Apache server at port 443 ошибка

Web server errors often put users in a panic situation. And, when the error affects multiple websites, things go for a toss.

Apache not listening on port 443 is a typical error that happens after turning ON SSL on websites. This can happen due to many reasons like wrong Apache settings, firewall blocks and more.

At Bobcares, we often get requests from customers to fix Apache related errors as part of our Technical Support Services.

Today, we’ll see how Bobcares’ Engineers diagnose and fix Apache not listening on port 443 error.

Relevance of Apache port 443

By default, Apache uses port 80 for normal web traffic. But, when it has to deal with secure web transactions, it uses the port 443. This secure transaction works using the SSL certificate.  When you go to a website which uses the link containing https:// at the beginning, you are connecting to port 443 of the web server. And for this to work, 443 port must be open on the server and Apache should listen on this port.

Data transferred across such https connections are highly resistant to eavesdropping.

In Apache, the Listen directive tells the server to accept incoming requests only on the specified ports. For example, to make the server accept connections on both port 80 and port 443, on all interfaces, we need to use:

Listen 80
Listen 443

Or, if for security reasons, we need to restrict https connection on a specific IP, we set the Apache config directive as

Listen :443

Here, we replace IP with the specific IP address of the server that need to handle secure traffic.

However, server will accept connection on port 443 only if inbound traffic is allowed via firewall too.

Reasons for Apache not listening on port 443

Apache not listening on port 443 is a common issue that we see while handling server. There could be several reasons for the error. Let’s check each of them in detail.

1. Wrong Apache configuration

Often issues with port 443 happen due to wrong entries in Apache configuration file. For example, some customers may add the ‘Listen‘ directive in the particular SSL include file at /etc/httpd/conf/extra/httpd-ssl.conf. But, may forget to activate the Include line in the main httpd.conf file. Thus, it may end up in port 443 connection failure.

Similarly, duplicate Listen statements, sites pointing to wrong IP address etc. also can create problems with secure websites. Again, the Apache configuration entries may be correct, but server will not have SSL module support. This again stops the working of SSL.

2. Port already in use

Yet another reason for port 443 failure is port used by some other service. In such cases, as the port 443 is already in use, Apache cannot start secure SSL connection.

3. Firewall blocks

Another common reason for Apache not listening on port 443 would be firewall. This could be the firewall that resides inside the server. Only when there are specific rules to accept connections, Apache would listen on port 443.

Moreover, network firewall also affect the port 443 connection. Certain organization may block several ports in their corporate firewall as part of tightening security. And, if port 443 is not allowed, users will have problems accessing websites using https:// link

Recently, when a customer reported problems with his secure websites, it was the Network Address Translation rules that created problems. The iptables NAT table had some rules redirecting traffic coming in on port 443 to a different port (8443). Unfortunately, nothing was listening on port 8443 and it resulted in website failure.

How we fix Apache port 443

We now know the probable reasons for port 443 failure. Now, let’s take a look at how our Support Engineers troubleshoot and fix the secure website connection.

1. Correcting Apache conf

As the first step, we check the Apache server configuration for typical errors. Recently, a customer reported the following error while trying Apache restart.

* Restarting web server apache2

(98)Address already in use: make_sock: could not bind to address [::]:443 [ OK ] 

On checking, we could see that there was an extra “Listen 443″ entry in /etc/apache2/ports.conf file. This was creating the conflict. After removing the duplicate entry followed by an Apache restart, the website started working fine.

2. Verifying services on port 443

When there do not exists any error with Apache configuration and still if port 443 connection fails, then we check for duplicate service listening on port 443 using:

netstat -ntupl | grep :443

Here, it will show the services listening on port 443. Therefore, to fix, our Dedicated Engineers stop the duplicate service and do an Apache restart.

3. Fixing firewall

When having problems with port 443 connection, isolating firewall problems can be tricky. Here, we first check if the port is accessible within the server. For this, we use the command :

telnet localhost 443

And, if the connection fails, most probably, the port 443 will not be open in the server firewall.

In servers using iptables, we use below command to open port 443.

iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
service iptables save
service iptables restart

Again, when firewall programs like  UFW was blocking port access, we had to execute “ufw allow 443” which fixed the underlying problem.

Additionally, if server listens correctly on port 443, it means that problem lies with the network firewall. This involves working with the server data center or modifying the network firewall settings too.

[Apache fails on port 443? We can make website secure access working.]

Conclusion

In short, the common reasons for Apache not listening on port 443 include wrong configuration settings, network firewall, etc. Today, we saw how our Support Engineers fix port 443 connection and make secure websites working again.

var google_conversion_label = «owonCMyG5nEQ0aD71QM»;

I have an Apache 2.4 on Debian and configured two VirtualHosts:

1. The first is listening to port 80 to forward all «unsecure» requests to my secure VirtualHost.
2. The second is the «secure» VirtualHost and listening to port 443.

