147 lines
4.4 KiB
Plaintext
147 lines
4.4 KiB
Plaintext
|
====== Apache 2 : proxy-reverse : configurer un site en https pour un sous-domaine ======
|
|||
|
|
|
|||
|
|
Voici mes prises de notes pour configurer un site Internet **http**. Le configuration est destinée pour un site Internet commençant par **www**.
|
|||
|
|
|
|||
|
|
<code>
|
|||
|
|
Configurer Apache 2
|
|||
|
|
http://www.abonnel.fr ==> https://www.abonnel.fr <==[reverse-proxy]==> 54.1.23.4
|
|||
|
|
</code>
|
|||
|
|
|
|||
|
|
|
|||
|
|
===== Pré requis =====
|
|||
|
|
|
|||
|
|
Je viens de demander un [[ssl-let-s_encrypt-certbot-auto|certificat SSL]] pour le site Internet. Il faut configurer Apache 2 pour que :
|
|||
|
|
* les demandes en https utilisent le certificat SSL
|
|||
|
|
* toutes les visites en http soit redirigé en https
|
|||
|
|
|
|||
|
|
====== Configurer ======
|
|||
|
|
|
|||
|
|
|
|||
|
|
Je complète le fichier de configuration ''/etc/apache2/sites-available/100-com.perdu.extra.conf''. J'ajoute un bloc de redirection vers ''https'' :
|
|||
|
|
|
|||
|
|
<code>
|
|||
|
|
RewriteEngine On
|
|||
|
|
RewriteCond %{SERVER_NAME} =extra.perdu.com
|
|||
|
|
RewriteCond %{REQUEST_URI} !\.well-known/acme-challenge/.*
|
|||
|
|
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
|
|||
|
|
</code>
|
|||
|
|
|
|||
|
|
Puis, j'ajoute un bloc pour la configuration SSL / https. Il s'agit d'un copier/coller de la configuration http.
|
|||
|
|
J'effectue quelques modifications :
|
|||
|
|
* [[linux:solutions_linux:configurer_un_site_web_apache_2:ErrorLog]] et [[linux:solutions_linux:configurer_un_site_web_apache_2:CustomLog]] pour l’écriture des fichiers logs
|
|||
|
|
* [[linux:solutions_linux:configurer_un_site_web_apache_2:RewriteRule]] pour la redirection des URL sans www
|
|||
|
|
* Ajout des options SSL
|
|||
|
|
* Ajout de la gestion des certificats
|
|||
|
|
|
|||
|
|
<code>
|
|||
|
|
<IfModule mod_ssl.c>
|
|||
|
|
<VirtualHost *:443>
|
|||
|
|
|
|||
|
|
ServerName extra.perdu.com
|
|||
|
|
|
|||
|
|
ProxyPreserveHost On
|
|||
|
|
ProxyPass "/" "http://103.224.182.253/"
|
|||
|
|
ProxyPassReverse "/" "http://103.224.182.253/"
|
|||
|
|
|
|||
|
|
Include /etc/letsencrypt/options-ssl-apache.conf
|
|||
|
|
SSLCertificateFile /etc/letsencrypt/live/extra.perdu.com/fullchain.pem
|
|||
|
|
SSLCertificateKeyFile /etc/letsencrypt/live/extra.perdu.com/privkey.pem
|
|||
|
|
|
|||
|
|
</VirtualHost>
|
|||
|
|
</IfModule>
|
|||
|
|
|
|||
|
|
|
|||
|
|
</code>
|
|||
|
|
|
|||
|
|
Les options SSL sont à créer une seule fois sur le serveur. Ces options sont communes à tous les sites Internet que je configure.
