jemminger's questions

I've had a site up for a client at http://staging.livecurriculum.com for years. They've managed the DNS on their end, previously through Dreamhost. They recently moved this domain to NetSol and now the site is unavailable for them and what seems like the rest of the world:

http://isup.me/staging.livecurriculum.com

Strangely, the site resolves and works as expected for me still.

Nothing has changed with the vhost conf. They've defined "staging" as an A record on "livecurriculum.com" pointing to the IP of the server 96.126.123.156.

What else can be wrong?

FYI, hitting the URL http://staging.livecurriculum.com when you're not logged in will redirect you to https://secure.livecurriculum.com, and we currently have a self-signed cert there. Just a heads-up on the "Invalid certificate!" warning you'll get.

I've installed a new SSL certificate using SHA2 hashing instead of SHA1. My chain checks out using these online verifiers:

• http://www.sslshopper.com/ssl-checker.html
• http://www.digicert.com/help/

However this one tells me it can't find the Root CA:

• http://www.geocerts.com/ssl_checker

How do I fix this?

Edit: Derp, here's the URL: secure.symt.us

This is on Apache2 on CentOS.

I have followed GoDaddy's setup instructions to the letter and restarted the server.

Edit 2, apache vhost conf:

SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/ca.crt
SSLCertificateKeyFile /etc/pki/tls/private/ca.key
SSLCertificateChainFile /etc/pki/tls/certs/gd_bundle-g2.crt

==== [SOLVED] ====

The problem turned out to be that my vhost was defined as <VirtualHost *:443>. Changing it to the server's IP address <VirtualHost xx.xx.xx.xx:443> fixed it.

There was a catch-all default <VirtualHost _default_:443> albeit without an SSLCertificateChainFile directive. Grepping /etc/httpd for SSLCertificateChainFile returned only my directive.

Perhaps apache has its own default SSLCertificateChainFile internally and refused to send mine when configured as *:443?

I have the exact same configuration for my rails site on a staging server and a production server, aside from the "staging" vs "production" in the file paths.

They're both set up to redirect all requests on port 80 to the SSL version on 443.

This works properly on staging, but in production it's just showing the default Apache test page. Apache doesn't seem to be forwarding the requests to passenger. My rails logs are empty. The apache logs show all of the requests, but there are no errors.

Any ideas?

At the end of httpd.conf:

LoadModule passenger_module /usr/local/lib/ruby/gems/1.9.1/gems/passenger-3.0.19/ext/apache2/mod_passenger.so
PassengerRoot /usr/local/lib/ruby/gems/1.9.1/gems/passenger-3.0.19
PassengerRuby /usr/local/bin/ruby

Include /etc/httpd/conf/extra/httpd-vhosts.conf

vhosts.conf:

NameVirtualHost *:80

<VirtualHost *:80>
  ServerName  goodtogotraining.com
  ServerAlias www.goodtogotraining.com
  Redirect permanent / https://www.goodtogotraining.com/
</VirtualHost>

<VirtualHost www.goodtogotraining.com:443>
   ServerName  goodtogotraining.com
   ServerAlias www.goodtogotraining.com
   DocumentRoot /home/goodtogo/production/current/public
   PassengerMaxPoolSize 18
   RailsEnv production

   SSLEngine on
   SSLCertificateFile    /etc/pki/tls/certs/ca.crt
   SSLCertificateKeyFile /etc/pki/tls/private/ca.key
   SSLCACertificateFile  /etc/pki/tls/certs/ca.crt

   <Directory /home/goodtogo/production/current/public>
     Options -MultiViews
     Allow from all
   </Directory>
</VirtualHost>

If I have this output from top for httpd, how do I determine its total memory usage?