Note: I use the «example.com» in my text, but I have a non-fake domain with SSL

When I test the connection to https://example.com I get an error.
«error:1408F10B:SSL routines:ssl3_get_record:wrong version number» on client side with curl / «ERR_SSL_PROTOCOL_ERROR» with Chrome
«AH00566: request failed: malformed request line» at Apache server side

When I test the connection with port 443 https://example.com:443 it also results in same error.

When I test the connection to http://example.com:443 (protocol http and port 443) the default index page of apache is successfully shown. …. Although this is not my own index.html which I actually expected. But this is another issue for later.

Since the last test success I guess that there is no issue with SSL certificate, right?

Apache seams to listen on both ports:

> sudo apache2ctl -S
VirtualHost configuration:
*:80                   example.com (/etc/apache2/sites-enabled/example.com.conf:10)
*:433                  example.com (/etc/apache2/sites-enabled/example.com.conf:21)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex ssl-stapling: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/run/apache2/" mechanism=default
Mutex watchdog-callback: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33
Group: name="www-data" id=33

> netstat -tupln
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -
udp        0      0 0.0.0.0:68              0.0.0.0:*                           -
udp6       0      0 fe80::250:56ff:fe20:546 :::*      

My «ports.conf»:

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default.conf

Listen 0.0.0.0:80

<IfModule ssl_module>
        Listen 0.0.0.0:443
</IfModule>

<IfModule mod_gnutls.c>
        Listen 0.0.0.0:443
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

My «example.com.conf» in sites-enabled:

########
# main config file for my webpage
########

# NameVirtualHost is deprected
#NameVirtualHost *:443

<VirtualHost *:80>
   ServerName example.de
   # this line is masked for superuser.com due to privacy
   ServerAlias XXXXXXX.online-server.cloud www.example.com xxx.xxx.xx.xx
   Redirect permanent / https://example.com
   LogLevel debug
   CustomLog ${APACHE_LOG_DIR}/example-nossl-access.log combined
   ErrorLog ${APACHE_LOG_DIR}/example-nossl-error.log

</VirtualHost>

# Default-Host
<VirtualHost *:433>
    # admin mail given to user when any issues occur
    ServerAdmin dodo@example.com
    # the domain that routes to DocumentRoot
    ServerName example.com
    # alias which also routes to DocumentRoot
    # this line is masked for superuser.com due to privacy
    ServerAlias www.example.com XXXXXX.online-server.cloud xxx.xxx.xx.xx

    DocumentRoot /var/www/example-homepage
    LogLevel debug
    CustomLog ${APACHE_LOG_DIR}/example-access.log combined
    ErrorLog ${APACHE_LOG_DIR}/example-error.log
    #<IfModule mod_ssl.c>
        SSLEngine on
        SSLCertificateKeyFile /etc/apache2/ssl/_.example.com_private_key.key
        SSLCertificateFile /etc/apache2/ssl/example.com_ssl_certificate.cer
    #</IfModule>
</VirtualHost>

<Directory /var/www/example-homepage>
    # allow .htaccess files in root directory
    AllowOverride All
</Directory>

Edit SSL Logs:

[Fri Feb 07 07:17:37.546729 2020] [ssl:info] [pid 83145:tid 139622694843520] AH01914: Configuring server example.com:443 for SSL protocol
[Fri Feb 07 07:17:37.546735 2020] [ssl:debug] [pid 83145:tid 139622694843520] ssl_engine_init.c(1750): AH10083: Init: (example.com:443) mod_md support is unavailable.
[Fri Feb 07 07:17:37.546943 2020] [ssl:debug] [pid 83145:tid 139622694843520] ssl_engine_init.c(479): AH01893: Configuring TLS extension handling
[Fri Feb 07 07:17:37.547220 2020] [ssl:debug] [pid 83145:tid 139622694843520] ssl_util_ssl.c(476): AH02412: [example.com:443] Cert matches for name 'example.com' [subject: CN=*.example.com / issuer: CN=Encryption Everywhere DV TLS CA - G1,OU=www.digicert.com,O=DigiCert Inc,C=US / serial: 0C9227F96F2A0EFA7B7E6F7391B9EBA0 / notbefore: Dec 26 00:00:00 2019 GMT / notafter: Dec 25 12:00:00 2020 GMT]
[Fri Feb 07 07:17:37.547229 2020] [ssl:info] [pid 83145:tid 139622694843520] AH02568: Certificate and private key example.com:443:0 configured from /etc/apache2/ssl/example.com_ssl_certificate.cer and /etc/apache2/ssl/_.example.com_private_key.key

Edit 2 Verbose log from curl:

* Expire in 0 ms for 6 (transfer 0x55ac2933ef50)
* Expire in 1 ms for 1 (transfer 0x55ac2933ef50)
...
*   Trying xxx.xxx.xx.xx...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x55ac2933ef50)
* Connected to example.com (xxx.xxx.xx.xx) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

Please help me to understand why https is not mapped to port 443 and to fix that issue so I can access my webpage with https://example.com.

