Apache可能会出现从HTTPS (外部)到HTTP (内部)的反向代理问题

Question

我有一个使用.NET Core2.1、Kestrel和Apache2运行Ubuntu18.04的服务器。我使用LetsEncrypt作为SSL，并且域是用SSL设置的。在安装.NET核心并在这个站点上托管项目之前，它是一个静态的index.html站点。在遵循本指南：https://docs.microsoft.com/en-us/aspnet/core/host-and-deploy/linux-apache?view=aspnetcore-2.2之后，我无法获得域重定向到已配置的Kestrel服务。我可以在服务器上很好地访问它。

Apache error.log：

[Sat Apr 20 02:08:12.950750 2019] [ssl:warn] [pid 7473] AH01909: ct.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Apr 20 02:08:13.001939 2019] [ssl:warn] [pid 7474] AH01909: ct.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Apr 20 02:08:13.007430 2019] [mpm_prefork:notice] [pid 7474] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g configured -- resuming normal operations
[Sat Apr 20 02:08:13.007467 2019] [core:notice] [pid 7474] AH00094: Command line: '/usr/sbin/apache2'
[Sat Apr 20 02:08:18.723565 2019] [autoindex:error] [pid 7483] [client 50.88.218.180:10635] AH01276: Cannot serve directory /var/www/ct.com/public_html/ps/publish/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive

虚拟主机配置- ct.com.conf：

RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}



ServerAdmin webmaster@localhost
ServerName ct.com
ServerAlias www.ct.com

ProxyPreserveHost On
ProxyPass / http://127.0.0.1:5000/
ProxyPassReverse / http://127.0.0.1:5000/

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =ct.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

LetsEncrypt配置：

/etc/apache2/sites-available# cat ct.com-le-ssl.conf


        ServerAdmin webmaster@localhost
        ServerName ct.com
        ServerAlias www.ct.com
        DocumentRoot /var/www/ct.com/public_html/ps/publish

        
            AllowOverride All
            Require all granted
        

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.

# RewriteCond %{SERVER_NAME} =ct.com
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/www.ct.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.ct.com/privkey.pem

最近从Apache2.conf中删除了索引：

    Options FollowSymLinks
    AllowOverride None
    Require all granted

有人看到为什么我的服务器不通过SSL向我当前运行的站点提供任何请求了吗？我有其他的网站，工作良好的SSL。

更新4/23:当我尝试使用Postman: xx.xxx.xx.xx - "GET /api/Main/TestCall HTTP/1.1“404 3805 - "PostmanRuntime/7.6.1”到达端点时，下面是xx.xxx.xx.xx

Update 4/23 (2):

Apache access.log显示了与上面相同的错误。Apache error.log如下所示：

[Wed Apr 24 00:13:25.017062 2019] [ssl:warn] [pid 4117] AH01909: localhost:443:0 server certificate does NOT include an ID whic matches the server name
[Wed Apr 24 00:13:25.022627 2019] [mpm_prefork:notice] [pid 4117] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g configured -- resuming normal operations

New ct.com.conf 4/24:

RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}



ServerAdmin webmaster@localhost
ServerName ct.com
ServerAlias www.ct.com
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]


ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
LogLevel debug



ServerAdmin webmaster@localhost
ServerName ct.com
ServerAlias www.ct.com

ProxyPreserveHost On
ProxyPass / http://127.0.0.1:5123/
ProxyPassReverse / http://127.0.0.1:5123/

SSLEngine On
SSLProtocol all -SSLv2

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
LogLevel debug
#RewriteEngine on
#RewriteCond %{SERVER_NAME} =ct.com
#RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,R=permanent]
#RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:!RC4+RSA:+HIGH:+MEDIUM:!LOW:!RC4
SSLCertificateFile /etc/letsencrypt/live/www.ct.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.ct.com/privkey.pem

调试级别的<#>Error.log

tail -f /var/log/apache2/error.log
[Wed Apr 24 16:01:15.260207 2019] [mpm_prefork:notice] [pid 19201] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g configured -- resuming normal operations
[Wed Apr 24 16:01:15.260232 2019] [core:notice] [pid 19201] AH00094: Command line: '/usr/sbin/apache2'
[Wed Apr 24 16:01:45.298236 2019] [proxy:debug] [pid 19233] proxy_util.c(1785): AH00925: initializing worker http://127.0.0.1:5123/ shared
[Wed Apr 24 16:01:45.299302 2019] [proxy:debug] [pid 19233] proxy_util.c(1827): AH00927: initializing worker http://127.0.0.1:5123/ local
[Wed Apr 24 16:01:45.299451 2019] [proxy:debug] [pid 19233] proxy_util.c(1878): AH00931: initialized single connection worker in child 19233 for (127.0.0.1)
[Wed Apr 24 16:01:58.912849 2019] [autoindex:error] [pid 19211] [client 50.88.218.180:28627] AH01276: Cannot serve directory /var/www/ct.com/public_html/ps/publish/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Wed Apr 24 16:01:59.408882 2019] [autoindex:error] [pid 19211] [client 50.88.218.180:28627] AH01276: Cannot serve directory /var/www/ct.com/public_html/ps/publish/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Wed Apr 24 16:02:05.322145 2019] [proxy:debug] [pid 19245] proxy_util.c(1785): AH00925: initializing worker http://127.0.0.1:5123/ shared
[Wed Apr 24 16:02:05.324374 2019] [proxy:debug] [pid 19245] proxy_util.c(1827): AH00927: initializing worker http://127.0.0.1:5123/ local
[Wed Apr 24 16:02:05.324607 2019] [proxy:debug] [pid 19245] proxy_util.c(1878): AH00931: initialized single connection worker in child 19245 for (127.0.0.1)

Answer 1

你抄袭错误的例子。您的ProxyPass是在非SSL 中定义的，它将重定向到https。

将代理内容移动到您的。请参阅微软指南中的SSL示例。

还可以更改RewriteRule并移除NE标志。我想你不需要这里了。或者使用SSL示例中的规则：

RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

证书有问题..。