在运行Tomcat的EC2实例上终止HTTPS
问题描述:
我试图在使用Elastic Beanstalk部署的AWS EC2实例上启用HTTPS。执行此操作的文档要求您在应用程序的根目录中的目录.ebextensions/https-instance.config
中添加this snippet。我必须分别用我的证书和密钥替换certificate file contents
和private key contents
。我最初接受的格式不正确的错误,所以我转换他们以JSON和提供的片段重新上传它 -在运行Tomcat的EC2实例上终止HTTPS
{
"files": {
"/etc/httpd/conf.d/ssl.conf": {
"owner": "root",
"content": "LoadModule ssl_module modules/mod_ssl.so\nListen 443\n<VirtualHost *:443>\n <Proxy *>\n Order deny,allow\n Allow from all\n </Proxy>\n\n SSLEngine on\n SSLCertificateFile \"/etc/pki/tls/certs/server.crt\"\n SSLCertificateKeyFile \"/etc/pki/tls/certs/server.key\"\n SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH\n SSLProtocol All -SSLv2 -SSLv3\n SSLHonorCipherOrder On\n \n Header always set Strict-Transport-Security \"max-age=63072000; includeSubdomains; preload\"\n Header always set X-Frame-Options DENY\n Header always set X-Content-Type-Options nosniff\n \n ProxyPass/http://localhost:8080/ retry=0\n ProxyPassReverse/http://localhost:8080/\n ProxyPreserveHost on\n \n</VirtualHost>\n",
"group": "root",
"mode": "000644"
},
"/etc/pki/tls/certs/server.crt": {
"owner": "root",
"content": "-----BEGIN CERTIFICATE-----\ncertificate file contents\n-----END CERTIFICATE-----\n",
"group": "root",
"mode": "000400"
},
"/etc/pki/tls/certs/server.key": {
"owner": "root",
"content": "-----BEGIN RSA PRIVATE KEY-----\nprivate key contents # See note below.\n-----END RSA PRIVATE KEY-----\n",
"group": "root",
"mode": "000400"
}
},
"container_commands": {
"killhttpd": {
"command": "killall httpd"
},
"waitforhttpddeath": {
"command": "sleep 3"
}
},
"packages": {
"yum": {
"mod_ssl": []
}
}
}
部署与错误中止 -
[Instance: i-0x012x0123x012xyz] Command failed on instance. Return code: 1 Output: httpd: no process found. container_command killhttpd in my-app-name/.ebextensions/https-instance.config failed. For more detail, check /var/log/eb-activity.log using console or EB CLI.
我可以告诉大家,错误的是是由于container_commands
键造成的,因此在配置后会停止httpd
,以致于可以使用新的https.conf
和证书。它告诉我,它试图杀死httpd
,但它找不到任何此类进程正在运行。 service httpd status
显示httpd.worker (pid 0123) is running
,我也可以在线访问我的应用程序。 /var/log/eb-activity.log
也没有任何记录。
我见过其他一些人在网上发布相同的问题,但我找不到任何解决方案。有什么我在这里做错了吗?
答
您ebextensions
正试图执行killall httpd
,但您的过程被称为httpd.worker
。
将ebextensions
中的行更改为killall httpd.worker
。
由于您使用Elastic Beanstalk,因此您不仅仅是在ELB级别终止SSL? – birryree
@birryree我是,但我想终止它一直到EC2实例。 –
在这种情况下,问题可能是'ebextensions'尝试执行'killall httpd',但是你的过程被称为'httpd.worker'。如果你用'killall httpd.worker'替换'killall httpd',会发生什么? – birryree