|
|||
|
|
Les options dans ''/etc/letsencrypt/options-ssl-apache.conf'' sont les suivantes :
|
|||
|
|
<code>
|
|||
|
|
SSLEngine on
|
|||
|
|
|
|||
|
|
# intermediate configuration, tweak to your needs
|
|||
|
|
SSLProtocol -ALL +TLSv1.2
|
|||
|
|
SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:!RC4:HIGH:!MD5:!aNULL:!EDH
|
|||
|
|
|
|||
|
|
SSLHonorCipherOrder on
|
|||
|
|
|
|||
|
|
SSLCompression on
|
|||
|
|
#SSLSessionTickets off
|
|||
|
|
|
|||
|
|
# -- Securité supplémentaire
|
|||
|
|
|
|||
|
|
SSLOptions +StrictRequire
|
|||
|
|
|
|||
|
|
# HSTS (mod_headers is required) (15768000 seconds = 6 months)
|
|||
|
|
Header always set Strict-Transport-Security "max-age=15768000"
|
|||
|
|
|
|||
|
|
# Always ensure Cookies have "Secure" set (JAH 2012/1)
|
|||
|
|
Header edit Set-Cookie (?i)^(.*)(;\s*secure)??((\s*;)?(.*)) "$1; Secure$3$4"
|
|||
|
|
</code>
|
|||
|
|
|
|||
|
|
|
|||
|
|
----
|
|||
|
|
|
|||
|
|
|
|||
|
|
Ce qui donne une configuration globale suivante :
|
|||
|
|
|
|||
|
|
<code>
|
|||
|
|
<VirtualHost *:80>
|
|||
|
|
|
|||
|
|
ServerName extra.perdu.com
|
|||
|
|
|
|||
|
|
# ProxyPass devient obsolète avec RewriteRule
|
|||
|
|
ProxyPass /.well-known/acme-challenge !
|
|||
|
|
Alias /.well-known/acme-challenge /var/www/html/.well-known/acme-challenge
|
|||
|
|
|
|||
|
|
<Directory "/var/www/html/.well-known/acme-challenge">
|
|||
|
|
Options None
|
|||
|
|
AllowOverride None
|
|||
|
|
Require all granted
|
|||
|
|
AddDefaultCharset off
|
|||
|
|
</Directory>
|
|||
|
|
|
|||
|
|
# Proxy* deviennent obsolète avec Rewrite*
|
|||
|
|
ProxyPreserveHost On
|
|||
|
|
ProxyPass "/" "http://103.224.182.253/"
|
|||
|
|
ProxyPassReverse "/" "http://103.224.182.253/"
|
|||
|
|
|
|||
|
|
RewriteEngine On
|
|||
|
|
RewriteCond %{SERVER_NAME} =info.mindcast.fr
|
|||
|
|
RewriteCond %{REQUEST_URI} !\.well-known/acme-challenge/.*
|
|||
|
|
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
|
|||
|
|
|
|||
|
|
</VirtualHost>
|
|||
|
|
|
|||
|
|
<IfModule mod_ssl.c>
|
|||
|
|
<VirtualHost *:443>
|
|||
|
|
|
|||
|
|
ServerName extra.perdu.com
|
|||
|
|
|
|||
|
|
ProxyPreserveHost On
|
|||
|
|
ProxyPass "/" "http://103.224.182.253/"
|
|||
|
|
ProxyPassReverse "/" "http://103.224.182.253/"
|
|||
|
|
|
|||
|
|
Include /etc/letsencrypt/options-ssl-apache.conf
|
|||
|
|
SSLCertificateFile /etc/letsencrypt/live/extra.perdu.com/fullchain.pem
|
|||
|
|
SSLCertificateKeyFile /etc/letsencrypt/live/extra.perdu.com/privkey.pem
|
|||
|
|
|
|||
|
|
</VirtualHost>
|
|||
|
|
</IfModule>
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
</code>
|
|||
|
|
|
|||
|
|
|
|||
|
|
====== Recharger ======
|
|||
|
|
|
|||
|
|
Après ces modifications, je recharge la configuration de Apache 2 :
|
|||
|
|
<code>
|
|||
|
|
sudo service apache2 reload
|
|||
|
|
</code>
|
|||
|
|
|
|||
|
|
====== Liens ======
|
|||
|
|
|
|||
|
|
https://stackoverflow.com/questions/20406845/proxy-error-502-the-proxy-server-received-an-invalid-response-from-an-upstream
|
|||
|
|
|