Recently configured SSL on Apache 2.4/Ubuntu 20.04 hosted on Oracle Cloud and have been getting connection refused for https/port 443.

External device:

$ curl simpliassure.com:443
curl: (7) Failed to connect to simpliassure.com port 443: Connection refused

$ curl simpliassure.com
(normal html content loads)

$ nmap -p 443 132.145.100.143
Host is up (0.024s latency).
PORT    STATE  SERVICE
443/tcp closed https

ssh’d into server:

$ curl localhost
(normal html content loads)

$ curl localhost:443
(normal html content loads)

$ curl https://localhost
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

$ apachectl configtest
Syntax OK

$ sudo apache2ctl -S
VirtualHost configuration:
132.145.100.143:80     simpliassure.com (/etc/apache2/sites-enabled/default-ssl.conf:3)
132.145.100.143:443    simpliassure.com (/etc/apache2/sites-enabled/default-ssl.conf:14)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex ssl-stapling: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/run/apache2/" mechanism=default 
Mutex mpm-accept: using_defaults
Mutex watchdog-callback: using_defaults
Mutex ssl-stapling-refresh: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33
Group: name="www-data" id=33

$ ss -tupln
Netid  State   Recv-Q  Send-Q    Local Address:Port   Peer Address:Port Process 
udp    UNCONN  0       0               0.0.0.0:111         0.0.0.0:*            
udp    UNCONN  0       0         127.0.0.53%lo:53          0.0.0.0:*            
udp    UNCONN  0       0        10.0.0.29%ens3:68          0.0.0.0:*            
udp    UNCONN  0       0                  [::]:111            [::]:*            
tcp    LISTEN  0       4096            0.0.0.0:111         0.0.0.0:*            
tcp    LISTEN  0       4096      127.0.0.53%lo:53          0.0.0.0:*            
tcp    LISTEN  0       128             0.0.0.0:22          0.0.0.0:*            
tcp    LISTEN  0       4096               [::]:111            [::]:*            
tcp    LISTEN  0       511                   *:80                *:*            
tcp    LISTEN  0       128                [::]:22             [::]:*            
tcp    LISTEN  0       511                   *:443               *:* 

/etc/sites-available/default-ssl.conf is the only symlink under /etc/sites-enabled/default-ssl.conf

/etc/sites-available/default-ssl.conf:

<IfModule mod_ssl.c>
    <VirtualHost 132.145.100.143:80>
        ServerAdmin webmaster@localhost
        ServerName simpliassure.com

        DocumentRoot /var/www/html

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

    </VirtualHost>

    <VirtualHost 132.145.100.143:443>
        ServerAdmin webmaster@localhost
        ServerName simpliassure.com

        DocumentRoot /var/www/html

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        SSLEngine on

        SSLCertificateFile /home/ubuntu/certificate_bundle/www.simpliassure.com.crt
        SSLCertificateKeyFile /home/ubuntu/certificate_bundle/www.simpliassure.com.key
        SSLCertificateChainFile /home/ubuntu/certificate_bundle/www.simpliassure.com_intermediate.crt

        <FilesMatch ".(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                SSLOptions +StdEnvVars
        </Directory>
    </VirtualHost>
</IfModule>

/etc/apache2/ports.conf:

Listen 80
Listen 443

Ubuntu’s ufw is inactive.
Ran…

$ sudo ufw allow https
$ sudo a2enmod ssl
$ sudo a2enmod headers
$ sudo a2ensite default-ssl
$ sudo systemctl restart apache2

… with no luck.

Oracle Virtual Cloud Network Ingress Rules:

Any ideas?

I’ve purchased an SSL and I’m trying to set it on a browser.
The port is forwarded in the router to the server, and I believe that SSL certificate is installed correctly (the apache starts OK).

I opened the port in the IPtables firewall, but when I list the port listened — I don’t see anything listening to port 443.

