我有一个服务于我的网站的Apache服务器，如果我只使用http，但无法通过https连接到它。 我已经梳理了所有的错误日志，什么也没有发现。 我已经从本网站的其他答案尝试了几件事情，包括允许端口443通过我的防火墙并重新启动iptables，并禁用SELinux。 这些都没有奏效，所以我怀疑我的configuration有问题。
这是我的虚拟主机：
Listen 80 Listen 443 NameVirtualHost *:80 <VirtualHost *:80> ServerName myurl.com Redirect permanent / https://myurl.com:443 </VirtualHost> NameVirtualHost *:443 <VirtualHost *:443> ServerName myurl.com Alias /static /path/to/my/app/static WSGIScriptAlias / /path/to/my/app/wsgi.py <Directory /path/to/my/app> Order deny,allow Allow from all </Directory> SSLEngine on SSLCertificateFile /etc/ssl/ssl.crt/myurl.com.crt SSLCertificateChainFile /etc/ssl/ssl.crt/myurl.com.ca-bundle SSLCertificateKeyFile /etc/ssl/ssl.key/myurl.com.key ErrorLog logs/ssl_error_log TransferLog logs/ssl_access_log LogLevel debug # SSL Protocol support: # List the enable protocol levels with which clients will be able to # connect. Disable SSLv2 access by default: SSLProtocol all -SSLv2 # SSL Cipher Suite: # List the ciphers that the client is permitted to negotiate. # See the mod_ssl documentation for a complete list. SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW <Files ~ "\.(cgi|shtml|phtml|php3?)$"> SSLOptions +StdEnvVars </Files> <Directory "/var/www/cgi-bin"> SSLOptions +StdEnvVars </Directory> SetEnvIf User-Agent ".*MSIE.*" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 # Per-Server Logging: # The home of a custom SSL log file. Use this when you want a # compact non-error SSL logfile on a virtual host basis. CustomLog logs/ssl_request_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b" </VirtualHost> 这是netstat -ltpn的输出：
Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 1122/rpcbind tcp 0 0 0.0.0.0:42675 0.0.0.0:* LISTEN 5774/rpc.statd tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 27100/sshd tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 5806/cupsd tcp 0 0 127.0.0.1:5432 0.0.0.0:* LISTEN 12076/postmaster tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 6011/master tcp 0 0 :::111 :::* LISTEN 1122/rpcbind tcp 0 0 :::80 :::* LISTEN 5860/httpd tcp 0 0 :::22 :::* LISTEN 27100/sshd tcp 0 0 ::1:631 :::* LISTEN 5806/cupsd tcp 0 0 ::1:5432 :::* LISTEN 12076/postmaster tcp 0 0 ::1:25 :::* LISTEN 6011/master tcp 0 0 :::443 :::* LISTEN 5860/httpd tcp 0 0 :::40040 :::* LISTEN 5774/rpc.statd
和curl -v https://myurl.com ：
[admin@eusay ~]$ curl -v https://myurl.com * About to connect() to eusay.eusa.ed.ac.uk port 443 (#0) * Trying ::1... connected * Connected to eusay.eusa.ed.ac.uk (::1) port 443 (#0) * Initializing NSS with certpath: sql:/etc/pki/nssdb * CAfile: /etc/pki/tls/certs/ca-bundle.crt CApath: none * SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA * Server certificate: * subject: CN=eusay.eusa.ed.ac.uk,OU=Domain Control Validated * start date: Jun 26 00:00:00 2014 GMT * expire date: Jun 25 23:59:59 2017 GMT * common name: eusay.eusa.ed.ac.uk * issuer: CN=TERENA SSL CA,O=TERENA,C=NL > GET / HTTP/1.1 > User-Agent: curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.15.3 zlib/1.2.3 libidn/1.18 libssh2/1.4.2 > Host: eusay.eusa.ed.ac.uk > Accept: */* > < HTTP/1.1 200 OK < Date: Fri, 15 Aug 2014 19:37:16 GMT < Server: Apache/2.2.15 (CentOS) < Vary: Cookie < X-Frame-Options: SAMEORIGIN < Set-Cookie: sessionid=zi5oddwgqure8iwnkvd7evrjjt0qe3q8; expires=Fri, 29-Aug-2014 19:37:17 GMT; httponly; Max-Age=1209600; Path=/ < Connection: close < Transfer-Encoding: chunked < Content-Type: text/html; charset=utf-8 <
接着是页面的完整HTML。
使用curl进行testing可以validationApache本身是否通过HTTPS提供站点服务。 也就是说，你的curltesting是从服务器本身完成的。
当我用卷发进行testing时，在80和443上，我的结果与你的不同。 在80，我得到了预期的HTTP 301。 但是，当我尝试访问您网站的HTTPS版本时，我收到了ICMP HOST UNREACHEABLE。
换句话说，你的防火墙正在拒绝你的networking服务器上发往TCP 443的数据包。
find为什么来自外部的TLSstream量被阻止，然后修复它。
运行iptables -L -v -n来查看实际的规则。 您可能需要添加一个规则来显式允许stream量，例如：
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
或删除阻止它的规则，或者甚至两者。
输出来自curl -v http://eusay.eusa.ed.ac.uk
*重buildurl：http://eusay.eusa.ed.ac.uk/ * DNScaching中找不到主机名 *尝试129.215.116.90 ... *连接到eusay.eusa.ed.ac.uk（129.215.116.90）80号港口（＃0） > GET / HTTP / 1.1 > User-Agent：curl / 7.35.0 >主持人：eusay.eusa.ed.ac.uk >接受：* / * > 301永久移动</ title> </ HEAD> <BODY> <h1>永久移动</ h1> <p>该文件已移至<a href="https://eusay.eusa.ed.ac.uk:443">此处</a>。</ p> <HR> <address> Apache / 2.2.15（CentOS）Server at eusay.eusa.ed.ac.uk Port 80 </ address> </ BODY> </ HTML> *closures连接0
curl -v https://eusay.eusa.ed.ac.uk输出curl -v https://eusay.eusa.ed.ac.uk
*重buildurl：https：//eusay.eusa.ed.ac.uk/ * DNScaching中找不到主机名 *尝试129.215.116.90 ... *连接到129.215.116.90端口443失败：没有路由到主机 *无法连接到eusay.eusa.ed.ac.uk端口443：没有路由到主机 *closures连接0 curl：（7）无法连接到eusay.eusa.ed.ac.uk端口443：没有路由到主机