我在 Ubuntu 20.04 上遇到了这个问题。
它看起来很像许多类似的东西，但经过几个小时的尝试，结果证明它不是通常的东西。
我曾经certbot --apache将 HTTPS 添加到我服务器上的一个工作网站。我要求自动重定向到 HTTPS。一切显然都顺利。我还运行a2enmod ssl; a2nsite default-ssl.conf启用 SSL 模块并重新启动 apache2。
在日志中似乎读取了证书：
[ssl:info] [pid 4187632] AH02568: Certificate and private key mysite.com:443:0 configured from /etc/letsencrypt/live/mysite.com/fullchain.pem and /etc/letsencrypt/live/mysite.com/privkey.pem
我也发现了这个，但找不到足够的文档：
[headers:debug] [pid 4188047] mod_headers.c(899): AH01503: headers: ap_headers_error_filter()
最终发生的情况是，apache2 正在侦听端口 443，但一旦发生重定向，就会通过该端口提供 HTTP 服务。当然，浏览器无法工作并会抛出如下错误：
This site can’t provide a secure connection
mysite.com sent an invalid response.
ERR_SSL_PROTOCOL_ERROR
没有别的。
从另一台服务器我可以做这两个简单的测试：
$ nmap -A -Pn -p 443 mysite.com.
Nmap scan report for mysite.com. (1.2.3.4)
Host is up (0.044s latency).
Other addresses for mysite.com. (not scanned): 1234:1234:123:1234::
rDNS record for 1.2.3.4: host1.hosting.net
PORT STATE SERVICE VERSION
443/tcp open http Apache httpd 2.4.41
|_http-server-header: Apache/2.4.41 (Ubuntu)
|_http-title: Did not follow redirect to https://mysite.com/
Service Info: Host: mysite.com
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 7.64 seconds
和
$ wget -v -v -v https://mysite.com/
--2024-01-15 16:42:45-- https://mysite.com/
Loaded CA certificate '/etc/ssl/certs/ca-certificates.crt'
Resolving mysite.com (mysite.com)... 1.2.3.4, 1234:1234:123:1234::
Connecting to mysite.com (mysite.com)|1.2.3.4|:443... connected.
GnuTLS: An unexpected TLS packet was received.
Unable to establish SSL connection.
这些证实了我的诊断（通过端口 443 的 HTTP），并且没有防火墙阻止任何内容。
有什么提示吗？
我的（主要）配置位如下。
所有其他文件（000-default.conf和default-ssl.conf）都是 Ubuntu 20.04 安装的默认文件。
ports.conf:
# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default.conf
Listen 80
<IfModule ssl_module>
Listen 443
</IfModule>
<IfModule mod_gnutls.c>
Listen 443
</IfModule>
# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
mysite.conf
<VirtualHost _default_:80>
ServerName mysite.com
ServerAlias www.mysite.com
ServerAdmin [email protected]
DocumentRoot /home/fe/public_html
<Directory />
Options FollowSymLinks ExecCGI
AllowOverride All
AuthType Basic
AuthName "Credentials, please"
AuthUserFile /home/fe/.htpasswd
Require valid-user
</Directory>
ScriptAlias /x/ /home/fe/cgi/
<Directory "/home/fe/cgi">
Options ExecCGI
SetHandler cgi-script
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/mysite-error.log
LogLevel debug
CustomLog ${APACHE_LOG_DIR}/mysite-access.log combined
<FilesMatch "\.(cgi|shtml|phtml|php)$">
</FilesMatch>
<Directory /usr/lib/cgi-bin>
</Directory>
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
RewriteEngine on
RewriteCond %{SERVER_NAME} =site.mysite.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>
最后三行已由 添加certbot。
mysite-le-ssl.conf
<IfModule mod_ssl.c>
<VirtualHost _default_:443>
ServerName mysite.com
ServerAlias www.mysite.com
ServerAdmin [email protected]
DocumentRoot /home/fe/public_html
<Directory />
Options FollowSymLinks ExecCGI
AllowOverride All
AuthType Basic
AuthName "Credentials, please"
AuthUserFile /home/fe/.htpasswd
Require valid-user
</Directory>
ScriptAlias /x/ /home/fe/cgi/
<Directory "/home/fe/cgi">
Options ExecCGI
SetHandler cgi-script
Require all granted
</Directory>
ErrorLog ${APACHE_LOG_DIR}/mysite-error.log
LogLevel debug
CustomLog ${APACHE_LOG_DIR}/mysite-access.log combined
<FilesMatch "\.(cgi|shtml|phtml|php)$">
</FilesMatch>
<Directory /usr/lib/cgi-bin>
</Directory>
BrowserMatch "MSIE [2-6]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
SSLCertificateFile /etc/letsencrypt/live/mysite.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/mysite.com/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>
