1

I'm running into some trouble with my Apache 2.4 config. Accessing https://subdomain.my-domain.com always returns this http 400.

Bad Request Your browser sent a request that this server could not understand. Reason: You're speaking plain HTTP to an SSL-enabled server port. Instead use the HTTPS scheme to access this URL, please.

I'm accessing my site via https directly so there is no redirect from http to https involved. Below my apache config. I'm aware that I don't check the certificates for validity. Right now they're just self signed but that will change in the future.

##################################################################
###                                                            ###
###   Global Settings                                          ###
###                                                            ###
##################################################################

    DocumentRoot /var/ebc/apache2/www/htdocs
    <Location /fwcheck.html>
        <RequireAll>
            Require all granted
        </RequireAll>
    </Location>

##################################################################
###                                                            ###
###   Global SSL Settings                                      ###
###                                                            ###
##################################################################

    SSLProtocol             ALL -SSLv2 -SSLv3
    SSLProxyProtocol        ALL -SSLv2 -SSLv3
    SSLHonorCipherOrder     on
    SSLCipherSuite          ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:HIGH:!MD5:!aNULL:!EDH
    SSLCompression          off
    SSLSessionTickets       off

    # OCSP Stapling, only in httpd 2.3.3 and later
    SSLUseStapling                      on
    SSLStaplingResponderTimeout         5
    SSLStaplingReturnResponderErrors    off
    SSLStaplingCache                    shmcb:/var/ebc/apache2/sslstaplingcache(128000)

##################################################################
###                                                            ###
###   Virtual Hosts                                            ###
###                                                            ###
##################################################################

<VirtualHost 10.173.144.43:80>
    ErrorLog /var/ebc/apache2/log/error.log
    CustomLog /var/ebc/apache2/log/access.log vhost_combined

    ##################################################################
    ###                                                            ###
    ###   Send everything to https except firewall check           ###
    ###   vhost config only for port 443 necessary.                ###
    ###   No further config for port 80.                           ###
    ###                                                            ###
    ##################################################################

        RewriteEngine On
        RewriteCond %{REQUEST_FILENAME} !fwcheck.html
        RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

    ##################################################################
</VirtualHost>

<VirtualHost 10.173.144.43:443>
    ServerName subdomain.my-domain.com
    ErrorLog /var/ebc/apache2/log/error.log
    CustomLog /var/ebc/apache2/log/access.log vhost_combined

    ##################################################################
    ###                                                            ###
    ###   SSL Settings                                             ###
    ###                                                            ###
    ##################################################################

        RequestHeader set ClientProtocol HTTPS
        SSLEngine       On
        SSLProxyEngine  On

        SSLCertificateFile      /var/ebc/apache2/ssl/subdomain.my-domain.com.crt
        SSLCertificateKeyFile   /var/ebc/apache2/ssl/subdomain.my-domain.com.key
        SSLCACertificateFile    /var/ebc/apache2/ssl/subdomain.my-domain.com.crt

        ProxyRequests       off
        ProxyPreserveHost   on

        # Disable certificate checks
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerName off

        # HSTS (15768000 seconds = 6 months)
        Header always set Strict-Transport-Security "max-age=15768000"

    ##################################################################
    ###                                                            ###
    ###   Locations                                                ###
    ###                                                            ###
    ##################################################################

        DocumentRoot /var/ebc/apache2/www/htdocs/prod

        <Location />
            Options None
            <RequireAll>
                Require all granted
            </RequireAll>
        </Location>

        <Location /web-status>
            <RequireAll>
                Require all denied
            </RequireAll>
        </Location>

        <Location /balancer-manager>
            <RequireAll>
                Require all denied
            </RequireAll>
        </Location>

    ##################################################################
</VirtualHost>

I don't really have an idea why this does not work. Can anyone give me a hint?

closed as off-topic by Jeff Schaller, slm Jun 30 '16 at 16:22

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions describing a problem that can't be reproduced and seemingly went away on its own (or went away when a typo was fixed) are off-topic as they are unlikely to help future readers." – Jeff Schaller, slm
If this question can be reworded to fit the rules in the help center, please edit the question.

1

Problem is solved. My apache config as posted above is correct. The problem was a false firewall configuration. Since I didn't change the firewall settings myself I cannot post the actual solution but as said the above apache config works.

0

Your connection does not arrive on interface 10.173.144.43:443 so it's not handled by your VirtualHost. It hits the main server configuration which does not have SSL enabled.

If you don't care what local interface is used, use a * in VirtualHost.

Perhaps your firewall change made is so that some inbound request now used the named interface/IP, but it will break as soon as you test from the command line with localhost.

-1

Are you trying to access you server via telnet? If so, that won't work correctly for secured pages (i.e. https).

You need to use tools designed to do so; e.g. the OpenSSL suite of tools.

Try the following set of commands instead:

  1. openssl s_client -connect <server>:<port>
  2. GET / HTTP/1.1
  • I'm accessing my server via browser. Here is the strange thing: If I'm accessing my server directly via ip (or rather hosts entry pointing subdomain.my-domain.com directly to the IP) it works. Without this I'm going through a firewall and then I get above mentioned error. – Sebastian Sommerfeld Jan 19 '16 at 8:53

Not the answer you're looking for? Browse other questions tagged or ask your own question.