让我们在AWS Lightsail中加密bitnami.conf中的SSL设置

Question

我在AWS Lightsail中创建了一个新实例，并配置了一个域example.com，它也有两个子域。test.example.com和app.example.com。

我删除了默认的bitnami.conf并创建了一个新的。这删除了预定义的SSL设置代码。我按照这个tutorial安装了Lets。

下面是我在添加SSL之前的bitnami.conf文件。我可以根据需要访问所有的网站。

ServerName example.com

<VirtualHost *:80>

    ServerName example.com
       <Directory /opt/bitnami/apache2/htdocs/default_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>

    DocumentRoot /opt/bitnami/apache2/htdocs/default_website
</VirtualHost>



<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/app_website
    <Directory /opt/bitnami/apache2/htdocs/app_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName app.example.com

</VirtualHost>



<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/test_website
     <Directory /opt/bitnami/apache2/htdocs/test_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName test.example.com

</VirtualHost>

下面是我添加SSL代码后的bitnami.conf文件。从example.com到https://example.com的重定向工作正常，但页面不能在https中加载。我收到ERR_CONNECTION_REFUSED错误。

新建bitnami.conf文件

ServerName example.com

<VirtualHost *:80>

    ServerName example.com
    RewriteEngine On
            RewriteCond %{HTTPS} !=on
            RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R,L]

       <Directory /opt/bitnami/apache2/htdocs/default_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>

    DocumentRoot /opt/bitnami/apache2/htdocs/default_website
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/opt/bitnami/apache2/htdocs/default_website"
SSLEngine on
SSLCertificateFile "/opt/bitnami/apache2/conf/server.crt"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/server.key"

<Directory "/opt/bitnami/apache2/htdocs/default_website">
Options Indexes FollowSymLinks
AllowOverride All
<IfVersion < 2.3 >
Order allow,deny
Allow from all
</IfVersion>
<IfVersion >= 2.3 >
Require all granted
</IfVersion>
</Directory>

# Error Documents
ErrorDocument 503 /503.html

# Bitnami applications installed with a prefix URL (default)
Include "/opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf"
</VirtualHost>



<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/app_website
    <Directory /opt/bitnami/apache2/htdocs/app_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName app.example.com
</VirtualHost>


<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/test_website
     <Directory /opt/bitnami/apache2/htdocs/test_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName test.example.com
</VirtualHost>

Answer 1

我是Bitnami工程师。您还需要定义Apache将在其中开始侦听的新端口，以及它将接受的不同密码和协议。缺省情况下，这些行包含在堆栈中包含的bitnami.conf文件中

Listen 443
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !EDH !RC4"
SSLPassPhraseDialog  builtin
SSLSessionCache "shmcb:/opt/bitnami/apache2/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300

在定义端口443的VirtualHost之前，您需要将它们包括在内

我希望这能帮到你