[Comm] ssl with vhost

Пт Ноя 18 12:08:23 MSK 2005

Привет,

Не могу добить проблемы подключения ssl к vhost на apache
(вирт хосты разделяются и работают, но без ssl)
В активе:
vhost, namebased (знаю знаю что ssl будет только у одного, для которого
сертификат)
при старте апача ssl движок пишет что все ок, что все сошлось и
проинициализировалось.
Сертификат создан для CN=localhost, ServerName у апача localhost и
обращаюсь я именно к localhost но ssl сессии не открывается.
443 порт открыт.

В чем еще может быть проблема?

прикладываю свой Vhost.conf и ssl.vhost

PS: вы принципе это мне для отладки локально программирования под сайт.
Сам сайт с ssl работает замечательно. Но хотелось бы выяснить и на будущее
(вдруг виртуальный хостинг сделаю для регионалов)

-- 

С уважением,
Алексей Морсов
системный администратор ЗАО "ИК "Риком-Траст"

ICQ: 196-766-290
Jabber: samurai на www.fondmarket.ru
www.ricom.ru
www.fondmarket.ru

* gvy раздумывает, чем бы таким стукнуть alterator
<dmi> kick, ban, kill?
<BK_man> alterator: shut up!
<raorn> alterator: quiet
<alterator> OK
----------- следующая часть -----------
##
## SSL Virtual Host Context
##

<VirtualHost 127.0.0.1>

#  General setup for the virtual host
DocumentRoot /var/www/html
ServerName localhost
#ServerAdmin you на your.address
ErrorLog logs/ssl-error_log
TransferLog logs/ssl-access_log

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   SSL Cipher Suite:
#   List the ciphers that the client is permitted to negotiate.
#   See the mod_ssl documentation for a complete list.
#SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL

#   Server Certificate:
#   Point SSLCertificateFile at a PEM encoded certificate.  If
#   the certificate is encrypted, then you will be prompted for a
#   pass phrase.  Note that a kill -HUP will prompt again. A test
#   certificate can be generated with `make certificate' under
#   built time.
SSLCertificateFile conf/ssl/server.crt

#   Server Private Key:
#   If the key is not combined with the certificate, use this
#   directive to point at the key file.
SSLCertificateKeyFile conf/ssl/server.key

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convinience.
#SSLCertificateChainFile @@ServerRoot@@/conf/ssl/ssl.crt/ca.crt

#   Certificate Authority (CA):
#   Set the CA certificate verification path where to find CA
#   certificates for client authentication or alternatively one
#   huge file containing all of them (file must be PEM encoded)
#   Note: Inside SSLCACertificatePath you need hash symlinks
#         to point to the certificate files. Use the provided
#         Makefile to update the hash symlinks after changes.
#SSLCACertificatePath @@ServerRoot@@/conf/ssl/ssl.crt
#SSLCACertificateFile @@ServerRoot@@/conf/sssl/sl.crt/ca-bundle.crt

#   Certificate Revocation Lists (CRL):
#   Set the CA revocation path where to find CA CRLs for client
#   authentication or alternatively one huge file containing all
#   of them (file must be PEM encoded)
#   Note: Inside SSLCARevocationPath you need hash symlinks
#         to point to the certificate files. Use the provided
#         Makefile to update the hash symlinks after changes.
#SSLCARevocationPath @@ServerRoot@@/conf/ssl/ssl.crl
#SSLCARevocationFile @@ServerRoot@@/conf/ssl/ssl.crl/ca-bundle.crl

#   Client Authentication (Type):
#   Client certificate verification type and depth.  Types are
#   none, optional, require and optional_no_ca.  Depth is a
#   number which specifies how deeply to verify the certificate
#   issuer chain before deciding the certificate is not valid.
#SSLVerifyClient require
#SSLVerifyDepth  10

#   Access Control:
#   With SSLRequire you can do per-directory access control based
#   on arbitrary complex boolean expressions containing server
#   variable checks and other lookup directives.  The syntax is a
#   mixture between C and Perl.  See the mod_ssl documentation
#   for more details.
#<Location />
#SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
#            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
#            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
#            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
#            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
#           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
#</Location>

