Re: More fun with SSL certificates

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 




> Am 03.05.2023 um 13:37 schrieb Patrick O'Callaghan <pocallaghan@xxxxxxxxx>:
> 
> On Wed, 2023-05-03 at 13:31 +0200, Peter Boy wrote:
>> 
>> 
>>> Am 03.05.2023 um 12:05 schrieb Patrick O'Callaghan
>>> <pocallaghan@xxxxxxxxx>:
>>> 
>>> On Tue, 2023-05-02 at 14:31 +0200, Peter Boy wrote:
>>>> 
>>>> 
>>>>> Am 02.05.2023 um 12:23 schrieb Patrick O'Callaghan
>>>>> <pocallaghan@xxxxxxxxx>:
>>>>> 
>>>>> # httpd  -S
>>>>> VirtualHost configuration:
>>>>> *:80                   bree.org.uk
>>>>> (/etc/httpd/conf.d/bree.conf:1)
>>>>> *:443                  is a NameVirtualHost
>>>>>        default server bree.org.uk (/etc/httpd/conf.d/bree-le-
>>>>> ssl.conf:2)
>>>>>        port 443 namevhost bree.org.uk (/etc/httpd/conf.d/bree-
>>>>> le-
>>>>> ssl.conf:2)
>>>>>        port 443 namevhost bree.org.uk
>>>>> (/etc/httpd/conf.d/ssl.conf:56)
>>>>> ServerRoot: "/etc/httpd"
>>>>> Main DocumentRoot: "/var/www/html“
>>>> 
>>>> We often encounter issues with a configuration as you have.
>>>> 
>>>> The problem is:
>>>> Your bree.org.uk address acts as a default server following
>>>> apache’s
>>>> naming convention (it is the first file sorting the file names
>>>> alphabetically). At the same time a default vname server is
>>>> configured in the default ssl configuration file
>>>> (/etc/httpd/conf.d/ssl.conf:56). We often encounter problems in
>>>> such
>>>> a situation, when 2 configurations are effective at the same
>>>> time. 
>>>> 
>>>> You may try either of the following
>>>> 
>>>> (a) define another named host with comes first in the
>>>> alphabetical
>>>> order, e.g. adefault.conf You may configure it minimally so it
>>>> shows
>>>> the default Fedora welcome page. It will only get used, if
>>>> someone
>>>> addresses your server by IP.
>>>> 
>>>> (b) comment out the default server at
>>>> /etc/httpd/conf.d/ssl.conf:56
>>>> You may comment out all the lines between <VirtualHost
>>>> _default_:443>
>>>> and </VirtualHost> provided you fully configure ssl in
>>>> /etc/httpd/conf.d/bree-le-ssl.conf, i.e. include all the
>>>> configuration option you find between both former directives of
>>>> your
>>>> own, probably customised, way. Or you may just comment out those
>>>> <VirtualHost…> directives leaving the remaining directives as
>>>> defaults. But this way sometimes results in conflict between the
>>>> different certificate locations. The details of this conflict are
>>>> not
>>>> fully known yet.
>>>> 
>>>> Anyway, it would be helpful for us it you try it and give
>>>> feedback
>>>> about the results. 
>>>> 
>>>> Another possible issue is that port 80 is defined as 'main
>>>> server'
>>>> only, and port 443 has defined named server only. A more clean
>>>> configuration is to define a port 80 server as a named server for
>>>> bree.org.uk as well, that just redirects to port 443.
>>> 
>>> I've attempted to implement suggestion (a) but without success.
>>> Clearly
>>> there's something I'm not understanding. I copied the standard
>>> /etc/httpd/conf.d/welcome.conf to [...]/aaa-default.conf and edited
>>> it
>>> to include the line:
>>> 
>>> ServerName default.bree.org.uk
>>> 
>>> but still got the same error after restarting Apache. Changing that
>>> to
>>> 'bree.org.uk' had the same result. Perhaps you could explain in a
>>> little more detail.
>> 
>> Sorry, yes, I probably should have provided more details. Please,
>> wait about 2-3 hours and I’ll publish a complete guide at
>> https://docs.fedoraproject.org/en-US/fedora-server/
>> 
>> I’ll post the exact URL here when I’ve it published.
>> 
> 
> Thanks. I look forward to it.
> 
>>> 
>>> I also tried suggestion (b) by commenting out the <VirtualHost>
>>> lines,
>>> but again it made no difference.
>>> 
>>> (I should note that I'm reluctant to edit the standard httpd.conf
>>> itself unless there's no alternative. Currently it's exactly as
>>> installed. I'm aware that it would be replaced on any update.)
>> 
>> 
>> That’s a very good strategy! We know about that bug for some time but
>> never managed to describe it in detail and to file a bug. We’ll do it
>> now so it hopefully gets fixed soon.
> 
> Thanks again.
> 

The description is now at
https://docs.stg.fedoraproject.org/en-US/fedora-server/services/httpd-basic-setup/ 
at the bottom, Troubleshooting

Unfortunately, I had various issues with my test equipment and couldn’t test the steps so far. The next hours I’ve various Fedora team meetings. So I’ll continue later and tomorrow. 

If you stay with you name your configuration file bre-org-uk.conf you must use aaadefault.con (instead of vhost-aaadefault.conf as in the Fedora server docs.



--
Peter Boy
https://fedoraproject.org/wiki/User:Pboy
pboy@xxxxxxxxxxxxxxxxx

Timezone: CET (UTC+1) / CEST (UTC+2)


Fedora Server Edition Working Group member
Fedora docs team contributor
Java developer and enthusiast


_______________________________________________
users mailing list -- users@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to users-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/users@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue



[Index of Archives]     [Older Fedora Users]     [Fedora Announce]     [Fedora Package Announce]     [EPEL Announce]     [EPEL Devel]     [Fedora Magazine]     [Fedora Summer Coding]     [Fedora Laptop]     [Fedora Cloud]     [Fedora Advisory Board]     [Fedora Education]     [Fedora Security]     [Fedora Scitech]     [Fedora Robotics]     [Fedora Infrastructure]     [Fedora Websites]     [Anaconda Devel]     [Fedora Devel Java]     [Fedora Desktop]     [Fedora Fonts]     [Fedora Marketing]     [Fedora Management Tools]     [Fedora Mentors]     [Fedora Package Review]     [Fedora R Devel]     [Fedora PHP Devel]     [Kickstart]     [Fedora Music]     [Fedora Packaging]     [Fedora SELinux]     [Fedora Legal]     [Fedora Kernel]     [Fedora OCaml]     [Coolkey]     [Virtualization Tools]     [ET Management Tools]     [Yum Users]     [Yosemite News]     [Gnome Users]     [KDE Users]     [Fedora Art]     [Fedora Docs]     [Fedora Sparc]     [Libvirt Users]     [Fedora ARM]

  Powered by Linux