16924 apache    20   0  203m 7108 2852 S  0.0  0.2   0:03.48 httpd                                                                                                                                                                           
16925 apache    20   0  204m 7128 2776 S  0.0  0.2   0:03.40 httpd                                                                                                                                                                           
16926 apache    20   0  203m 7024 2772 S  0.0  0.2   0:03.24 httpd                                                                                                                                                                           
16928 apache    20   0  203m 7164 2852 S  0.3  0.2   0:03.64 httpd                                                                                                                                                                           
16929 apache    20   0  203m 7028 2740 S  0.0  0.2   0:03.37 httpd                                                                                                                                                                           
16930 apache    20   0  203m 6828 2740 S  0.0  0.2   0:03.21 httpd                                                                                                                                                                           
16931 apache    20   0  203m 6916 2728 S  0.0  0.2   0:03.55 httpd                                                                                                                                                                           
16941 apache    20   0  204m 7076 2740 S  0.0  0.2   0:03.39 httpd                                                                                                                                                                           
16995 apache    20   0  203m 6852 2716 S  0.0  0.2   0:03.46 httpd                                                                                                                                                                           
17086 apache    20   0  203m 6988 2716 S  0.0  0.2   0:03.73 httpd                                                                                                                                                                           
17103 apache    20   0  203m 7028 2740 S  0.0  0.2   0:03.46 httpd                                                                                                                                                                           
17194 apache    20   0  204m 7276 2852 S  0.0  0.2   0:03.17 httpd                                                                                                                                                                           
17288 apache    20   0  204m 7176 2840 S  0.0  0.2   0:03.03 httpd                                                                                                                                                                           
18432 apache    20   0  203m 6980 2740 S  0.0  0.2   0:02.31 httpd                                                                                                                                                                           
18659 apache    20   0  203m 6972 2816 S  0.0  0.2   0:01.87 httpd                                                                                                                                                                           
19432 root      20   0  203m 7784 4356 S  0.0  0.2   2:53.45 httpd                                                                                                                                                                           
19686 apache    20   0  203m 6916 2728 S  0.0  0.2   0:01.67 httpd                                                                                                                                                                           
19698 apache    20   0  203m 7048 2840 S  0.0  0.2   0:01.78 httpd                                                                                                                                                                           
19699 apache    20   0  203m 6904 2740 S  0.0  0.2   0:01.93 httpd                                                                                                                                                                           
19700 apache    20   0  203m 7124 2860 S  0.0  0.2   0:02.00 httpd                                                                                                                                                                           
19710 apache    20   0  203m 6736 2740 S  0.3  0.2   0:01.96 httpd                                                                                                                                                                           

According to my NewRelic monitoring, it's using just over 600MB at the above point in time.

I'm trying to redirect ALL traffic for http://*.domain.com to https://secure.domain.com.

What I have so far:

NameVirtualHost *:80
<VirtualHost *:80>
  ServerName domain.com
  ServerAlias *.domain.com
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule (.*) https://secure.domain.com%{REQUEST_URI}
</VirtualHost>

This seems to work for:

www.domain.com
www.domain.com/whatever
anything.domain.com
anything.domain.com/whatever

But not for:

domain.com
domain.com/whatever

What am I missing?

I have apache running on one machine as a load balancer:

<VirtualHost *:443>
  ServerName    ssl.example.com
  DocumentRoot  /home/example/public

  SSLEngine             on
  SSLCertificateFile    /etc/pki/tls/certs/example.crt
  SSLCertificateKeyFile /etc/pki/tls/private/example.key

  <Proxy balancer://myappcluster>
    BalancerMember http://app1.example.com:12345 route=app1
    BalancerMember http://app2.example.com:12345 route=app2
  </Proxy>

  ProxyPass         / balancer://myappcluster/ stickysession=_myapp_session
  ProxyPassReverse  / balancer://myappcluster/

</VirtualHost>

Note that the balancer takes requests under SSL port 443, but then communicates to the balancer members on a non-ssl port. Is it possible to have the forwarding to the balancer members be under SSL too?

If so, is this the best/recommended way?

If so, do I have to have another SSL cert for each balancer member?

Does the SSLProxyEngine directive have anything to do with this?