Can't configure Apache to serve https on alternate port

lostjohnny · 10-25-2009, 08:43 AM

Hi,

I've been running an Apache web server serving on the default http and https ports for over a year now. But there is now another https server on the network whose port can't be configured, so I'm trying to get my server to serve https on an alternate port so that it can be accessed from the Internet.

In /etc/httpd/conf.d/ssl.conf I changed the Listen directive to

Code:

Listen 1184

and restarted httpd. Now when I try to connect with

Code:

lynx https://127.0.0.1:1184/

I get the error

Code:

Looking up 127.0.0.1:1184
Making HTTPS connection to 127.0.0.1:1184
Retrying connection without TLS.
Looking up 127.0.0.1:1184
Making HTTPS connection to 127.0.0.1:1184
Alert!: Unable to make secure connection to remote host.

lynx: Can't access startfile https://127.0.0.1:1184/

nmap gives

Code:

Starting Nmap 4.11 ( http://www.insecure.org/nmap/ ) at 2009-10-25 13:35 GMT
Interesting ports on localhost (127.0.0.1):
Not shown: 1674 closed ports
PORT     STATE SERVICE
22/tcp   open  ssh
25/tcp   open  smtp
80/tcp   open  http
111/tcp  open  rpcbind
960/tcp  open  unknown
3306/tcp open  mysql

Nmap finished: 1 IP address (1 host up) scanned in 0.130 seconds

There are no virtual hosts defined in my /etc/httpd/conf/httpd.conf

Any ideas, please?

bathory · 10-25-2009, 09:19 AM

Ypu should start by checking the apache error_log for hints.

Regards

harry edwards · 10-25-2009, 09:31 AM

Do you have firewall blocking the port?

Wim Sturkenboom · 10-25-2009, 10:02 AM

There can be 10s or 100s or 1000s or ... apache servers listening on port 443 in the same network. They are differentiated by their ip-addresses.

So I suppose I'm missing something. Can you please try to explain what I'm missing ?

lostjohnny · 10-28-2009, 07:36 AM

Thanks bathory, I hadn't thought of looking in the logs for errors.

harry edwards, I've disabled the firewall temporarily while I sort this out, so it's not the firewall. Also, I don't know if the firewall blocks access on the local machine anyway.

Wim Sturkenboom, I want this to be accessed from the Internet. All servers on the network can only be accessed by the router's single public IP address, so I need alternate ports to distinguish which one the client is requesting.

Wim Sturkenboom · 10-28-2009, 08:07 AM

The simplest test is to use telnet 127.0.0.1 1184 If it can't connect, check
- firewall was already mentioned and you ruled it out
- hosts.allow and hosts.deny
- apache is not listening on that port

Could you connect using lynx https://127.0.0.1 before the changes? I'm thinking that lynx does not like your certificate as it contains a domain name and 127.0.0.1 does not match that domain name; but I might be wrong.

anomie · 10-30-2009, 12:47 PM

Check the output of # netstat -ltn

If there is nothing listening on tcp 1184, it is pointless to test connecting there.

As mentioned, Apache's error log should provide clues...