Subject: Re: Re: SSL works from localhost but not elsewhere

From: Eric Webber <[email-masked]>
Date: Thu, 28 Feb 2002 13:18:32 -0500

thanks for the reply.

I doubt it is the firewall since
the I am trying to access https://192.168.0.80/
from another PC on the same LAN, i.e. router
does not come into play.

That IP address is an internal IP address to the
LAN.  So for example my webserver with mod_ssl
running is on IP 192.168.0.80, and the PC I am 
trying to access it with is 192.168.0.3 for 
example.

When I use a web browser on 192.168.0.80 with
URL https://localhost/ or the URL 
https://192.168.0.80/ SSL works fine with 
corresponding log entries in both access_log
and ssl_request log being made.

But when I use browser on 192.168.0.3 with 
URL https://192.168.0.80/  it responds with 
Page Cannot be Displayed with Explorer, and
connection refused with Netscape and in 
both cases no log entries are made on the 
server in either access_log or ssl_request log.

Of course I checked if normal http works from
192.168.0.3 and it does of course.

I am at a loss as to why this is.

warmest regards,

Eric Sean Webber

________________________________________________
Get your own "800" number
Voicemail, fax, email, and a lot more
http://www.ureach.com/reg/tag

---- On Thu, 28 Feb 2002, Andrew Lietzow ([email-masked])
wrote:

> Dear Owen,
> Personally I am not a big fan of opening attachments from unknown
> sources.
> Since you're on this list, you're
> probably a trusted source but I was not aware that sending
attachments
> through this list server was even an option.  Perhaps I am a bit
> paranoid
> about viruses?
> 
> With that said, here are a series of things that I would check.
> 1) Do you have a firewall that might be preventing HTTPS access?
> 2) Do other non-secure pages from that server come up in your
> browser-wowser?
> 3) In httpd.conf, do you have any entries similar to the following:
> 
> NameVirtualHost $IPADDR
> 
> <VIrtualHost $IPADDR:443>
>     ServerAdmin webmaster@$YOURDOMAINNAME
>     ServerName $YOURDOMAINNAME
>     Port 443
>     DocumentRoot /var/www/secure.yourdomain.name
>         (or whereever you store your documents that you want to
bring up
> on
> the secure server.  You need to have something in that directory
that
> you
> can bring up if you don't have index.html)
>    ErrorLog    logs/$YOURDOMAINNAME_err
>    TransferLog    logs/$YOURDOMAINNAME_transfer
> </VirtualHost>
> 
> If you have the ErrorLog file, what is it telling you?  Any hints
there?
> 
> Also, in your named.domain.xxx file, do you have an entry for your
> secure
> server if it is running on a different server than your main web
site?
> 
> Probably this info is more than you need, and I am a newbie, but
better
> more
> than not enough :-)
> 
> Good luck!
> 
> Andrew Lietzow
> The ACL Group, Inc.
> 
> 
> 
> 
> 
> sure that your firewall is allowing HTTP and HTTPS access?
> ----- Original Message -----
> From: "Eric Webber" <[email-masked]>
> To: <[email-masked]>
> Sent: Wednesday, February 27, 2002 2:16 PM
> Subject: SSL works from localhost but not elsewhere
> 
> 
> >
> >
> > When I go to the url https://localhost
> > using netscape on the same box running
> > apache and mod_ssl, SSL appears to
> > work fine.
> >
> > But when I come in from a box other than
> > the box running apache and mod_ssl, I get
> > Page cannot be displayed.
> >
> > I have apache 1.3.20 RedHat, OpenSSL
> > version 0.9.6b, on redhat version 2.4.7-10.
> >
> > Is this because of the Servername ?  I am at
> > a loss and cannot find the solution in the
> > mod_ssl documentation.  Is there a set of
> > tests to help ferret out this problem ?
> >
> > warmest regards,
> >
> >
> > Eric Sean Webber
> >
> >
> > here is a copy of my httpd.conf as a file
> > attachment
> >
> >
> >
> >
> > ________________________________________________
> > Get your own "800" number
> > Voicemail, fax, email, and a lot more
> > http://www.ureach.com/reg/tag
> 
>
______________________________________________________________________
> Apache Interface to OpenSSL (mod_ssl)                  
www.modssl.org
> User Support Mailing List                     
[email-masked]
> Automated List Manager                           
[email-masked]

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Glen Mehn <[email-masked]>
Date: Thu, 28 Feb 2002 10:11:00 -0800

you could have a local firewall on the machine-- iptables or ipchains, perhaps?

Do you have a NameVirtualHost directive? Something liek:

NameVirtualHost 192.168.0.80:443

In your SSL VirtualHost directive, have you specified the IP also?

glen

-- 
Glen S Mehn
Lead Systems Administrator		SquareTrade, Inc
[email-masked]	Building Trust in Transactions (sm)
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Andrew Lietzow" <[email-masked]>
Date: Thu, 28 Feb 2002 15:56:55 -0600

Dear Eric and list,
RE:>>I doubt it is the firewall since the I am trying to access
https://192.168.0.80/  from another PC on the same LAN, i.e. router does not
come into play.
-----------------
 I only mention the firewall issue because if you have one, it could be the
culprit.  I just spent the better part of two days phutzing with my firewall
to allow two new services and the problem was the firewall.  I have an
internal LAN as well.   Test by flushing all ipchains rules and enabling all
policies to ACCEPT packets.  If it works, you've got your answer.

I am suspect of your NameVirtualHost and Virtual Host settings.  I would
spend some time studying the VirtualHost doc pages at the
http://www.apache.org web site and see if that doesn't give you some
options.

Just got through setting mod_ssl up myself last night so the process still
fresh in my memory.  Two days from now, I may not be so quick to offer
suggestions.  I did, however, set my secure server up on a different IP
address/machine than the DNS/web server.  i.e. the main pages are on one
server and the secure server is a different machine.
-------------
RE:>>and in both cases no log entries are made on the server in either
access_log or ssl_request log.
----
If you are using RedHat, you might check
>/var/log/messages<.
This could be where you get some clues as to whether it is a firewall issue.
I think this file structure is fairly standard across *nix's and it provided
major help for why my new services were not allowing access to the server.

Good Luck!

Andrew Lietzow
The ACL Group, Inc.
At any given moment, on a continuum between dunce and genius.  Hope you're
catching me on a good day. :-)