Common Issues with Apache HTTPS Support

Linux Apps Tutorials - Herong's Tutorial Examples

∟Running Apache HTTP Server (httpd) on Linux Systems

∟Common Issues with Apache HTTPS Support

This section provides examples of some common issues related to HTTPS support on Apache HTTP Server.

Here are some common issues related to HTTPS support on Apache HTTP Server.

1. Missing mod_ssl package on the CentOS system. You will get the "Invalid command 'SSLEngine'" error message in the log file. See error message example and solution below.

herong$ sudo apachectl restart
  Job for httpd.service failed because the control process exited with error code.
  See "systemctl status httpd.service" and "journalctl -xe" for details.

herong sudo systemctl status httpd.service
  systemd[1]: Starting The Apache HTTP Server...
  httpd[359352]: AH00526: Syntax error on line 11 of /etc/httpd/conf.d/ssl.conf:
   httpd[359352]: Invalid command 'SSLEngine', perhaps misspelled or 
    defined by a module not included... 

herong$ sudo dnf install mod_ssl

2. Wrong SELinux context properties on server certificate related files. You will get the "file ... does not exist or is empty" error message in the log file. See error message example and solution below.

herong sudo systemctl status httpd.service
  ... Syntax error on line 14 of /etc/httpd/conf.d/ssl.conf:
  ... SSLCertificateFile: file '/etc/pki/tls/certs/ca-chain-cert.pem'
    does not exist or is empty

herong$ sudo chcon -u system_u /etc/pki/tls/certs/ca-chain-cert.pem

4. Port 443 is blocked by the firewall. User will see a "connection refused" or "connection timed out" error. You need to open firewall for port 443 or server "https"

herong$ sudo firewall-cmd --zone=public --add-service=https
herong$ sudo firewall-cmd --runtime-to-permanent

5. Missing X.509 v3 "Subject Alternative Name" field in server certificate. You need to re-do your server certificate. See error message example from Google Chrome below.

Your connection is not private
  This server could not prove that it is www.example.com; 
  its security certificate does not specify Subject Alternative Names. 
  This may be caused by a misconfiguration or an attacker intercepting 
  your connection.