apache - 在运行 Tomcat 的 EC2 实例上终止 HTTPS

Question

我正在尝试在使用 Elastic Beanstalk 部署的 AWS EC2 实例上启用 HTTPS。执行此操作的文档要求您添加 this snippet在应用程序根目录的目录 .ebextensions/https-instance.config 中。我必须分别用我的证书和 key 替换 certificate file contents 和 private key contents。我最初收到一个不正确的格式错误，所以我将他们提供的代码段转换为 JSON 并重新上传 -

{
  "files": {
    "/etc/httpd/conf.d/ssl.conf": {
      "owner": "root",
      "content": "LoadModule ssl_module modules/mod_ssl.so\nListen 443\n<VirtualHost *:443>\n  <Proxy *>\n    Order deny,allow\n    Allow from all\n  </Proxy>\n\n  SSLEngine             on\n  SSLCertificateFile    \"/etc/pki/tls/certs/server.crt\"\n  SSLCertificateKeyFile \"/etc/pki/tls/certs/server.key\"\n  SSLCipherSuite        EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH\n  SSLProtocol           All -SSLv2 -SSLv3\n  SSLHonorCipherOrder   On\n  \n  Header always set Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\"\n  Header always set X-Frame-Options DENY\n  Header always set X-Content-Type-Options nosniff\n  \n  ProxyPass / http://localhost:8080/ retry=0\n  ProxyPassReverse / http://localhost:8080/\n  ProxyPreserveHost on\n  \n</VirtualHost>\n",
      "group": "root",
      "mode": "000644"
    },
    "/etc/pki/tls/certs/server.crt": {
      "owner": "root",
      "content": "-----BEGIN CERTIFICATE-----\ncertificate file contents\n-----END CERTIFICATE-----\n",
      "group": "root",
      "mode": "000400"
    },
    "/etc/pki/tls/certs/server.key": {
      "owner": "root",
      "content": "-----BEGIN RSA PRIVATE KEY-----\nprivate key contents # See note below.\n-----END RSA PRIVATE KEY-----\n",
      "group": "root",
      "mode": "000400"
    }
  },
  "container_commands": {
    "killhttpd": {
      "command": "killall httpd"
    },
    "waitforhttpddeath": {
      "command": "sleep 3"
    }
  },
  "packages": {
    "yum": {
      "mod_ssl": []
    }
  }
}

部署因错误中止 -

[Instance: i-0x012x0123x012xyz] Command failed on instance. Return code: 1 Output: httpd: no process found. container_command killhttpd in my-app-name/.ebextensions/https-instance.config failed. For more detail, check /var/log/eb-activity.log using console or EB CLI.

我可以看出错误是由于 container_commands 键导致的，该键在配置后停止了 httpd 以便新的 https.conf并且可以使用证书。它告诉我它正试图终止 httpd 但它找不到任何正在运行的此类进程。 service httpd status 显示 httpd.worker (pid 0123) 正在运行，我也可以在线访问我的应用程序。 /var/log/eb-activity.log 也没有任何记录。

我看到其他一些人在网上发布了同样的问题，但我找不到任何解决方案。我在这里做错了什么吗？

Answer 1

您 ebextensions 正在尝试执行 killall httpd，但您的进程名为 httpd.worker。

将 ebextensions 中的行更改为 killall httpd.worker。