apache - 让我们在 AWS Lightsail 的 bitnami.conf 中加密 SSL 设置

Question

我在 AWS Lightsail 中创建了一个新实例并配置了一个域 example.com，它也有 2 个子域。 test.example.com 和 app.example.com。

我删除了默认的 bitnami.conf 并创建了一个新的。这删除了预定义的 SSL 设置代码。我按照这个 tutorial 安装了 Lets encrypt .

这是我在添加 SSL 之前的 bitnami.conf 文件。我可以根据需要访问所有网站。

ServerName example.com

<VirtualHost *:80>

    ServerName example.com
       <Directory /opt/bitnami/apache2/htdocs/default_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>

    DocumentRoot /opt/bitnami/apache2/htdocs/default_website
</VirtualHost>



<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/app_website
    <Directory /opt/bitnami/apache2/htdocs/app_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName app.example.com

</VirtualHost>



<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/test_website
     <Directory /opt/bitnami/apache2/htdocs/test_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName test.example.com

</VirtualHost>

这是我添加 SSL 代码后的 bitnami.conf 文件。从 example.com 到 https://example.com 的重定向工作正常，但页面未加载 https。我遇到了 ERR_CONNECTION_REFUSED 错误。

新建 bitnami.conf 文件

ServerName example.com

<VirtualHost *:80>

    ServerName example.com
    RewriteEngine On
            RewriteCond %{HTTPS} !=on
            RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R,L]

       <Directory /opt/bitnami/apache2/htdocs/default_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>

    DocumentRoot /opt/bitnami/apache2/htdocs/default_website
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/opt/bitnami/apache2/htdocs/default_website"
SSLEngine on
SSLCertificateFile "/opt/bitnami/apache2/conf/server.crt"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/server.key"

<Directory "/opt/bitnami/apache2/htdocs/default_website">
Options Indexes FollowSymLinks
AllowOverride All
<IfVersion < 2.3 >
Order allow,deny
Allow from all
</IfVersion>
<IfVersion >= 2.3 >
Require all granted
</IfVersion>
</Directory>

# Error Documents
ErrorDocument 503 /503.html

# Bitnami applications installed with a prefix URL (default)
Include "/opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf"
</VirtualHost>



<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/app_website
    <Directory /opt/bitnami/apache2/htdocs/app_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName app.example.com
</VirtualHost>


<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/test_website
     <Directory /opt/bitnami/apache2/htdocs/test_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName test.example.com
</VirtualHost>

Answer 1

这里是 Bitnami 工程师。您还需要定义 Apache 将开始监听的新端口以及它将接受的不同密码和协议(protocol)。这些行包含在我们默认包含在堆栈中的 bitnami.conf 文件中

Listen 443
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !EDH !RC4"
SSLPassPhraseDialog  builtin
SSLSessionCache "shmcb:/opt/bitnami/apache2/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300

You will need to include them before defining the VirtualHost for the port 443

希望对你有帮助