Apache ssl代理不需要的redirect

我正在运行的Ubuntu的服务器12.04。我想要通过apache ssl 代理来保护对python应用程序的访问。我有

sudo a2ensite erp.mydomain.com

我在/ etc / hosts中

 127.0.0.1 mydomain.com erp.mydomain.com

– http://erp.mydomain.comredirect到 – https://erp.mydomain.com 行
– https://erp.mydomain.com代理到 – https://erp.mydomain.com/web/webclient/home 行
– http://mydomain.com在/ var / www / OK中进入我的常规网站
https://mydomain.comredirect到http://mydomain.com/web/webclient/home导致错误：“在此服务器上找不到请求的URL / web / webclient / home。不好

我不明白这个redirect，任何指针都会有所帮助。这是我的erp.mydomain.com文件：

 <VirtualHost *:80> ServerAdmin webmaster@localhost ServerName erp.mydomain.com Redirect / https://erp.mydomain.com/ DocumentRoot /var/www <Directory /> Options FollowSymLinks AllowOverride None </Directory> <Directory /var/www/> Options Indexes FollowSymLinks MultiViews AllowOverride None Order allow,deny allow from all </Directory> ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ <Directory "/usr/lib/cgi-bin"> AllowOverride None Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch Order allow,deny Allow from all </Directory> ErrorLog ${APACHE_LOG_DIR}/error.log # Possible values include: debug, info, notice, warn, error, crit, # alert, emerg. LogLevel warn CustomLog ${APACHE_LOG_DIR}/access.log combined Alias /doc/ "/usr/share/doc/" <Directory "/usr/share/doc/"> Options Indexes MultiViews FollowSymLinks AllowOverride None Order deny,allow Deny from all Allow from 127.0.0.0/255.0.0.0 ::1/128 </Directory> </VirtualHost> <IfModule mod_ssl.c> <VirtualHost *:443> ServerAdmin webmaster@localhost ServerName erp.mydomain.com <Proxy *> Order deny,allow Allow from all </Proxy> ProxyRequests Off ProxyPass / http://127.0.0.1:8069/ ProxyPassReverse / http://127.0.0.1:8069/ SetEnv proxy-nokeepalive 1 DocumentRoot /var/www <Directory /> Options FollowSymLinks AllowOverride None </Directory> <Directory /var/www/> Options Indexes FollowSymLinks MultiViews AllowOverride None Order allow,deny allow from all </Directory> ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/ <Directory "/usr/lib/cgi-bin"> AllowOverride None Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch Order allow,deny Allow from all </Directory> ErrorLog ${APACHE_LOG_DIR}/error.log # Possible values include: debug, info, notice, warn, error, crit, # alert, emerg. LogLevel warn CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined Alias /doc/ "/usr/share/doc/" <Directory "/usr/share/doc/"> Options Indexes MultiViews FollowSymLinks AllowOverride None Order deny,allow Deny from all Allow from 127.0.0.0/255.0.0.0 ::1/128 </Directory> SSLEngine on SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key <FilesMatch "\.(cgi|shtml|phtml|php)$"> SSLOptions +StdEnvVars </FilesMatch> <Directory /usr/lib/cgi-bin> SSLOptions +StdEnvVars </Directory> BrowserMatch "MSIE [2-6]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 # MSIE 7 and newer should be able to use keepalive BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown </VirtualHost> </IfModule>

如果你没有

 <VirtualHost *:443> ServerName mydomain.com ... </VirtualHost>

在常规的mydomain.com站点文件中阻塞，那么问题是Apache将会在没有其他匹配的情况下提供configuration的第一个虚拟主机。为该servername添加一个虚拟主机，它应该被解决。

如果你这样做，那么你可能会遇到SNI不能正常工作的问题，无论是在客户端（IE-on-XP不支持）还是在服务器端（12.04应该有正确版本的OpenSSL）。在这种情况下，如果SSLStrictSNIVHostCheckclosures，则将客户端作为默认的第一个虚拟主机，而不是错误消息。

最后，确保您已经在* .80和* .443上设置了基于名称的虚拟主机：

 NameVirtualHost *:80 NameVirtualHost *:443

这更像是你的网站发送一个HTTPredirect到客户端。由于服务器和客户端都不知道代理它只是逃脱。

使用类似于此的重写规则

  ReWriteEngine On RewriteRule ^/web/webclient/home/(.*) https://%{HTTP_HOST}/web/webclient/home

所以当redirect被发送时，在客户端看到它之前会被检测并重写，以指向https服务器。