1

Trying the configure SSL on Apache2 on Ubuntu server installed Apache

sudo apt install apache2

Opened ufw firewall

sudo ufw allow 'Apache' ufw allow https

Installed SSL files in /root/cert

 chmod 400 /root/cert/* chmod 500 /root/cert/

In /etc/apache2/sites-available found two conf files: domainname.conf and default-ssl.conf DId not know which one to modify, so modified domainname.conf by adding following lines

 <VirtualHost *:443> SSLEngine on SSLCertificateFile /root/cert/ca-bundle.crt SSLCertificateKeyFile /root/cert/Private.key SSLCertificateChainFile /root/cert/certificate.crt </VirtualHost> apachectl configtest apachectl restart iptables -A INPUT -p tcp --dport 443 -j ACCEPT systemctl enable apache2 --now netstat -ntlp | grep 80 tcp6 0 0 :::80 :::* LISTEN 899/apache2 netstat -ntlp | grep 443 returns nothing

Added information - the website DNS resolution has not happened yet, because the nameserver is being changed. So I am checking on localhost. localhost:80 works, localhost:443 does not work gives error: localhost refused to connect

Several questions:

  1. have I switched files SSLCertificateFile SSLCertificateChainFile by mistake since I did not which one was which. Also it has comment statement -----BEGIN CERTIFICATE----- and -----BEGIN CERTIFICATE-----

  2. When I perform

    apache2ctl configtest it says AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.0.1. Set the 'ServerName' directive globally to suppress this message Syntax OK

Is this a problem since nameserver is still pointing to old provider and I am in process of switching to new provider nameserver where the new website is running.

Can anyone help?

Improve this question
2
  • just a thought ... SSL certificates are for a domain ... localhost is not the domain in the certificate ... so ... perhaps that's why whatever you are using to test is refusing to connect? hmm, just read it again, port 443 isn't even open Commented Nov 1, 2023 at 8:15
  • Looks like you are missing the Listen directive for that port somewhere. Commented Nov 1, 2023 at 18:48

4 Answers 4

Reset to default
2

If the Apache process is not listening on port 443 you are missing the Listen 443 directive in your configuration. It should be enabled by default if the ssl module is active, so make sure the module is loaded.

sudo a2enmod ssl
Improve this answer
9
  • This command worked. It said Enabling module SSL. Later I ran netstat -ntlp | grep 443 tcp6 0 0 :::443 :::* LISTEN 2897/apache2 Commented Nov 1, 2023 at 21:08
  • If I run localHost:80 it correctly shows my website. However if I run localhost:443 it shows default ubuntu page. How to switch ubuntu page to my website for port 443? Commented Nov 1, 2023 at 21:23
  • Your 443 virtualhost is rather empty. Copy the directives from the 80 virtualhost over. Commented Nov 2, 2023 at 6:16
  • 443 has all the directives from 80 and also inserted SSL commands, but still not working. Should I redirect port 80 to 443 or something? Commented Nov 2, 2023 at 16:06
  • How to redirect port 80 to 443 Commented Nov 2, 2023 at 16:15
2

Also (check other answers) you chould change the files in the config. This:

SSLCertificateFile /root/cert/ca-bundle.crt SSLCertificateKeyFile /root/cert/Private.key SSLCertificateChainFile /root/cert/certificate.crt

should be

SSLCertificateFile /root/cert/certificate.crt SSLCertificateKeyFile /root/cert/Private.key SSLCertificateChainFile /root/cert/ca-bundle.crt
Improve this answer
3
  • I did swap the certs as suggested Commented Nov 1, 2023 at 21:03
  • @vrao, check also the answer of Gerald to enable the ssl Commented Nov 1, 2023 at 21:06
  • 1
    Your suggestion helped. But more importantly Gerlad's command helped me enable SSL, so I accepted his answer. Commented Nov 1, 2023 at 21:11
0

Configuration from /etc/apache2/sites-available is not included in the apache2.conf, but configuration from /etc/apache2/sites-enabled. Create a symlink using

sudo a2ensite domainname
Improve this answer
0
0

It looks like your domainname.conf file is not enabled.

Checkout the /etc/apache2/sites-enabled and to find out which configuration file is enabled.

Improve this answer
1
  • it was domainname.conf Commented Nov 1, 2023 at 21:12

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.