @ 2005-11-18 14:05 UTC (permalink / raw)
To: community
[-- Attachment #1: Type: text/plain, Size: 571 bytes --]
On Fri, Nov 18, 2005 at 11:00:10PM +1200, Alexey Borovskoy wrote:
>
> <VirtualHost ip:443>
> <VirtualHost ip:80>
>
> а не просто
>
> <VirtualHost ip>
>
Это где?
--
С уважением,
Алексей Морсов
системный администратор ЗАО "ИК "Риком-Траст"
ICQ: 196-766-290
Jabber: samurai@www.fondmarket.ru
www.ricom.ru
www.fondmarket.ru
<mouse> raorn: hi, я тут quakeforge на Zaurus'е запустил, правда после
ряда оптимизаций я смог получить прирост всего в 2 fps - теперь
у меня их 3 fps ;) а вот обычный sdlquake не завёлся :((
[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 481 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2005-11-18 14:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2005-11-18 9:08 [Comm] ssl with vhost Alexey Morsov
2005-11-18 11:00 ` Alexey Borovskoy
2005-11-18 14:05 ` Alexey Morsov
ALT Linux Community general discussions
This inbox may be cloned and mirrored by anyone:
git clone --mirror http://lore.altlinux.org/community/0 community/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 community community/ http://lore.altlinux.org/community \
mandrake-russian@linuxteam.iplabs.ru community@lists.altlinux.org community@lists.altlinux.ru community@lists.altlinux.com
public-inbox-index community
Example config snippet for mirrors.
Newsgroup available over NNTP:
nntp://lore.altlinux.org/org.altlinux.lists.community
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git