web-dev-qa-db-ja.com

HTTPS（外部）からHTTP（内部）へのApacheでのリバースプロキシの問題の可能性

.NET Core 2.1、Kestrel、Apache2を搭載したUbuntu18.04を実行しているサーバーがあります。 LetsEncrypt for SSLを使用しており、ドメインはSSLで設定されています。 .NET Coreをインストールしてこのサイトでプロジェクトをホストする前は、静的なindex.htmlサイトでした。このガイドに従った後： https://docs.Microsoft.com/en-us/aspnet/core/Host-and-deploy/linux-apache?view=aspnetcore-2.2 、私は構成されているKestrelサービスにリダイレクトするドメインを取得できません。サーバー上で問題なくアクセスできます。

Apache error.log：

[Sat Apr 20 02:08:12.950750 2019] [ssl:warn] [pid 7473] AH01909: ct.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Apr 20 02:08:13.001939 2019] [ssl:warn] [pid 7474] AH01909: ct.com:443:0 server certificate does NOT include an ID which matches the server name
[Sat Apr 20 02:08:13.007430 2019] [mpm_prefork:notice] [pid 7474] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g configured -- resuming normal operations
[Sat Apr 20 02:08:13.007467 2019] [core:notice] [pid 7474] AH00094: Command line: '/usr/sbin/Apache2'
[Sat Apr 20 02:08:18.723565 2019] [autoindex:error] [pid 7483] [client 50.88.218.180:10635] AH01276: Cannot serve directory /var/www/ct.com/public_html/ps/publish/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive

仮想ホスト構成-ct.com.conf：

<VirtualHost *:*>
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
</VirtualHost>

<VirtualHost *:80>
ServerAdmin webmaster@localhost
ServerName ct.com
ServerAlias www.ct.com

ProxyPreserveHost On
ProxyPass / http://127.0.0.1:5000/
ProxyPassReverse / http://127.0.0.1:5000/

ErrorLog ${Apache_LOG_DIR}/error.log
CustomLog ${Apache_LOG_DIR}/access.log combined
RewriteEngine on
RewriteCond %{SERVER_NAME} =ct.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

LetsEncryptの構成：

/etc/Apache2/sites-available# cat ct.com-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerAdmin webmaster@localhost
        ServerName ct.com
        ServerAlias www.ct.com
        DocumentRoot /var/www/ct.com/public_html/ps/publish

        <Directory /var/www/ct.com/public_html/ps/publish>
            AllowOverride All
            Require all granted
        </Directory>

        ErrorLog ${Apache_LOG_DIR}/error.log
        CustomLog ${Apache_LOG_DIR}/access.log combined
RewriteEngine on
# Some rewrite rules in this file were disabled on your HTTPS site,
# because they have the potential to create redirection loops.

# RewriteCond %{SERVER_NAME} =ct.com
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

Include /etc/letsencrypt/options-ssl-Apache.conf
SSLCertificateFile /etc/letsencrypt/live/www.ct.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.ct.com/privkey.pem
</VirtualHost>
</IfModule>

Apache2.confから最近削除されたインデックス：

<Directory /var/www/>
    Options FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

サーバーが現在実行中のサイトにSSL経由でリクエストを処理しない理由について、誰かが間違っていることに気づきましたか？ SSLを介して正常に動作する他のWebサイトがあります。

アップデート4/23：Postmanを使用してエンドポイントにアクセスしようとしたときのaccess.logは次のとおりです：xx.xxx.xx.xx --- [23/Apr/2019：18：24：12 +0000] "GET/api/Main/TestCall HTTP/1.1 "404 3805"-"" PostmanRuntime/7.6.1 "

更新4/23（2）：

Apache access.logは、上記と同じエラーを示しています。 Apacheerror.logは次のとおりです。

[Wed Apr 24 00:13:25.017062 2019] [ssl:warn] [pid 4117] AH01909: localhost:443:0 server certificate does NOT include an ID whic matches the server name
[Wed Apr 24 00:13:25.022627 2019] [mpm_prefork:notice] [pid 4117] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g configured -- resuming normal operations

