4

I just re-installed httpd and created a static index.html file. I have firewalld configured to allow internet access to the https service. But when I type https://my.server.ip in a web browser, the browser gives an error saying it cannot connect with the server. What do I have to change in order for the browser to receive the index.html file?

Here is the firewalld definition for the public zone:

[username@my.server.ip]# firewall-cmd --list-all
public (default, active)
  interfaces: enp3s0
  sources: 
  services: https ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 

Here is the index.html file along with its location:

[username@my.server.ip]# cd /var/www/html
[username@my.server.ip html]# cat index.html
<html>
<body>
Understand that this is a test.  If this text appears in the browser, then https is working.
</body>
</html>

Here is the VirtualHost tag in httpd.conf:

<VirtualHost server.ip.address:443>
   DocumentRoot /var/www/html/
   SSLEngine on
   SSLProxyEngine on
   SSLCertificateFile /etc/pki/tls/certs/localhost.crt
   SSLCertificateChainFile /etc/pki/tls/certs/ca-bundle.crt
   SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
   # ProxyPass / http://localhost:8080/
   # ProxyPassReverse / http://localhost:8080/
</VirtualHost>  

Here is a link to the entire httpd.conf file.

EDIT #1

I am getting mixed results when I look to see what ssl is installed in the system. For example, nothing is listening on 443. Also, while systemctl cannot find openssl, yum seems to think that opensl is already installed. But I did confirm that the .crt files are all in their intended locations.

[root@1my-server-ip-addr ~]# netstat -na | grep 443.*LISTEN
[root@1my-server-ip-addr ~]# systemctl status openssl
openssl.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)

[root@1my-server-ip-addr ~]# yum install openssl
Loaded plugins: fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirrors.chkhosting.com
 * epel: mirror.nexcess.net
 * extras: ftpmirror.your.org
 * updates: centos.mbni.med.umich.edu
Package 1:openssl-1.0.1e-34.el7_0.6.x86_64 already installed and latest version
Nothing to do

EDIT #2

I also checked for mod_ssl and httpd status as follows:

[root@1my-server-ip-addr certs]# systemctl status mod_ssl.service
mod_ssl.service
   Loaded: not-found (Reason: No such file or directory)
   Active: inactive (dead)

[root@1my-server-ip-addr certs]# systemctl status httpd
httpd.service - The Apache HTTP Server
   Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
   Active: active (running) since Thu 2014-12-11 18:44:31 EST; 1h 54min ago
 Main PID: 4094 (httpd)
   Status: "Total requests: 0; Current requests/sec: 0; Current traffic:   0 B/sec"
   CGroup: /system.slice/httpd.service
           ├─4094 /usr/sbin/httpd -DFOREGROUND
           ├─4095 /usr/sbin/httpd -DFOREGROUND
           ├─4096 /usr/sbin/httpd -DFOREGROUND
           ├─4097 /usr/sbin/httpd -DFOREGROUND
           ├─4098 /usr/sbin/httpd -DFOREGROUND
           └─4099 /usr/sbin/httpd -DFOREGROUND

Dec 11 18:44:31 1my-server-ip-addr.static.servdns.com systemd[1]: Started The Apac...
Hint: Some lines were ellipsized, use -l to show in full.  

EDIT #3

I also tried the following, as per prateek61's advice:

[root@1my-server-ip-addr certs]# error_log
-bash: error_log: command not found
[root@1my-server-ip-addr certs]# access_log
-bash: access_log: command not found
[root@1my-server-ip-addr certs]# sestatus
SELinux status:                 disabled  

EDIT #4

I found the following in access_log. I am not sure how to interpret it because a lot of cinfigurations have been changed today, and some of these logs may have been generated under different configurations:

