httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
Subject Re: [users@httpd] HSTS verification
Date Sat, 03 Jul 2021 09:20:08 GMT

On 02.07.21 09:27, @lbutlr wrote:
> When checking for https HSTS compliance on I get a warning 
>> We cannot connect to using TLS ("Get http:
server gave HTTP response to HTTPS client").

What is in your access logs, can you identify the request and check which virtual hosts served
it? You can enable logging of the
virtual host in the access log or log to dedicated files (see
a list of what is available).

> And I do not understand how this can be. The page in questions loads as https with a
valid cert and the http query is set to redirect to https
> <VirtualHost>
>    ServerName
>    ServerAlias
>    ServerAlias
>    DocumentRoot /usr/local/www/example/
>    DirectoryIndex index.html
>    ProxyPassMatch ^/(.*\.php)$ fcgi://$1
>    SSLEngine on
>    SSLCertificateFile /usr/local/etc/dehydrated/certs/
>    SSLCertificateKeyFile /usr/local/etc/dehydrated/certs/
>    SSLCertificateChainFile /usr/local/etc/dehydrated/certs/
>    SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
>    SSLHonorCipherOrder on
>    #SSLUseStapling On
>    Header always set Strict-Transport-Security "max-age=15638400; includeSubdomains;"
>    Header always set X-Frame-Options DENY
>    Alias /.well-known/ /usr/local/www/.well-known/
> </VirtualHost>
> <VirtualHost *:80>
>    ServerName
>    ServerAlias foo,
>    ServerAlias
>    ServerAlias
>    Redirect /
>    Alias /.well-known/ /usr/local/www/.well-known/
> </VirtualHost>

I do not see anything onbviously wrong here (there is a typo on "ServerAlias foo,"
though, assume this is just an example issue).
However, your TLS virtualhost is bound to a fixed IP, your plain HTTP virtual host is bound
to all available IPs on the machine.

My guess would be virtual host mismatch or a DNS specific issue (does resolve
to different IPs for different resolvers?). Again
access logs may reveal some more information on that.


To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message