让我们在AWS Lightsail中的bitnami.conf中加密SSL设置

Question

I created a new Instance in AWS Lightsail and Configured a domain example.com which has 2 subdomains as well. test.example.com and app.example.com .

I removed the default bitnami.conf and created a new one. This removed the predefined SSL setup code. I installed Lets encrypt by following this tutorial .

Here is my bitnami.conf file before adding SSL. I could access all the websites as desired.

ServerName example.com

<VirtualHost *:80>

    ServerName example.com
       <Directory /opt/bitnami/apache2/htdocs/default_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>

    DocumentRoot /opt/bitnami/apache2/htdocs/default_website
</VirtualHost>



<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/app_website
    <Directory /opt/bitnami/apache2/htdocs/app_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName app.example.com

</VirtualHost>



<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/test_website
     <Directory /opt/bitnami/apache2/htdocs/test_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName test.example.com

</VirtualHost>

Here is my bitnami.conf file after adding SSL code. Redirection from example.com to https://example.com works fine, but the page doesn't load in https . I'm getting ERR_CONNECTION_REFUSED error.

New bitnami.conf file

ServerName example.com

<VirtualHost *:80>

    ServerName example.com
    RewriteEngine On
            RewriteCond %{HTTPS} !=on
            RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R,L]

       <Directory /opt/bitnami/apache2/htdocs/default_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>

    DocumentRoot /opt/bitnami/apache2/htdocs/default_website
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/opt/bitnami/apache2/htdocs/default_website"
SSLEngine on
SSLCertificateFile "/opt/bitnami/apache2/conf/server.crt"
SSLCertificateKeyFile "/opt/bitnami/apache2/conf/server.key"

<Directory "/opt/bitnami/apache2/htdocs/default_website">
Options Indexes FollowSymLinks
AllowOverride All
<IfVersion < 2.3 >
Order allow,deny
Allow from all
</IfVersion>
<IfVersion >= 2.3 >
Require all granted
</IfVersion>
</Directory>

# Error Documents
ErrorDocument 503 /503.html

# Bitnami applications installed with a prefix URL (default)
Include "/opt/bitnami/apache2/conf/bitnami/bitnami-apps-prefix.conf"
</VirtualHost>



<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/app_website
    <Directory /opt/bitnami/apache2/htdocs/app_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName app.example.com
</VirtualHost>


<VirtualHost *:80>

    DocumentRoot /opt/bitnami/apache2/htdocs/test_website
     <Directory /opt/bitnami/apache2/htdocs/test_website>
                                     DirectoryIndex index.html
                                     AllowOverride All
                                     Require all granted
                     </Directory>
    ServerName test.example.com
</VirtualHost>

Answer 1

Bitnami Engineer here. You also need to define the new port in which Apache will start to listen and the different cyphers and protocols it will accept. These lines are included in the bitnami.conf file we include in our stacks by default

Listen 443
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !EDH !RC4"
SSLPassPhraseDialog  builtin
SSLSessionCache "shmcb:/opt/bitnami/apache2/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300

You will need to include them before defining the VirtualHost for the port 443

I hope this helps