I went over my configuration (default debian 7 w/ with LAMP server) and I have the following in my ports.conf file:

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default
# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
# README.Debian.gz

NameVirtualHost *:80
Listen 80


<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
     NameVirtualHost *:443
     Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    NameVirtualHost *:443
    Listen 443
</IfModule>

And in the sites-enabled I have a file called default-ssl containing (it’s quite long, i’ll just add the host data, not the entire ssl file options unless someone can think it could help)

<IfModule mod_ssl.c>
<VirtualHost _default_:443>
        ServerAdmin webmaster@localhost

        DocumentRoot /var/www
        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /var/www/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride All
#               Order allow,deny
#               allow from all
        </Directory>

        ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
        <Directory "/usr/lib/cgi-bin">
                AllowOverride None
                Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                Order allow,deny
                Allow from all
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/error.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

        #   SSL Engine Switch:
        #   Enable/Disable SSL for this virtual host.
        SSLEngine on


    #   A self-signed (snakeoil) certificate can be created by installing
    #   the ssl-cert package. See
    #   /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
    #   If both key and certificate are stored in the same file, only the
    #   SSLCertificateFile directive is needed.
    SSLCertificateFile    /etc/ssl/dev.webmark.co.il/dev_webmark_co_il.pem
    SSLCertificateKeyFile /etc/ssl/dev.webmark.co.il/dev.webmark.co.il.key

    #   Server Certificate Chain:
    #   Point SSLCertificateChainFile at a file containing the
    #   concatenation of PEM encoded CA certificates which form the
    #   certificate chain for the server certificate. Alternatively
    #   the referenced file can be the same as SSLCertificateFile
    #   when the CA certificates are directly appended to the server
    #   certificate for convinience.
    #SSLCertificateChainFile /etc/apache2/ssl.crt/server-ca.crt

    #   Certificate Authority (CA):
    #   Set the CA certificate verification path where to find CA
    #   certificates for client authentication or alternatively one
    #   huge file containing all of them (file must be PEM encoded)
    #   Note: Inside SSLCACertificatePath you need hash symlinks
    #         to point to the certificate files. Use the provided

So I apologize for the very long post, just thought this is relevant information.

I think the ports.conf file enables the listener on 443, but I don’t know why it doesn’t.

When I list the ports listening:

netstat -a | egrep 'Proto|LISTEN'

I get

Proto Recv-Q Send-Q Local Address           Foreign Address         State
tcp        0      0 10.0.0.10:mysql         *:*                     LISTEN
tcp        0      0 *:35563                 *:*                     LISTEN
tcp        0      0 *:sunrpc                *:*                     LISTEN
tcp        0      0 localhost:61619         *:*                     LISTEN
tcp        0      0 *:61620                 *:*                     LISTEN
tcp        0      0 *:ftp                   *:*                     LISTEN
tcp        0      0 *:ssh                   *:*                     LISTEN
tcp        0      0 10.0.0.10:8888          *:*                     LISTEN
tcp        0      0 localhost:smtp          *:*                     LISTEN
tcp        0      0 *:27017                 *:*                     LISTEN
tcp6       0      0 [::]:sunrpc             [::]:*                  LISTEN
tcp6       0      0 [::]:http               [::]:*                  LISTEN
tcp6       0      0 [::]:ssh                [::]:*                  LISTEN
tcp6       0      0 localhost:smtp          [::]:*                  LISTEN
tcp6       0      0 [::]:https              [::]:*                  LISTEN
tcp6       0      0 [::]:55644              [::]:*                  LISTEN
Proto RefCnt Flags       Type       State         I-Node   Path
unix  2      [ ACC ]     STREAM     LISTENING     7400     /tmp/mongodb-27017.so                                                                                        ck
unix  2      [ ACC ]     STREAM     LISTENING     7444     /var/run/dbus/system_                                                                                        bus_socket
unix  2      [ ACC ]     STREAM     LISTENING     7215     /var/run/rpcbind.sock
unix  2      [ ACC ]     SEQPACKET  LISTENING     3434     /run/udev/control
unix  2      [ ACC ]     STREAM     LISTENING     7351     /var/run/acpid.socket
unix  2      [ ACC ]     STREAM     LISTENING     7624     /var/run/mysqld/mysql                                                                                        

I’m pretty sure that the condition is true. I hope I gave all the relevant information and not too much of it.
Thanks for your time reading this.
Yan

Edit
in order to make sure mod_ssl is running — I used

apache2ctl -M

Which resulted with:

Loaded Modules:
 core_module (static)
 log_config_module (static)
 logio_module (static)
 version_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 alias_module (shared)
 auth_basic_module (shared)
 authn_file_module (shared)
 authz_default_module (shared)
 authz_groupfile_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 cgi_module (shared)
 deflate_module (shared)
 dir_module (shared)
 env_module (shared)
 headers_module (shared)
 mime_module (shared)
 ssl_module (shared)
 negotiation_module (shared)
 php5_module (shared)
 reqtimeout_module (shared)
 rewrite_module (shared)
 setenvif_module (shared)
 status_module (shared)
Syntax OK

/edit