Summary
I cannot manage the SSL configuration with LE certificate on a newly installed MM 5.31.4 server on Ubuntu 20.04 and Apache.
Expected behavior
MM should be accessible via https.
2-3 years ago I successfully installed another 5.3 MM server with a LE certificate. Thus I have a correct Apache conf configuration for comparison.
Observed behavior
Browser always says “timeout” after a longer period.
Apache modules installed
alias_module (shared)
auth_basic_module (shared)
authn_core_module (shared)
authn_file_module (shared)
authz_core_module (shared)
authz_host_module (shared)
authz_user_module (shared)
autoindex_module (shared)
core_module (static)
deflate_module (shared)
dir_module (shared)
env_module (shared)
filter_module (shared)
http_module (static)
log_config_module (static)
logio_module (static)
mime_module (shared)
mpm_prefork_module (shared)
negotiation_module (shared)
php7_module (shared)
proxy_http_module (shared)
proxy_module (shared)
proxy_wstunnel_module (shared)
reqtimeout_module (shared)
rewrite_module (shared)
setenvif_module (shared)
so_module (static)
status_module (shared)
unixd_module (static)
version_module (static)
watchdog_module (static)
Apaches mm-ssl.conf
<IfModule ssl_module>
<VirtualHost *:80>
ServerName gwmm1.vss.xyz.com
ServerAdmin hostmaster@mydomain.com
RewriteEngine on
RewriteCond %{SERVER_NAME} =gwmm1.vss.xyz.com
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,QSA,R=permanent]
</VirtualHost>
<VirtualHost *:443>
ServerName gwmm1.vss.xyz.com
ServerAdmin hostmaster@mydomain.com
ProxyPreserveHost On
DocumentRoot /opt/mattermost
# Setup the proxy
<Proxy *>
Order allow,deny
Allow from all
</Proxy>
# Set web sockets
RewriteEngine On
RewriteCond %{REQUEST_URI} /api/v[0-9]+/(users/)?websocket [NC,OR]
RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC,OR]
RewriteCond %{HTTP:CONNECTION} ^Upgrade$ [NC]
RewriteRule .* ws://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
RewriteRule .* http://127.0.0.1:8065%{REQUEST_URI} [P,QSA,L]
<LocationMatch "^/api/v(?<apiversion>[0-9]+)/(?<apiusers>users/)?websocket">
Require all granted
ProxyPass ws://127.0.0.1:8065/api/v%{env:MATCH_APIVERSION}/%{env:MATCH_APIUSERS}websocket
ProxyPassReverse ws://127.0.0.1:8065/api/v%{env:MATCH_APIVERSION}/%{env:MATCH_APIUSERS}websocket
ProxyPassReverseCookieDomain 127.0.0.1 gwmm1.vss.xyz.com
</LocationMatch>
<Location />
Require all granted
ProxyPass http://127.0.0.1:8065/
ProxyPassReverse http://127.0.0.1:8065/
ProxyPassReverseCookieDomain 127.0.0.1 gwmm1.vss.xyz.com
</Location>
# Generated by Certbot
SSLCertificateFile /etc/letsencrypt/live/gwmm1.vss.xyz.com/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/gwmm1.vss.xyz.com/privkey.pem
# SSLCertificateFile /etc/ssl/certs/ssl-cert-snakeoil.pem
# SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
# HSTS (mod_headers is required) (15768000 seconds = 6 months)
# (Browser never connects in next 6 months to http://, always https://)
Header always set Strict-Transport-Security "max-age=15768000 ; includeSubDomains"
</VirtualHost>
SSLHonorCipherOrder on
SSLCompression off
SSLSessionTickets off
# OCSP Stapling, only in httpd 2.3.3 and later
SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLStaplingCache shmcb:/var/run/ocsp(128000)
</IfModule>
The example config on Configuring Apache2 with SSL and HTTP/2 (Unofficial) — Mattermost 5.35 documentation also ends with timeout and I would rather have the configs from /etc/letsencrypt/options-ssl-apache.conf (or similar) in my own conf file.
Can anyone see my mistake?
– see my list above.