Problème avec mon SSL en ipv4

Help
1

Bonjour,
Je viens ici chercher de l'aide car je suis désespéré !

J'ai mis en place mon propre serveur web (avec un mini PC relié à ma freebox pour laquelle j'ai demandé une ipv4 full-stack et ai fait une redirection des ports 443 et 80 vers mon serveur) avec apache pour un site internet que j'ai créé. Tout fonctionne avec des appareils compatibles ipv6 mais lorsque des appareils se connectent en ipv4, les connexions avec SSL (https) ne passent pas et le site est inaccessible. Pourtant en http tout fonctionne, j'ai vérifié plusieurs fois et aussi avec mon fournisseur de nom de domaine la configuration de mon DNS et il ne semble pas que ce soit le problème. Je ne comprends pas, ça n'a aucun sens...

SSLLABS m'annonce un grade A pour l'ipV6 et un tiret pour l'ipV4 (donc rien...).

Si cela peut vous aider voici le nom de domaine: firstocks.com .

2

I also see Http requests for both IPv4 and IPv6 are fine. It is only HTTPS that fails for IPv4

Check the firewall and communications config in your hosting service for port 443 and make sure it is correct for both of those. Also check your Apache to make sure your port 443 is configured right similar to how you did your port 80

Check apache with

sudo apachectl -t -D DUMP_VHOSTS

Might need apache2ctl or httpd depending on your system

3 Likes
3

It's my own computer running ubuntu and I've disabled the firewall to make sure it works.
I ran this command: sudo apachectl -t -D DUMP_VHOSTS

and I get this:

*:80 is a NameVirtualHost
          port 80 namevhost firstocks.com (/etc/apache2/apache2.conf:275)
                  aka www.firstocks.com
*:443 is a NameVirtualHost
          port 443 namevhost firstocks.com (/etc/apache2/apache2.conf:350)
                  aka www.firstocks.com

This also seems to be the correct configuration...

Here is my setup:


<VirtualHost *:80>
     ServerName firstocks.com
     ServerAlias www.firstocks.com
     ProxyPreserveHost On
     ProxyPass / http://127.0.0.1:6081/
     ProxyPassReverse / http://127.0.0.1:6081/
# RewriteEngine on
# RewriteCond %{SERVER_NAME} =firstocks.com [OR]
# RewriteCond %{SERVER_NAME} =www.firstocks.com
# RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<IfModule mod_ssl.c>


     <VirtualHost *:443>
         ServerName firstocks.com
         ServerAlias www.firstocks.com
         ProxyPreserveHost On
         ProxyPass / http://127.0.0.1:6081/
         ProxyPassReverse / http://127.0.0.1:6081/
         Include /etc/letsencrypt/options-ssl-apache.conf
         SSLCertificateFile /etc/letsencrypt/live/firstocks.com/fullchain.pem
         SSLCertificateKeyFile /etc/letsencrypt/live/firstocks.com/privkey.pem
     </VirtualHost>

</IfModule>

I use varnish for the cache which explains the proxy and itself sends to port 3004 of my machine where a nextjs application (node backend) is running...

And here is my varnish configuration :

vcl 4.1;

backend firstocks {
    .host = "127.0.0.1";
    .port = "3004";
}


sub vcl_recv {
    if (req.http.host ~ "^(www\.)?(firstocks.com|firstocks.fr)$") {
        set req.backend_hint = firstocks;
    }

    # Ne pas mettre en cache les requêtes pour les chemins d'URL commençant par /api/
    if (req.url ~ "^/api/") {
        return (pass);
    }
    # Vous pouvez ajouter des règles de mise en cache personnalisées ici, si nécessaire.
}

sub vcl_backend_response {
    # Vous pouvez ajouter des règles de mise en cache personnalisées ici, si nécessaire.
}

sub vcl_deliver {
    # Vous pouvez ajouter des règles de mise en cache personnalisées ici, si nécessaire.
}
4

Do you have a router? Do you have to setup rules to forward port 443 for both IPv4 and IPv6?

This isn't really a Let's Encrypt problem. There is some sort of comms routing problem in your system. It looks fine except for IPv4 using HTTPS (port 443).

HTTPS w/IPv4 fails
curl -I4 https://firstocks.com
curl: (7) Failed to connect to firstocks.com port 443 after 3226 ms: No route to host

HTTPS w/IPv6 works
curl -I6 https://firstocks.com
HTTP/1.1 200 OK
Server: Apache/2.4.52 (Ubuntu)
X-Powered-By: Next.js
X-Varnish: 245 235

HTTP with both work 
curl -I4k http://firstocks.com
HTTP/1.1 200 OK
Server: Apache/2.4.52 (Ubuntu)
X-Powered-By: Next.js
X-Varnish: 131187 235

curl -I6k http://firstocks.com
HTTP/1.1 200 OK
Server: Apache/2.4.52 (Ubuntu)
X-Powered-By: Next.js
X-Varnish: 247 131188
5 Likes
5

The ipv6 is that of the machine so no redirection necessary, I have on the other hand set up a redirection of port 443 but I realize when I write this message that it does not point to the right local IP! Thank you so much for your help, I wasn't looking in the right place!

3 Likes
6

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.