Question

I’m trying to configure SSL on EC2onrails with no luck. At present I am unable to even telnet into my server at port 443, it simply says trying MY.IP.ADDRESS... and stays there indefinitely. Telnet into 80 works fine.

This was my starting point. I followed the instructions exactly, and because I have a go daddy cert I created this custom default-ssl file so I could add the SSLCertificateChainFile directive:

NameVirtualHost *:443
<VirtualHost *:443>

  Include /etc/apache2/sites-available/app.custom
  Include /etc/apache2/sites-available/app.common

  ErrorLog /mnt/log/apache2/error.log
  LogLevel warn

  CustomLog /mnt/log/apache2/access.log combined

  # see http://httpd.apache.org/docs/2.2/ssl/ssl_intro.html and http://httpd.apache.org/docs/2.2/mod/mod_ssl.html
  SSLEngine On
  SSLCertificateFile    /etc/ec2onrails/ssl/cert/ec2onrails-default.crt
  SSLCertificateKeyFile /etc/ec2onrails/ssl/private/ec2onrails-default.key
  SSLCertificateChainFile    /etc/ec2onrails/ssl/cert/ec2onrails-chain.crt 

  RequestHeader set X_FORWARDED_PROTO 'https'
  ServerName MY_SERVER_NAME
</VirtualHost>

Note that I had to add

      ServerName MY_SERVER_NAME

Or else I saw the following warning at apache startup in the error.log file:

[Wed May 27 19:46:20 2009] [warn] RSA server certificate CommonName (CN) ` MY_SERVER_NAME' does NOT match server name!?

I have run cap ec2onrails:server:enable_ssl, apache boots up cleanly, regular access over port 80 works, and apache access logs indicate no request activity to port 443. I know apache is loading my default-ssl config files because if I type gobbledygook in them it complains at startup.

Has anyone else successfully gotten SSL working with EC2onRails? What else can I do to debug this issue? Right now I am using ec2onRails version 0.9.9.1 which is based on a version of Ubuntu.

Answer 1

OK I figured it out. Amazon’s EC2 has it’s own firewall as part of its “security group” concept. This firewall was blocking port 443.