[Thu Dec 11 15:37:59.025223 2014] [mpm_prefork:notice] [pid 2627] AH00170:  caught SIGWINCH, shutting down gracefully
[Thu Dec 11 16:40:07.114619 2014] [mime:error] [pid 981] (2)No such file or directory: AH01597: could not open mime types config file /etc/httpd/conf/mime.types.
AH00016: Configuration Failed
[Thu Dec 11 16:43:30.051125 2014] [mime:error] [pid 1076] (2)No such file or directory: AH01597: could not open mime types config file /etc/httpd/conf/mime.types.
AH00016: Configuration Failed
[Thu Dec 11 18:44:31.845012 2014] [suexec:notice] [pid 4094] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Dec 11 18:44:31.891627 2014] [auth_digest:notice] [pid 4094] AH01757: generating secret for digest authentication ...
[Thu Dec 11 18:44:31.893061 2014] [lbmethod_heartbeat:notice] [pid 4094] AH02282: No slotmem from mod_heartmonitor
[Thu Dec 11 18:44:31.898347 2014] [mpm_prefork:notice] [pid 4094] AH00163: Apache/2.4.6 (CentOS) configured -- resuming normal operations
[Thu Dec 11 18:44:31.898394 2014] [core:notice] [pid 4094] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'  

EDIT #5

I ran yum remove mod_ssl httpd and then yum install mod_ssl httpd. I then opened my web browser and requested https server.ip.addr and got the same failure to connect message. However, the following logs were created:

access_log

::1 - - [11/Dec/2014:21:47:42 -0500] "OPTIONS * HTTP/1.0" 200 - "-"  "Apache/2.4.6 (CentOS) (internal dummy connection)"
::1 - - [11/Dec/2014:21:47:42 -0500] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (CentOS) (internal dummy connection)"
::1 - - [11/Dec/2014:21:47:42 -0500] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (CentOS) (internal dummy connection)"
::1 - - [11/Dec/2014:21:47:42 -0500] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (CentOS) (internal dummy connection)"
::1 - - [11/Dec/2014:21:47:42 -0500] "OPTIONS * HTTP/1.0" 200 - "-" "Apache/2.4.6 (CentOS) (internal dummy connection)"  

error_log

[Thu Dec 11 21:47:42.930487 2014] [mpm_prefork:notice] [pid 4094] AH00170: caught SIGWINCH, shutting down gracefully  

There were no changes to ssl_access_log, ssl_error_log or ssl_request_log.

I do not know if some of the new logs were created by the act of un-installing and then re-installing.


Partial Answer

Three steps got httpd to serve the index.html page when requested via https my.server.ip:

1.) yum remove mod_ssl httpd  
2.) yum install mod_ssl httpd  
3.) systemctl restart httpd.service  

But closer examination showed that removal of the VirtualHost directive and the Listen 443 from httpd.conf played a role in getting the static content to be served. When I added the VirtualHost directive back in, a new error was thrown.

I need the VirtualHost directive because the end goal is to serve up war files from tomcat when an https request for a given domain comes in from a web browser.

I did not try to put Listen 443 back into httpd.conf because a similar Listen directive is given in ssl.conf.

closed as off-topic by roaima, user88036, Isaac, G-Man, RalfFriedl Oct 1 '18 at 5:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – roaima, Community, Isaac, G-Man, RalfFriedl
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Does it work if you use regular HTTP? – Warren Young Dec 12 '14 at 0:31
  • What do you get for netstat -na | grep 443.*LISTEN? – Warren Young Dec 12 '14 at 0:32
  • 1
    log files, if selinux is enabled, etc. – llua Dec 12 '14 at 1:37
  • Have you installed mod_ssl? Also, what is the output of systemctl status httpd? – prateek61 Dec 12 '14 at 1:37
  • 1
    Glad it worked - not sure if I actually provided a solution however. So I would be unwilling to post that as an answer :). – prateek61 Dec 12 '14 at 3:50
0

You commented out the proxy listening on port 8080 in your above example. Is there a (reverse)proxy configured and still listening on the front end? In that case you should enable ssl on the front-end server and uncomment listening on 8080 as per your above example.

If there is no front-end proxy listening yet/at all: Make sure to to have ssl.conf configured again as you removed and reinstalled as per your description - which also removed the previously configured values and path to certs (which you created how?).

restart httpd and check syntax with httpd -t. If that returns Syntax OK I recommend a ping to see if that is going through at all. Should that be the case, pls. share your ssl.conf

Not the answer you're looking for? Browse other questions tagged or ask your own question.