Início / server / Perguntas / 1176434
Accepted
therobyouknow
Asked: 2025-03-22 06:15:12 +0800 CST

Por que o Apache está escutando na porta 80 do servidor habilitado para SSL?

  • 772

Configurei um vhost para um domínio na porta 80:

<VirtualHost *:80>
    ServerAdmin webmaster@localhost
    ServerName thesolentmetropolitan.com
    DocumentRoot /var/www/10/thesolentmetropolitan.com/deployment_environments/live/docroot
    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    <Directory "/var/www/thesolentmetropolitan.com/docroot">
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
    </Directory>
</VirtualHost>

A visita ao site resulta em:

Pedido ruim

Seu navegador enviou uma solicitação que este servidor não conseguiu entender. Motivo: Você está falando HTTP simples para uma porta de servidor com SSL habilitado. Em vez disso, use o esquema HTTPS para acessar esta URL, por favor. Servidor Apache/2.4.58 (Ubuntu) em 127.0.1.1 Porta 80

Desabilitei todas as outras permutações de vhost https http, www e sem www.

Verifiquei o seguinte (não tenho certeza do que fazer com o seguinte):

sudo lsof -i -n | grep https
apache2   520640            root    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520645        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520662        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520705        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520706        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520707        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520708        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520741        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520743        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520981        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)
apache2   520982        www-data    6u  IPv6 4829014      0t0  TCP *:https (LISTEN)

e verifiquei outros vhosts.

root@server03:/etc/apache2/sites-available# apachectl -S
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
VirtualHost configuration:
*:443                  is a NameVirtualHost
         default server drupalsolent.dev (/etc/apache2/sites-enabled/drupalsolent.dev-le-ssl.conf:2)
         port 443 namevhost drupalsolent.dev (/etc/apache2/sites-enabled/drupalsolent.dev-le-ssl.conf:2)
         port 443 namevhost www.drupalsolent.dev (/etc/apache2/sites-enabled/drupalsolent.dev-le-ssl.conf:21)
         port 443 namevhost eval1.labs.drupalsolent.dev (/etc/apache2/sites-enabled/eval1.labs.drupalsolent.dev-le-ssl.conf:2)
         port 443 namevhost internationalgospelchoir.uk (/etc/apache2/sites-enabled/internationalgospelchoir.uk-le-ssl.conf:2)
         port 443 namevhost staging.internationalgospelchoir.uk (/etc/apache2/sites-enabled/staging.internationalgospelchoir.uk-le-ssl.conf:2)
         port 443 namevhost www.internationalgospelchoir.uk (/etc/apache2/sites-enabled/www.internationalgospelchoir.uk-le-ssl.conf:2)
*:80                   is a NameVirtualHost
         default server drupalsolent.dev (/etc/apache2/sites-enabled/drupalsolent.dev.conf:1)
         port 80 namevhost drupalsolent.dev (/etc/apache2/sites-enabled/drupalsolent.dev.conf:1)
         port 80 namevhost eval1.labs.drupalsolent.dev (/etc/apache2/sites-enabled/eval1.labs.drupalsolent.dev.conf:1)
         port 80 namevhost internationalgospelchoir.uk (/etc/apache2/sites-enabled/internationalgospelchoir.uk.conf:1)
         port 80 namevhost staging.internationalgospelchoir.uk (/etc/apache2/sites-enabled/staging.internationalgospelchoir.uk.conf:1)
         port 80 namevhost thesolentmetropolitan.com (/etc/apache2/sites-enabled/thesolentmetropolitan.com.conf:1)
         port 80 namevhost www.drupalsolent.dev (/etc/apache2/sites-enabled/www.drupalsolent.dev.conf:1)
         port 80 namevhost www.internationalgospelchoir.uk (/etc/apache2/sites-enabled/www.internationalgospelchoir.uk.conf:1)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex mpm-accept: using_defaults
Mutex watchdog-callback: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex ssl-stapling: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/run/apache2/" mechanism=default
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33
Group: name="www-data" id=33
root@server03:/etc/apache2/sites-available#

outras informações para análise:

root@server03:/etc/apache2/sites-available# cat drupalsolent.dev.conf
<VirtualHost *:80>
  ServerName drupalsolent.dev
  RedirectPermanent / https://drupalsolent.dev/
</VirtualHost>

Tentei o domínio em diferentes redes: fixa e móvel, o mesmo erro, então acho que deve ser algo no servidor.

O que poderia ser?

Preciso resolver esse problema porque me conecto na porta 80 para que o LetsEncrypt forneça um certificado https.

Obrigado pela ajuda.

Eu dei uma olhada em Servir a porta 443 por http cria o erro 400 Bad Request em vez de redirecionar, que tem algumas semelhanças, mas não é bem o que estou procurando.

apache-2.4

1 respostas

  1. Best Answer

    Resolvido. Possível configuração incorreta de outros arquivos conf do vhost

    Parece que isso está resolvido.

    http://thesolentmetropolitan.com e http://thesolentmetropolitan.com:80 agora se comportam como esperado - ambos redirecionam para https://thesolentmetropolitan.com - e posso renovar este domínio e também https://internationalgospelchoir.uk e https://www.internationalgospelchoir.uk .

    O que fiz foi desabilitar todos os outros arquivos vhost .conf, como mostra meu log de terminal.

    Acho que sua contribuição @vidarlo: Por que o Apache está escutando na porta 80 do servidor com SSL habilitado? ajudou a considerar a necessidade de considerar os outros arquivos de configuração.

