SSL和ProxyPass

Question

运行在8200上的js服务器和我刚刚获得了域的一些SSL证书。我希望能够在HTTPS上为我的页面服务。

到目前为止，我的apache配置文件如下

文件:/etc/apache2/sites启用/synsis.conf

<VirtualHost *:443>
  ServerAdmin sova.k@gmail.com
  ServerName  www.synsis.live
  ServerAlias synsis.live

  SSLEngine On
  SSLProxyEngine On
  SSLCertificateFile "/home/vas/synsis.live/certs/domain.crt"
  SSLCertificateKeyFile "/home/vas/synsis.live/certs/domain.key"
  SSLCertificateChainFile "/home/vas/synsis.live/certs/intermediate.pem"


  ProxyRequests Off
  <Proxy *>
    Order deny,allow
    Allow from all
  </Proxy>

<Location />
  ProxyPass  https://localhost:8200/
  ProxyPassReverse  https://localhost:8200/
</Location>
</VirtualHost>

但是，我的站点不使用此配置加载。有什么想法吗？

apachectl -t

AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
Syntax OK

和apachectl -S

VirtualHost configuration:
*:80                   is a NameVirtualHost
         default server 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1)
         port 80 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1)
         port 80 namevhost ch.mu (/etc/apache2/sites-enabled/c.conf:1)
         port 80 namevhost www.hai.run (/etc/apache2/sites-enabled/hai.conf:3)
                 alias hai.run
         port 80 namevhost practicalhuman.org (/etc/apache2/sites-enabled/ph.conf:4)
                 alias www.practicalhuman.org
*:443                  www.synthesis.live (/etc/apache2/sites-enabled/synthesis.conf:5)

ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/lock/apache2" mechanism=fcntl
Mutex mpm-accept: using_defaults
Mutex watchdog-callback: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33 not_used
Group: name="www-data" id=33 not_used

Answer 1

您的配置包含了我对野外配置示例的三个主要抱怨。

1. 在配置反向代理时使用<Proxy *>块。<Proxy>块几乎完全用于配置前向代理，而不是反向配置。在你的情况下，它是不必要的。
2. 使用ProxyPass内部定位块。最佳实践是使用ProxyPass的2参数版本，除非没有其他选择。
3. 在ApacheV2.4中使用ApacheV2.2授权指令。我强烈建议始终将所有v2.2 Allow、Order、Satisfy和require指令更改为新的v2.4 Require指令以及<RequireAny>和<RequireAll>块。
4. SSLProxyEngine指令用于在代理和基于SSL的服务时配置服务器，与实际的虚拟主机是否为SSL无关(是的，我知道我说了3，但这是一个非常小的命令，我添加它只是因为您回答说您的后端没有启用SSL：)

尝试以下作为一个基础，并希望“干净”，配置和工作从那里。*如果它不起作用，告诉我们实际发生了什么，而不是仅仅说“它不起作用”。

<VirtualHost *:443>
  ServerAdmin sova.k@gmail.com
  ServerName  www.synsis.live
  ServerAlias synsis.live

  SSLEngine On
  SSLProxyEngine On
  SSLCertificateFile "/home/vas/synsis.live/certs/domain.crt"
  SSLCertificateKeyFile "/home/vas/synsis.live/certs/domain.key"
  SSLCertificateChainFile "/home/vas/synsis.live/certs/intermediate.pem"

  # This is the default anyway, but no harm having it explicitly set
  ProxyRequests Off

  # You say in a comment your backend is not SSL, but your original configuration
  # tries to proxy to an SSL enabled service. This is almost certainly
  # why it originally failed
  ProxyPass / http://localhost:8200/
  ProxyPassReverse / http://localhost:8200/
</VirtualHost>

Answer 2

你的后端ssl是吗？

如果不是：

<VirtualHost *:443>
  ServerAdmin sova.k@gmail.com
  ServerName  www.synsis.live
  ServerAlias synsis.live

  SSLEngine On
  SSLProxyEngine On
  SSLCertificateFile "/home/vas/synsis.live/certs/domain.crt"
  SSLCertificateKeyFile "/home/vas/synsis.live/certs/domain.key"
  SSLCertificateChainFile "/home/vas/synsis.live/certs/intermediate.pem"


  ProxyRequests Off
  <Proxy *>
    Order deny,allow
    Allow from all
  </Proxy>

<Location />
  ProxyPass  http://localhost:8200/
  ProxyPassReverse  http://localhost:8200/
</Location>
</VirtualHost>

如果是的话，

：

<VirtualHost *:443>
  ServerAdmin sova.k@gmail.com
  ServerName  www.synsis.live
  ServerAlias synsis.live

  SSLEngine On
  SSLProxyEngine On
  SSLCertificateFile "/home/vas/synsis.live/certs/domain.crt"
  SSLCertificateKeyFile "/home/vas/synsis.live/certs/domain.key"
  SSLCertificateChainFile "/home/vas/synsis.live/certs/intermediate.pem"


  ProxyRequests Off
  <Proxy *>
    Order deny,allow
    Allow from all
  </Proxy>

<Location />
  SSLProxyEngine on
  ProxyPass  https://localhost:8200/
  ProxyPassReverse  https://localhost:8200/
</Location>
</VirtualHost>