I have a setup where there are a number of Apache web servers behind a common Nginx reverse proxy server. But I can not access the web servers from the Internet. The access works fine on my local network, so I suspect my Apache setup is correct. But I'm not 100% sure as an attempt at internet connection triggers two error messages - one from the Nginx server and one from the Apache server.
The Nginx server reports the following error: "no ssl_certificate is defined in server listening on SSL port while SSL handshaking" and the Apache web server comes with this error: "authz_core error ... AH01630 client denied by server configuration".
The configuration of the Nginx reverse proxy server is divided into two files - one for HTTP traffic and one for HTTPS:
<example_dk_80.conf>:
server {
listen 80;
server_name example.dk www.example.dk;
return 301 https://$server_name$request_uri;
}
<example_dk_443.conf>:
server {
listen 443 ssl http2;
server_name example.dk www.example.dk;
add_header Strict-Transport-Security "max-age=31536000";
ssl on;
ssl_certificate /etc/ssl/certs/example_dk.crt;
ssl_certificate_key /etc/ssl/private/example_dk.key;
ssl_trusted_certificate /etc/ssl/certs/example_dk.ca-bundle;
ssl_protocols TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 172.16.1.10 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
location /.well-known {
alias /var/www/example_dk/.well-known;
}
location / {
proxy_pass http://172.16.1.51:443;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
My Apache web servers (with WordPress) are configured as follows:
<vhost.conf>:
DirectoryIndex index.php index.html
<VirtualHost *:80>
ServerName example.dk
ServerAlias www.example.dk
DocumentRoot "/var/www/example_dk"
<Directory "/var/www/example_dk">
AllowOverride All
Options Indexes FollowSymLinks MultiViews
AllowOverride All
Require all granted
</Directory>
</VirtualHost>
<VirtualHost *:443>
ServerName example.dk
ServerAlias www.example.dk
DocumentRoot "/var/www/example_dk"
SSLEngine on
SSLCipherSuite AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
SSLCompression off
SSLCertificateFile /etc/ssl/certs/example_dk.crt
SSLCertificateKeyFile /etc/ssl/private/example_dk.key
SSLCertificateChainFile /etc/ssl/certs/example_dk.ca-bundle
<Directory "/var/www/example_dk">
AllowOverride None
Options Indexes FollowSymLinks MultiViews
Require all granted
</Directory>
</VirtualHost>
I do not know if it makes a difference, but here is the htaccess file for my WordPress installation:
<.htaccess>:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
## Security
<Files xmlrpc.php>
Require all denied
</Files>
<Files wp-config.php>
Require all denied
</Files>
Options -Indexes
## SSL
#Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
## Force www
RewriteEngine on
RewriteCond %{HTTP_HOST} ^example.dk [NC]
RewriteRule ^(.*)$ http://www.example.dk/$1 [L,R=301,NC]
## Force https
RewriteEngine On
RewriteCond %{HTTP:X-Forwarded-Proto} !https
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
All my servers are running Ubuntu 18.04.