web-dev-qa-db-ja.com

SSLがApacheをクラッシュ（ロードに失敗）

Apache2（Ubuntu 17）でSSLを使用しようとすると、Apacheが壊れているようです。

コンソールエラー

    ● Apache2.service - The Apache HTTP Server
   Loaded: loaded (/lib/systemd/system/Apache2.service; enabled; vendor preset: enabled)
  Drop-In: /lib/systemd/system/Apache2.service.d
           └─Apache2-systemd.conf
   Active: failed (Result: exit-code) since Thu 2018-05-03 11:52:21 AEST; 2h 4min ago
  Process: 3366 ExecStart=/usr/sbin/apachectl start (code=exited, status=1/FAILURE)
      CPU: 85ms

May 03 11:52:20 FRAFFEL_MEDIA systemd[1]: Starting The Apache HTTP Server...
May 03 11:52:21 FRAFFEL_MEDIA apachectl[3366]: AH00558: Apache2: Could not reliably determine the server's fully qualifi
May 03 11:52:21 FRAFFEL_MEDIA apachectl[3366]: Action 'start' failed.
May 03 11:52:21 FRAFFEL_MEDIA apachectl[3366]: The Apache error log may have more information.
May 03 11:52:21 FRAFFEL_MEDIA systemd[1]: Apache2.service: Control process exited, code=exited status=1
May 03 11:52:21 FRAFFEL_MEDIA systemd[1]: Failed to start The Apache HTTP Server.
May 03 11:52:21 FRAFFEL_MEDIA systemd[1]: Apache2.service: Unit entered failed state.
May 03 11:52:21 FRAFFEL_MEDIA systemd[1]: Apache2.service: Failed with result 'exit-code'.

/ var/log/Apache2/error_log：

[Thu May 03 06:25:01.830302 2018] [mpm_prefork:notice] [pid 4511] AH00163: Apache/2.4.25 (Ubuntu) OpenSSL/1.0.2g configured -- resuming normal operations
[Thu May 03 06:25:01.830372 2018] [core:notice] [pid 4511] AH00094: Command line: '/usr/sbin/Apache2'
[Thu May 03 08:03:44.188546 2018] [:error] [pid 13778] [client 95.213.177.126:63358] script '/var/www/404/azenv.php' not found or unable to stat, referer: https://proxyradar.com/
[Thu May 03 11:29:21.335601 2018] [mpm_prefork:notice] [pid 4511] AH00171: Graceful restart requested, doing restart
AH00558: Apache2: Could not reliably determine the server's fully qualified domain name, using fe80::f03c:91ff:fea7:2ab8. Set the 'ServerName' directive globally to suppress this message
[Thu May 03 11:29:21.424519 2018] [ssl:warn] [pid 4511] AH01909: fe80::f03c:91ff:fea7:2ab8:80:0 server certificate does NOT include an ID which matches the server name
[Thu May 03 11:29:21.424615 2018] [ssl:emerg] [pid 4511] AH02569: Illegal attempt to re-initialise SSL for server (SSLEngine On should go in the VirtualHost, not in global scope.)
[Thu May 03 11:29:21.424621 2018] [:emerg] [pid 4511] AH00020: Configuration Failed, exiting
[Thu May 03 11:36:17.850289 2018] [ssl:warn] [pid 3415] AH01909: 2600:3c01::f03c:91ff:fea7:2ab8:80:0 server certificate does NOT include an ID which matches the server name
[Thu May 03 11:36:17.851117 2018] [ssl:emerg] [pid 3415] AH02569: Illegal attempt to re-initialise SSL for server (SSLEngine On should go in the VirtualHost, not in global scope.)
AH00016: Configuration Failed
[Thu May 03 11:52:21.316911 2018] [ssl:warn] [pid 3393] AH01909: fe80::f03c:91ff:fea7:2ab8:80:0 server certificate does NOT include an ID which matches the server name
[Thu May 03 11:52:21.323098 2018] [ssl:emerg] [pid 3393] AH02569: Illegal attempt to re-initialise SSL for server (SSLEngine On should go in the VirtualHost, not in global scope.)
AH00016: Configuration Failed

利用可能なサイト構成でSSLを使用する場合にのみ発生するため、何が起こるのかわかりません。

<virtualhost *:443> 
ServerName fraffel.tech 
DocumentRoot /var/www/fraffeltech
</virtualhost>

SSLEngine on 
SSLCertificateFile /etc/ssl/fraffel_tech.crt 
SSLCertificateKeyFile /etc/ssl/private/fraffel.tech.key 
SSLCertificateChainFile /etc/ssl/fraffel_tech.ca-bundle

SSLファイルはこれらのディレクトリにありますが、どうなっているのかわかりません。はい、ssl modが有効になっています...

apache2ssl
1
FRAFFEL MEDIA

仮想ホストを

<VirtualHost *:443> 
    ServerName fraffel.tech 
    DocumentRoot /var/www/fraffeltech

    SSLEngine on 
    SSLCertificateFile /etc/ssl/fraffel_tech.crt 
    SSLCertificateKeyFile /etc/ssl/private/fraffel.tech.key 
    SSLCertificateChainFile /etc/ssl/fraffel_tech.ca-bundle 
</VirtualHost>

ヒントは次のとおりです。

[2018年5月3日11：36：17.851117 2018] [ssl：emerg] [pid 3415] AH02569：サーバーのSSLを再初期化しようとする不正な試み（SSLEngine Onは、グローバルスコープではなくVirtualHostに移動する必要があります。）

さらに、次のような警告メッセージが表示されます。

Fe80 :: f03c：91ffを使用して、サーバーの完全修飾ドメイン名を確実に決定できませんでした...このメッセージを抑制するために、 'ServerName'ディレクティブをグローバルに設定します

「ServerName」ディレクティブをグローバルに設定してこのメ​​ッセージを抑制しますは、<VirtualHost>タグの外側にServerNameディレクティブが1つ必要であることを意味します。プライマリドメインの名前または単にlocalhostの場合があります。

ServerName fraffel.tech 

<VirtualHost *:443> 
    ServerName fraffel.tech 
    DocumentRoot /var/www/fraffeltech

    #...
</VirtualHost>
1
vidarlo