#   SSL Engine Options:
#   Set various options for the SSL engine.
#   FakeBasicAuth:
#     Translate the client X.509 into a Basic Authorisation.  This means that
#     the standard Auth/DBMAuth methods can be used for access control.  The
#     user name is the `one line' version of the client's X.509 certificate.
#     Note that no password is obtained from the user. Every entry in the user
#     file needs this password: `xxj31ZMTZzkVA'.
#   ExportCertData:
#     This exports two additional environment variables: SSL_CLIENT_CERT and
#     SSL_SERVER_CERT. These contain the PEM-encoded certificates of the
#     server (always existing) and the client (only existing when client
#     authentication is used). This can be used to import the certificates
#     into CGI scripts.
#   CompatEnvVars:
#     This exports obsolete environment variables for backward compatibility
#     to Apache-SSL 1.x, mod_ssl 2.0.x, Sioux 1.0 and Stronghold 2.x. Use this
#     to provide compatibility to existing CGI scripts.
#   StrictRequire:
#     This denies access when "SSLRequireSSL" or "SSLRequire" applied even
#     under a "Satisfy any" situation, i.e. when it applies access is denied
#     and no other module can change it.
#   OptRenegotiate:
#     This enables optimized SSL connection renegotiation handling when SSL
#     directives are used in per-directory context. 
#SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire

#   SSL Protocol Adjustments:
#   The safe and default but still SSL/TLS standard compliant shutdown
#   approach is that mod_ssl sends the close notify alert but doesn't wait for
#   the close notify alert from client. When you need a different shutdown
#   approach you can use one of the following variables:
#   ssl-unclean-shutdown:
#     This forces an unclean shutdown when the connection is closed, i.e. no
#     SSL close notify alert is send or allowed to received.  This violates
#     the SSL/TLS standard but is needed for some brain-dead browsers. Use
#     this when you receive I/O errors because of the standard approach where
#     mod_ssl sends the close notify alert.
#   ssl-accurate-shutdown:
#     This forces an accurate shutdown when the connection is closed, i.e. a
#     SSL close notify alert is send and mod_ssl waits for the close notify
#     alert of the client. This is 100% SSL/TLS standard compliant, but in
#     practice often causes hanging connections with brain-dead browsers. Use
#     this only for browsers where you know that their SSL implementation
#     works correctly. 
#   Notice: Most problems of broken clients are also related to the HTTP
#   keep-alive facility, so you usually additionally want to disable
#   keep-alive for those clients, too. Use variable "nokeepalive" for this.
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

#   Per-Server Logging:
#   The home of a custom SSL log file. Use this when you want a
#   compact non-error SSL logfile on a virtual host basis.
CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>                                  

----------- следующая часть -----------
# Listen: Allows you to bind Apache to specific IP addresses and/or
# ports, in addition to the default. See also the VirtualHost command

#Listen 192.168.0.0:80

# VirtualHost: Allows the daemon to respond to requests for more than one
# server address, if your server machine is configured to accept IP packets
# for multiple addresses. This can be accomplished with the ifconfig 
# alias flag, or through kernel patches like VIF.

# Any httpd.conf or srm.conf directive may go into a VirtualHost command.
# See also the BindAddress entry.

NameVirtualHost 127.0.0.1

<VirtualHost 127.0.0.1>
ServerName localhost
DocumentRoot /var/www/html
</VirtualHost>

<VirtualHost 127.0.0.1>
ServerName www.localhost
DocumentRoot /var/www/ricomtrust
DirectoryIndex index.shtml index.html
ScriptAlias /RicomTrust/ /var/www/ricomtrust/cgi-bin/
AddType text/html .shtml
AddHandler server-parsed .shtml
</VirtualHost>

<Directory /var/www/ricomtrust>
Options +Includes
</Directory>

################# IP-based Virtual Hosts 
#<VirtualHost www.localhost>
#ServerAdmin webmaster на www.localhost
#DocumentRoot /var/www/ricomtrust
#ServerName www.localhost
#ErrorLog logs/www.localhost-error_log
#TransferLog logs/www.localhost-access_log
#ScriptAlias /cgi-bin/ /var/www/ricomtrust/cgi-bin/
#</VirtualHost>

################# Named VirtualHosts
#NameVirtualHost 127.0.0.1
#<VirtualHost 127.0.0.1>
#ServerName www.localhost
#ServerPath /var/www/ricomtrust
#DocumentRoot /var/www/ricomtrust
#</VirtualHost>
----------- следующая часть -----------
Было удалено вложение не в текстовом формате...
Имя     : =?iso-8859-1?q?=CF=D4=D3=D5=D4=D3=D4=D7=D5=C5=D4?=
Тип     : application/pgp-signature
Размер  : 481 байтов
Описание: Digital signature
Url     : <http://lists.altlinux.org/pipermail/community/attachments/20051118/0f51b8bf/attachment-0003.bin>