apache - 在 AWS EC2 实例上启用 SSL

Question

在通过虚拟主机为多个域提供服务的 EC2 实例上，我设置了一个负载均衡器，用于将其中一个域的 HTTPS 流量从端口 :443 转发到 :8443，部分遵循以下示例:http://elwoodicious.com/2009/12/23/using-elb-to-serve-multiple-domains-over-ssl-on-ec2-for-giggles/

我工作的 httpd.conf 虚拟主机看起来像这样:

NameVirtualHost *:80
<VirtualHost *:80>
    ServerAdmin webmaster@domain.com
    DocumentRoot /var/www/domain.om
    ServerName domain.com
    ServerAlias *.domain.com
    ErrorLog logs/domain.com-error_log
    CustomLog logs/domain.com-access_log common
</VirtualHost>

# more VirtualHosts on *:80 here

现在，只要我为同一个 domain.com 添加一个新的虚拟主机，就像这样，

<VirtualHost _default_:8443>
    ServerAdmin webmaster@domain.com
    DocumentRoot /var/www/domain.om
    ServerName domain.com
    ServerAlias *.domain.com
    SSLEngine On
    RequestHeader set X_FORWARDED_PROTO 'https'
    ErrorLog logs/domain.com-https-error_log
    CustomLog logs/domain.com-https-access_log common
</VirtualHost>

...Apache 无法重新启动。没有错误通知 - 它只是说 [FAILED] .

我唯一的线索是:即使我删除了所有 *:80 虚拟主机并只为端口 *:8443 保留一个虚拟主机，Apache 也会失败...即使设置 NameVirtualHost *:8443 .

这是否意味着它是某种仅允许端口 80 上的虚拟主机的 EC2 指令？

感谢您的帮助!

---------------- 编辑:添加错误日志

var/log/httpd/error_log包含这个:

[Tue Jun 09 16:52:37 2015] [notice] caught SIGTERM, shutting down
[Tue Jun 09 16:52:37 2015] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue Jun 09 16:53:13 2015] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue Jun 09 16:53:47 2015] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue Jun 09 16:53:47 2015] [notice] Digest: generating secret for digest authentication ...
[Tue Jun 09 16:53:47 2015] [notice] Digest: done
[Tue Jun 09 16:53:47 2015] [notice] Apache/2.2.29 (Unix) DAV/2 PHP/5.3.29 mod_ssl/2.2.29 OpenSSL/1.0.1k-fips configured -- resuming normal operations

var/log/httpd/ssl_error_log包含这个:

[Tue Jun 09 16:53:47 2015] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Tue Jun 09 16:53:47 2015] [warn] RSA server certificate CommonName (CN) `ip-xx-xx-xx-xx' does NOT match server name!?

最后，var/log/httpd/domain.com-https-error_log看起来像这样:

[Tue Jun 09 16:53:13 2015] [error] Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile] (/etc/httpd/conf/httpd.conf:1026)

httpd.conf 的第 1026 行是 <VirtualHost _default_:8043> .我已经使用 aws cli 上传了我在本地计算机上创建的自签名 OpenSSL 证书。 ，我将它附加到负载均衡器以获取 HTTPS 流量。

域的 CNAME 记录也指向 ELB DNS 名称。不确定我错过了什么。

Answer 1

太棒了。错误消息有所帮助。您缺少两行:

SSLCertificateFile /directory/to/file.crt
SSLCertificateKeyFile /directory/to//file.key

Here's a howto on configuring SSL on Apache .