Apache doesnt accept ssl on parts of the domain

Question

I have a problem with my Apache 2.4.18 server while using ssl encryption. My server setup is: the apache server redirects everything on port 80 (http) to port 443 (ssl), this I realized with different site configuration.

And now my problem is: if I open the link https://www.example.com, I get the website I want.

But if I open https://example.com, I get the error: ERR_CONNECTION_REFUSED

Why is that so, and how can I solve it?

Virtualhost file for ssl:

<IfModule mod_ssl.c>
    <VirtualHost *:443>
            ServerAdmin info@footprintgaming.de

            DocumentRoot /var/www/html



            ErrorLog ${APACHE_LOG_DIR}/error.log
            CustomLog ${APACHE_LOG_DIR}/access.log combined


            #   SSLCertificateFile directive is needed.
            SSLCertificateFile /etc/letsencrypt/live/footprintgaming.de/fullchain.pem
            SSLCertificateKeyFile /etc/letsencrypt/live/footprintgaming.de/privkey.pem



            #SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
            <FilesMatch "\.(cgi|shtml|phtml|php)$">
                            SSLOptions +StdEnvVars
            </FilesMatch>
            <Directory /usr/lib/cgi-bin>
                            SSLOptions +StdEnvVars
            </Directory>


     </VirtualHost>
 </IfModule>

  # vim: syntax=apache ts=4 sw=4 sts=4

Please show your configuration. – Alexander Tolkachev Aug 24 '17 at 15:44 — Alexander Tolkachev, Aug 24 '17 at 15:44
which of all those configurations? – MelcomX Aug 24 '17 at 16:26 — MelcomX, Aug 24 '17 at 16:26
Configuration for example.com. I think it would be vhost. – Alexander Tolkachev Aug 24 '17 at 16:27 — Alexander Tolkachev, Aug 24 '17 at 16:27
@AlexanderTolkachev I hope you mean this... – MelcomX Aug 24 '17 at 16:35 — MelcomX, Aug 24 '17 at 16:35

user · Answer 1 · 2017-08-24T17:56:59.600

0

footprintgaming.de has an A record pointing to 89.31.143.1, which appears to live at AS15598.

www.footprintgaming.de ultimately resolves to 46.5.192.81, which appears to live at AS29562.

Neither seems to have any associated IPv6 address record.

"Connection refused" means that the TCP SYN was responded to with a TCP RST/ACK. This typically happens when there is no listening socket bound to the IP address and TCP port in question, but may also be caused by firewalling.

I am able to connect to both just fine on port 80.

I am able to connect to the latter just fine on port 443, but not the former. This matches your results.

Some things to check:

Is the Apache instance listening on port 443? netstat -an | grep 443 will be a start.
Are there any relevant firewall rules in place? Assuming a moderately modern Linux, start with iptables -L -n and go from there. Other OSes will be similar yet different.
Is the mod_ssl module actually loaded? Try apachectl -M (and see here).
Silly, but has been known to happen: Have you reloaded the Apache configuration after editing it? apachectl configtest and apachectl graceful should be your friends.
Where is the ServerName for that virtual host? Check your apachectl -S output too. (This would normally cause you to get the wrong content or in this case a wrong HTTPS certificate, not a connection refused error, but I am including it because you're probably going to run into that the second you get a TCP connection...)

edited Aug 24 '17 at 17:56

answered Aug 24 '17 at 17:49

user

4,335
4
34
71

Thank you very much for your answer. After all this points, I believe the problem isn't the server itself, it's the dns-architecture(a little bit special) in front of it. But Thank you again... – MelcomX Aug 24 '17 at 20:24
1

In this setup your certificate is also not valid for footprintgaming.de because the certificate is only for www.footprintgaming.de (if without the www is not accessible than LetsEncrypt could not make the certificate include that name) – Lexib0y Aug 24 '17 at 20:51
@Lexib0y's comment is the most correct one. The other answer here by Michael contains alot of unnecessary step to verify thing that already works. For example that apache is listening on port 443? Ofcourse it does because www.footprintgaming.de does actually work! – Orphans Aug 25 '17 at 05:25
@Orphans *"For example that apache is listening on port 443? Ofcourse it does because www.footprintgaming.de does actually work!"* Please tell us how a server listening on one IP address and port necessarily implies that there is something listening on a different IP address but the same port, even on the same host. Right at the very top of my answer I mention that the two host names resolve to different IP addresses *in different ASes*. I do briefly discuss certificate validity, but I have yet to come across any system where using a wrong certificate causes the TCP connection to be *refused*. – user Aug 25 '17 at 10:03

Apache doesnt accept ssl on parts of the domain

1 Answers1