使用 SSL 证书和多个域设置 apache 反向代理

Question

I need help configuring Apache to act as a reverse proxy with https and multiple domains, such that www.myfirstdomain.com and www.myseconddomain.com both point to xxxx and than the server will selectively forward to, let's say, xxxx:2400 ( myfirstdomain.com , http), xxxx:2401 ( myfirstdomain.com , https), xxxx :2600 ( myseconddomain.com , http) and xxxx:2601 ( mysecondomain.com , https).

I tried many options but in the end I got stuck because I issued more than 5 certs (renews) per week and also I couldn't make it work.

myfirstdomain.com and www.myfirstdomain.com (http and https) were configured as follows:

/etc/apache2/sites-available/000-default.conf :

<VirtualHost *:80>
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:2400/
    ProxyPassReverse / http://127.0.0.1:2400/
</VirtualHost>

<VirtualHost *:443>
    ProxyPreserveHost On
    ProxyPass / http://127.0.0.1:2401/
    ProxyPassReverse / http://127.0.0.1:2401/
</VirtualHost>

<VirtualHost *:2400>
    ServerName myfirstdomain.com
    ServerAlias www.myfirstdomain.com
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html/myfirstdomain/public
    <Directory /var/www/html/myfirstdomain/public>
            Options Indexes FollowSymLinks
            AllowOverride All
            Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    RewriteEngine on
    RewriteCond %{SERVER_NAME} =myfirstdomain.com
    RewriteRule ^ https://www.%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

    RewriteCond %{SERVER_NAME} =www.myfirstdomain.com
    RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:2401>
    ServerName myfirstdomain.com
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/html/myfirstdomain/public
    <Directory /var/www/html/myfirstdomain/public>
            Options Indexes FollowSymLinks
            AllowOverride All
            Require all granted
    </Directory>

    CustomLog ${APACHE_LOG_DIR}/access.log combined

    RewriteEngine on
    RewriteCond %{SERVER_NAME} =myfirstdomain.com
    RewriteRule ^ https://www.%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

Then I generated the certs with certbot --apache for both www and non-www and I had this file:

/etc/apache2/sites-available/000-default-le-ssl.conf :

<IfModule mod_ssl.c>
    <VirtualHost *:443>
        ProxyPreserveHost On
        ProxyPass / http://127.0.0.1:2401/
        ProxyPassReverse / http://127.0.0.1:2401/
    </VirtualHost>

    <VirtualHost *:2401>
        ServerName myfirstdomain.com
        ServerAlias www.myfirstdomain.com
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html/myfirstdomain/public
        <Directory /var/www/html/myfirstdomain/public>
                Options Indexes FollowSymLinks
                AllowOverride All
                Require all granted
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        RewriteEngine on
        # Some rewrite rules in this file were disabled on your HTTPS site,
        # because they have the potential to create redirection loops.

        #     RewriteCond %{SERVER_NAME} =myfirstdomain.com
        #     RewriteRule ^ https://www.%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

        #     RewriteCond %{SERVER_NAME} =www.myfirstdomain.com
        #     RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]


        SSLCertificateFile /etc/letsencrypt/live/www.myfirstdomain.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/www.myfirstdomain.com/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
    </VirtualHost>

I also tried to regenerate the HTTPS certificates but it won't work. How do I do it?

Answer 1

First of all, remember that Apache listens on a range of ports, for instance 80 and 443.

Virtualhosts use the same ports (80 and 443) and Apache selects the correct folder using the domain name you use.

For example, myfirstdomain.com could display /var/www/html/myfirstdomain/public, but if apache listens on port 80, it never match the rule for *:2400.

I haven't tryed this, but you could put ProxyPass and ProxyPassReverse in each virtual hosts and leave the port to :80 or :443.

When you call myfirstdomain.com:80 , the rule on apache match and it executing proxing to another server.

See this answer .

LetsEncrypt create an ACME challenge (a file with a random string) that could be reachable from the internet. The Certification Server search this file, if exists the certificate is released; if not, it throw an error.

I don't remember the correct pathof the file, but you must verify:

• can you reach "myfistdomain.com" from the internet?
• an external server can reach "myfistdomain.com" ? (check dns name and port forwarding of your router
• can you open the ACME challenge file?
• can the server open the ACME challenge file?

On some Plesk installations acme files cannot be reacheable because Plesk adds some automatic rules.