新しいct.com.conf 4/24：

<VirtualHost *:*>
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
</VirtualHost>

<VirtualHost *:80>
ServerAdmin webmaster@localhost
ServerName ct.com
ServerAlias www.ct.com
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]


ErrorLog ${Apache_LOG_DIR}/error.log
CustomLog ${Apache_LOG_DIR}/access.log combined
LogLevel debug
</VirtualHost>

<VirtualHost *:443>
ServerAdmin webmaster@localhost
ServerName ct.com
ServerAlias www.ct.com

ProxyPreserveHost On
ProxyPass / http://127.0.0.1:5123/
ProxyPassReverse / http://127.0.0.1:5123/

SSLEngine On
SSLProtocol all -SSLv2

ErrorLog ${Apache_LOG_DIR}/error.log
CustomLog ${Apache_LOG_DIR}/access.log combined
LogLevel debug
#RewriteEngine on
#RewriteCond %{SERVER_NAME} =ct.com
#RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,R=permanent]
#RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:!RC4+RSA:+HIGH:+MEDIUM:!LOW:!RC4
SSLCertificateFile /etc/letsencrypt/live/www.ct.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.ct.com/privkey.pem
</VirtualHost>

デバッグレベルのError.log

tail -f /var/log/Apache2/error.log
[Wed Apr 24 16:01:15.260207 2019] [mpm_prefork:notice] [pid 19201] AH00163: Apache/2.4.29 (Ubuntu) OpenSSL/1.1.0g configured -- resuming normal operations
[Wed Apr 24 16:01:15.260232 2019] [core:notice] [pid 19201] AH00094: Command line: '/usr/sbin/Apache2'
[Wed Apr 24 16:01:45.298236 2019] [proxy:debug] [pid 19233] proxy_util.c(1785): AH00925: initializing worker http://127.0.0.1:5123/ shared
[Wed Apr 24 16:01:45.299302 2019] [proxy:debug] [pid 19233] proxy_util.c(1827): AH00927: initializing worker http://127.0.0.1:5123/ local
[Wed Apr 24 16:01:45.299451 2019] [proxy:debug] [pid 19233] proxy_util.c(1878): AH00931: initialized single connection worker in child 19233 for (127.0.0.1)
[Wed Apr 24 16:01:58.912849 2019] [autoindex:error] [pid 19211] [client 50.88.218.180:28627] AH01276: Cannot serve directory /var/www/ct.com/public_html/ps/publish/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Wed Apr 24 16:01:59.408882 2019] [autoindex:error] [pid 19211] [client 50.88.218.180:28627] AH01276: Cannot serve directory /var/www/ct.com/public_html/ps/publish/: No matching DirectoryIndex (index.html,index.cgi,index.pl,index.php,index.xhtml,index.htm) found, and server-generated directory index forbidden by Options directive
[Wed Apr 24 16:02:05.322145 2019] [proxy:debug] [pid 19245] proxy_util.c(1785): AH00925: initializing worker http://127.0.0.1:5123/ shared
[Wed Apr 24 16:02:05.324374 2019] [proxy:debug] [pid 19245] proxy_util.c(1827): AH00927: initializing worker http://127.0.0.1:5123/ local
[Wed Apr 24 16:02:05.324607 2019] [proxy:debug] [pid 19245] proxy_util.c(1878): AH00931: initialized single connection worker in child 19245 for (127.0.0.1)
sslapache-2.4lets-encryptubuntu-18.04
1
joshdeco

間違った例をコピーしました。 ProxyPassは、httpsにリダイレクトする非SSL <VirtualHost *:80>で定義されています。

プロキシのものを<VirtualHost *:443>に移動します。 Microsoftガイドの SSLの例 を参照してください。

また、RewriteRuleを変更し、NEフラグを削除します。ここでは必要ないと思います。
またはSSLの例のルールを使用します。

RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

そして、証明書に何か問題があります...

1
Freddy