2

I have an app that has been running for 2 years now via http. Now we want to move to https for better security. Our OS is CentOS Linux 7. We have a virtual host config in /etc/httpd/sites-available with the content below:

<VirtualHost *:443>

    ServerName www.trade.xxx.com
    ServerAlias trade.xxx.com
    DocumentRoot /ims/www/trade.xxx.com/public_html/public
    SSLEngine on
    SSLCertificateFile /home/divo/ssl_cert/wildcard_eneo_cm.crt
    SSLCertificateKeyFile /home/divo/ssl_cert/wildcard_eneo_cm.key
    SSLCertificateChainFile /home/divo/ssl_cert/DigiCertCA.crt
    ErrorLog /ims/www/trade.xxx.com/error.log
    CustomLog /ims/www/trade.xxx.com/requests.log combined
    <Directory "/ims/www/trade.xxx.com/public_html/public">
        AllowOverride All
    </Directory>
</VirtualHost>

How ever when I visit https://trade.xxx.com, the browser just keeps loading and after some duration give ERR_CONNECTION_TIMED_OUT error.

What can be the issue?

Researching, I did the following:

Command 1

openssl x509 -in wildcard_xxx_com.crt -noout -subject

Output

subject= /CN=*.xxx.com

Command 2

Checking whether httpd is listening to port 443 and below is the result

tcp        0      0 0.0.0.0:111             0.0.0.0:*               LISTEN      1/systemd           
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      881/dnsmasq         
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      880/sshd            
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      1013/master         
tcp6       0      0 :::3306                 :::*                    LISTEN      905/mysqld          
tcp6       0      0 :::111                  :::*                    LISTEN      1/systemd           
tcp6       0      0 :::80                   :::*                    LISTEN      10409/httpd         
tcp6       0      0 :::53                   :::*                    LISTEN      881/dnsmasq         
tcp6       0      0 :::22                   :::*                    LISTEN      880/sshd            
tcp6       0      0 ::1:25                  :::*                    LISTEN      1013/master         
tcp6       0      0 :::443                  :::*                    LISTEN      10409/httpd  

Command 3

Check if fire wall is enabled

systemctl status firewalld

From the result below, firewall is not enable so is not a firewall issue

● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)

Command 4

Check if ssl is enabled in ssl.conf and below can clearly show is on

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

From the above, everything seems okay but I don't understand why doesn't work. Where am I having blind spot. What config is missing?

  • 1
    The firewall is running but is it blocking traffic on the port. Run iptables -L – Raman Sailopal Jan 25 '18 at 12:30
  • Anything interesting in the server's error logs? SELinux disabled or permissive, I guess? – Ulrich Schwarz Jan 25 '18 at 13:50
  • Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT tcp -- anywhere anywhere tcp dpt:https Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination – Fokwa Best Jan 25 '18 at 14:02
  • Hi @Raman Sailopal, the above is my result for iptables -L – Fokwa Best Jan 25 '18 at 14:08
  • Hi, @Ulrich Schwarz is enabled and is in Permissive mode. – Fokwa Best Jan 25 '18 at 14:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.