php - 运行 PHP : "connection refused" error 的单个 EC2 Linux 实例上的 SSL

Question

我尝试在运行 PHP 的单个 EC2 Linux 实例上启用 SSL，但我收到“连接被拒绝”错误。

我按照以下说明启用 SSL:http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/SSL.SingleInstance.html

在第 4 步中，我完成了创建 .config 文件的步骤(我确保缩进是正确的)并将其放在 .ebextensions 文件夹中:http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/ssl-singleinstance-php.html

另外，我为 HTTPS 创建了一个新的安全组(入站 HTTPS | TCP | 443 | 0.0.0.0/0)。

提交更改后，我继续使用 aws.push 进行部署。部署成功(无错误)。但是，当我尝试在 http 和 https 上加载我的实例时，我看到了“拒绝连接”错误。

为了看看我是否可以恢复这种情况，我删除了 .config 文件并重新部署，但我仍然看到错误，该站点目前无法访问。

关于我可能做错了什么的任何想法？我阅读了类似问题中给出的答案，但找不到解决此问题的方法。我还想知道如何恢复配置以恢复网站。

这是我的配置文件:

Resources:
  sslSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

packages:
  yum:
    mod24_ssl : []

files:
  /etc/httpd/conf.d/ssl.conf:
    mode: "000644"
    owner: root
    group: root
    content: |
      LoadModule ssl_module modules/mod_ssl.so
      Listen 443
      <VirtualHost *:443>
        <Proxy *>
          Order deny,allow
          Allow from all
        </Proxy>

        SSLEngine             on
        SSLCertificateFile    "/etc/pki/tls/certs/server.crt"
        SSLCertificateKeyFile "/etc/pki/tls/certs/server.key"
        SSLCipherSuite        EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
        SSLProtocol           All -SSLv2 -SSLv3
        SSLHonorCipherOrder   On
        SSLSessionTickets     Off

        Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
        Header always set X-Frame-Options DENY
        Header always set X-Content-Type-Options nosniff

        ProxyPass / http://localhost:80/ retry=0
        ProxyPassReverse / http://localhost:80/
        ProxyPreserveHost on
        RequestHeader set X-Forwarded-Proto "https" early

        LogFormat "%h (%{X-Forwarded-For}i) %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\""
        ErrorLog /var/log/httpd/elasticbeanstalk-error_log
        TransferLog /var/log/httpd/elasticbeanstalk-access_log
      </VirtualHost>

  /etc/pki/tls/certs/server.crt:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN CERTIFICATE-----
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      mycertificateheremycertificateheremycertificateheremycertificate
      -----END CERTIFICATE-----

  /etc/pki/tls/certs/server.key:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN RSA PRIVATE KEY-----
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      myrsaprivatekeyheremyrsaprivatekeyheremyrsaprivatekeyheremyrsapr
      -----END RSA PRIVATE KEY-----

Answer 1

回答我自己的问题，因为它可能对其他人有帮助:

问题出在 Amazon Linux 服务器的版本上(2014 而不是 2015)。上面的配置文件不适用于 2014 服务器。