    Parece-me que copiar e colar de um arquivo vhost deixou o domínio original lá e não o atualizou com o domínio correto. Por exemplo, estou pensando se fiz uma cópia do arquivo drupalsolent.dev.conf para o arquivo thesolentmetropolitan.com.conf e deixei o domínio drupalsolent.dev lá, ou algo assim. Acho que o problema é algo assim, onde um copiar e colar deu errado.

    Vou analisar isso mais a fundo. Por enquanto, parece que não preciso construir outro servidor.

    Tentarei investigar a causa raiz mais específica.

    root@server03:/etc/apache2/sites-available# ls
000-default.conf                         internationalgospelchoir.uk.conf-2
drupalsolent.dev-le-ssl.conf             staging.internationalgospelchoir.uk-le-ssl.conf
drupalsolent.dev.conf                    staging.internationalgospelchoir.uk.conf
eval1.labs.drupalsolent.dev-le-ssl.conf  thesolentmetropolitan.com.conf
eval1.labs.drupalsolent.dev.conf         www.drupalsolent.dev.conf
internationalgospelchoir.uk-le-ssl.conf  www.internationalgospelchoir.uk-le-ssl.conf
internationalgospelchoir.uk.conf         www.internationalgospelchoir.uk.conf
root@server03:/etc/apache2/sites-available# a2dissite 000-default.conf
Site 000-default already disabled
root@server03:/etc/apache2/sites-available# a2dissite drupalsolent.dev-le-ssl.conf
Site drupalsolent.dev-le-ssl disabled.
To activate the new configuration, you need to run:
  systemctl reload apache2
root@server03:/etc/apache2/sites-available# a2dissite drupalsolent.dev.conf
Site drupalsolent.dev disabled.
To activate the new configuration, you need to run:
  systemctl reload apache2
root@server03:/etc/apache2/sites-available# a2dissite eval1.labs.drupalsolent.dev-le-ssl.conf
Site eval1.labs.drupalsolent.dev-le-ssl disabled.
To activate the new configuration, you need to run:
  systemctl reload apache2
root@server03:/etc/apache2/sites-available# a2dissite eval1.labs.drupalsolent.dev.conf
Site eval1.labs.drupalsolent.dev disabled.
To activate the new configuration, you need to run:
  systemctl reload apache2
root@server03:/etc/apache2/sites-available# a2dissite staging.internationalgospelchoir.uk-le-ssl.conf
Site staging.internationalgospelchoir.uk-le-ssl disabled.
To activate the new configuration, you need to run:
  systemctl reload apache2
root@server03:/etc/apache2/sites-available# a2dissite staging.internationalgospelchoir.uk.conf
Site staging.internationalgospelchoir.uk disabled.
To activate the new configuration, you need to run:
  systemctl reload apache2
root@server03:/etc/apache2/sites-available# a2dissite www.drupalsolent.dev.conf
Site www.drupalsolent.dev disabled.
To activate the new configuration, you need to run:
  systemctl reload apache2
root@server03:/etc/apache2/sites-available# systemctl reload apache2
root@server03:/etc/apache2/sites-available# ls
000-default.conf                         internationalgospelchoir.uk.conf-2
drupalsolent.dev-le-ssl.conf             staging.internationalgospelchoir.uk-le-ssl.conf
drupalsolent.dev.conf                    staging.internationalgospelchoir.uk.conf
eval1.labs.drupalsolent.dev-le-ssl.conf  thesolentmetropolitan.com.conf
eval1.labs.drupalsolent.dev.conf         www.drupalsolent.dev.conf
internationalgospelchoir.uk-le-ssl.conf  www.internationalgospelchoir.uk-le-ssl.conf
internationalgospelchoir.uk.conf         www.internationalgospelchoir.uk.conf
root@server03:/etc/apache2/sites-available# exit
exit
rob@server03:~$ sudo certbot --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: internationalgospelchoir.uk
2: www.internationalgospelchoir.uk
3: thesolentmetropolitan.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 3
Requesting a certificate for thesolentmetropolitan.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/thesolentmetropolitan.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/thesolentmetropolitan.com/privkey.pem
This certificate expires on 2025-06-23.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for thesolentmetropolitan.com to /etc/apache2/sites-available/thesolentmetropolitan.com-le-ssl.conf
Congratulations! You have successfully enabled HTTPS on https://thesolentmetropolitan.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
rob@server03:~$
rob@server03:~$ sudo certbot --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log

Which names would you like to activate HTTPS for?
We recommend selecting either all domains, or all domains in a VirtualHost/server block.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: internationalgospelchoir.uk
2: www.internationalgospelchoir.uk
3: thesolentmetropolitan.com
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): 2
Renewing an existing certificate for www.internationalgospelchoir.uk

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/www.internationalgospelchoir.uk/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/www.internationalgospelchoir.uk/privkey.pem
This certificate expires on 2025-06-23.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

Deploying certificate
Successfully deployed certificate for www.internationalgospelchoir.uk to /etc/apache2/sites-enabled/www.internationalgospelchoir.uk-le-ssl.conf
Your existing certificate has been successfully renewed, and the new certificate has been installed.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you like Certbot, please consider supporting our work by:
 * Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
 * Donating to EFF:                    https://eff.org/donate-le
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
rob@server03:~$

    Referência: https://community.letsencrypt.org/t/how-to-re-create-cert-i-just-have-standard-apache-vhost-config-files-for-port-80-443/235394 para discussão relacionada sobre a tentativa de renovar https.

    • 1

relate perguntas