Topic: HTTPS connection attempts time out

[AlanH]

Running Apache 2.4 on W2016 server. I installed OpenSSL, generated the CSR, got a certificate from RapidSSLOnline. Installed it on Apache using information from https://www.phildev.net/ssl/, https://tud.at/programm/apache-ssl-win32-howto.php3, as well as info on this site. Apache starts up with no errors, and my site is available via port 80, but HTTPS connection attempts fail with timeout or “unable to connect” errors.

I set the log level to debug, restarted Apache, and confirmed there are no obvious errors in the log from any module, the ssl messages are shown below.

I never see an entry in either the error log or the access log for the attempted HTTPS connection. I double checked firewall settings and both 80 & 443 are open.

I ran wireshark, and I do see activity on port 443, but what seems odd is that there’s a noticeable delay – maybe 5 seconds – after I attempt the https connection before wireshark shows any activity. I’m not sufficiently familiar with what I should be seeing in wireshark to know whether the packets are normal or not, but the fact that port 443 traffic is coming in seems to prove the firewall settings are correct.

I’ve only been working with Apache for a couple of months, so I’m still a novice, and this is my first attempt with SLL & certificates, so I may have done something monumentally stupid. Any suggestions for how to track down this problem would be greatly appreciated!

Excerpt from error.log

[mraddi]

Hello Alan,

do you have checked the local firewall-settings on your W2016-server so that connections to tcp-port 443 are allowed?
The log-lines provided look good (from my point of view) - no errors or warnings.

What exactly do you mean by "...before wireshark shows any activity"? What activity can be seen there? Only SYN-packets or a complete SYN-(SYN-ACK)-ACK-handshake followed by the packets for establishing a SSL-connection?
And where is the "noticable delay - maybe 5 seconds"? Between hitting enter in the browser's address bar and the first SYN-packet or between somewhere later after the SYN-(SYN-ACK)-ACK-handshake?

Best regards
Matthias

[AlanH]

[mraddi]

Hello,

you have used Wireshark (I guess you have doublechecked to listen to the correct network-interface) on the W2016-server that is running Apache and didn't see any packets from/to the other workstation running the browser?
If yes, that sounds strange. Please ensure that the packets are leaving the other computer running the browser and see if you see some odds there. You can also do a test using telnet to the W2016-server's port 443 to see if the problem is within the network (or the client's network stack) or the browser.
What is the result if you try to open https://localhost on the W2016-server's browser? Result should be an certificate-error.

Depending on your network there are many reasons - some of them are a firewall between the server and the client, some faulty routing or a misconfired pac-file for browser-configuration (as seen sometimes in the company I work for). Another idea is an anti-virus-package on the client-machine that prevents it from talking to its neighbours.

Best regards
Matthias

[AlanH]

[mraddi]

Good to hear that at the apache is working as expected . You are right - the certificate-error occured because localhost is (usually) not within the certificate's SAN (subject alternate name).

As you said that packets are coming in on port 443 (as seen with Wireshark on the W2016-server) - but not from you client - you now can focus on the next step "are these packets leaving my client?".

The registrar is (according to my knowledge) not the reason for anything being blocked as it only provides the link between name and ip-address.

[AlanH]