Re: questions about IPv6 and SSL

Andreas Meyer <a.meyer@xxxxxxxxxx> · Thu, 1 Sep 2016 00:05:00 +0200

Hello!

Christopher Schultz <chris@xxxxxxxxxxxxxxxxxxxxxx> schrieb am 31.08.16 um 17:28:04 Uhr:

> > A few days ago I added IPv6-connectivity to the web server and
> > changed the Listen-directives and the VitrualHost to also listen to
> > the IPv6-Address on port 443.  
> 
> Please post your "Listen" and "VirtualHost" directive lines from your
> config file.

This is the part of listen.conf:

Listen 127.0.0.1:80
Listen 37.120.166.21:80
Listen 46.38.231.143:80
Listen [2a03:4000:6:4123::1]:80

<IfDefine SSL>
    <IfDefine !NOSSL>
         IfModule mod_ssl.c>

            Listen 127.0.0.1:443
            Listen 37.120.166.21:443
            Listen 46.38.231.143:443
            Listen [2a03:4000:6:4123::1]:443

    </IfModule>
    </IfDefine>
</IfDefine>

and in the VirtualHost I just added

<Virtualhost 37.120.166.21 [2a03:4000:6:4123::1]:80>

RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

and in the sslvhost
<Virtualhost 37.120.166.21 [2a03:4000:6:4123::1]:443>

tried also with a separate
<VirtualHost [2a03:4000:6:4123::1]:443>

> > There is a redirect from http to https. The website is not
> > reachable anymore, not certificates are found.  
> 
> Those are two different problems:
> 
>  1. Certificates are not found

The certificate are there. If I disable the IPV6 things, they
are found.

>  2. Web site is not reachable
> 
> One may cause the other.
> 
> What error message to you get, and where?

The thing is, I didn't notice the website is not reachable
'cause my testings with my IPv6 connetion showed no errors.

ping from outside:

andreas@workstation:/> ping6 2a03:4000:6:4123::1
PING 2a03:4000:6:4123::1(2a03:4000:6:4123::1) 56 data bytes
64 bytes from 2a03:4000:6:4123::1: icmp_seq=1 ttl=58 time=33.2 ms
64 bytes from 2a03:4000:6:4123::1: icmp_seq=2 ttl=58 time=33.1 ms
64 bytes from 2a03:4000:6:4123::1: icmp_seq=3 ttl=58 time=30.9 ms
^C

People then reported the site is not reachable, for instance:

Firefox-Fehlermeldung:
Ein Fehler ist während einer Verbindung mit www.bitcorner.de 
aufgetreten. SSL hat einen Eintrag erhalten,
  der die maximal erlaubte Länge überschritten hat. Fehlercode: 
SSL_ERROR_RX_RECORD_TOO_LONG

Curl:
error (35): error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown 
protocol]

Wget:
  wget "https://www.bitcorner.de/bshop/products.csv";
--2016-08-31 15:21:12-- https://www.bitcorner.de/bshop/products.csv
Resolving www.bitcorner.de (www.bitcorner.de)... 37.120.166.21, 
2a03:4000:6:4123::1
Connecting to www.bitcorner.de (www.bitcorner.de)|37.120.166.21|:443... 
connected.
GnuTLS: An unexpected TLS packet was received.
Unable to establish SSL connection.

  Andreas