Trying to Learn + Test SSL Setup

[Neuner]

I've been wanting to take the next step and learn how to setup SSL for a Wordpress website but have hit a roadblock.
Using XAMPP Control Panel v3.3.0
I have a Wordpress website fully functional under port 80 and http://website-example.org

What I've done;

- Used Certifytheweb and Let's Encrypt to obtain a Certificate and Key.
- Placed the certificate in C:\xampp\apache\conf\ssl.crt\certificate.crt
- Placed the key in C:\xampp\apache\conf\ssl.crt\private.key
- Enabled Port 443 on Windows and Router
- For httpd.conf;

* made sure no # in front of LoadModule ssl_module modules/mod_ssl.so
* made sure no # in front of Include conf/extra/httpd-ssl.conf
- For httpd-ssl.conf

* DocumentRoot "C:/xampp/htdocs"
* ServerName localhost:443 (also tried website-example.org with no difference)
* SSLCertifcateFile "conf/ssl.crt/certifcated.crt"
* SSLCertificateKeyFile "conf/ssl.key/private.key"

I then restarted Apache, retried the website as https://website-example.org and it didn't give me an error but instead it displays the XAMPP Apache + MariaDB + PHP + Perl Welcome screen. It also does the same for http: It never displays the website.

What am I doing wrong?

[Nobbie]

You need to configure a VirtualHost for website-example.org on Port 443.

How did you configure http://website-example.org?? I cannot access it. And where is your WordPress Installation stored (which folder)?

It also does the same for http: It never displays the website.

??

And what is meant with "I have a Wordpress website fully functional under port 80 and http://website-example.org"?

[Neuner]

And what is meant with "I have a Wordpress website fully functional under port 80 and http://website-example.org"?

I have a wordpress website up and running but I'm not posting the real website address. It's why I've included the faux website-example.org.

[Nobbie]

What is the idea of keeping the URL of your site secret?
And it does not explain that you have "a fully functional" website but also "it never displays the website" (for http: and https:).

I cannot help any further with masked data and values, in most cases the reason for the problem is masked or hidden as well. Good luck.

[Altrea]

Hi,

Just to notice:

Scope of support

Evaluate if your topic is in scope of support of our board. We don't want to provide...
[...]

• ...support for live, production or public accessible environments.
  XAMPP is not configurated for such environments (default passwords, many activated and probably unnecessary modules, not tweaked for performance, scalability, stability or security). This board does have several entrys about hacked XAMPP installations because of using unprotected XAMPP installations in not supported environments. XAMPP don't want to fit every possible use case and there are other (also free) alternatives for such environments.

[...]
Source: [INFO] How to not fail getting help here (Linked as "Forum rules")

[Neuner]

Thank you Altrea. I only have it live to test it out. This is for my learning only and the reason why I'm not posting the actual website. I don't know why Nobbie keeps asking for the actual website address as that doesn't matter.

If this forum does not have the knowledge to assist then please let me know.

[Nobbie]

I don't know why Nobbie keeps asking for the actual website address as that doesn't matter.

You should know, as i told you. I will repeat it for you: masked data usually masks and hides the reason for the issue also. Dont you get that?

If this forum does not have the knowledge to assist then please let me know.

If you are here to troll, please let us know. I definately have the knowledge to solve your problem, but its all a question of giving a good explanation including the full configuration. You are far from that.

I asked you about VirtualHosts, you still lack any answer. Dont you have basic knowledge about Apache? Let us know.

[Neuner]

On every other forum I've been a part of, they did not need to know the website address. It's also a security protocol to not divulge it as the forum is open to the general public and mine is not public. I only have it up and running as a test procedure to confirm it is operating correctly. Under http://, port 80, it has been working correctly.

In httpd-vhosts.conf I added the following;

Code: Select all

<VirtualHost website-example.org:443>
   DocumentRoot "C:/xampp/htdocs/website-example"
   ServerName website-example.org
   SSLEngine On
   SSLCertificateFile "C:/xampp/apache/conf/ssl.crt/certificate.crt"
   SSLCertificateKeyFile "C:/xampp/apache/conf/ssl.key/private.key"
   <Directory "C:/xampp/htdocs/website-example">
   Order allow,deny
   Allow from all
   </Directory>
</VirtualHost>

I then restarted Apache and received the following error;

1:12:24 PM [Apache] Error: Apache shutdown unexpectedly.
1:12:24 PM [Apache] This may be due to a blocked port, missing dependencies,
1:12:24 PM [Apache] improper privileges, a crash, or a shutdown by another method.
1:12:24 PM [Apache] Press the Logs button to view error logs and check
1:12:24 PM [Apache] the Windows Event Viewer for more clues
1:12:24 PM [Apache] If you need more help, copy and post this
1:12:24 PM [Apache] entire log window on the forums

Before I tried SSL for my site, XAMPP Control Panel showed Port(s) 80,443 for the Apache Module.

I had opened 443 under Windows and my Router but will double check.

[Nobbie]

<VirtualHost website-example.org:443>

This looks already very suspicous (probably wrong!), but due to the fact that you are masking the real URL, its once again exactly the main problem as i mentioned: due to the masking you are masking the error as well!

In a VirtualHost definition you should not (or MUST NOT) apply a domain name (as this probably points to the wrong IP), instead apply either the LAN IP or (even better) simply apply an asterisk. The IP of website-example is probably NOT a local IP of your Xampp PC and is not in the scope of your Apache. You should instead use this VirtualHost:

Code: Select all

<VirtualHost *:443>

The Domain of the VirtualHost is defined by the "ServerName" and NOT(!) by the name in the VirtualHost Definition.

But we still are missing a VirtualHost for Port 80 (http:)?!

[Neuner]

Code: Select all

<VirtualHost *:443>

The Domain of the VirtualHost is defined by the "ServerName" and NOT(!) by the name in the VirtualHost Definition.

But we still are missing a VirtualHost for Port 80 (http:)?!

I made the change to *:443 but I still get the same error and Apache won't start.

my VirtualHost for Port 80 which works is as follows;

Code: Select all

<VirtualHost *:80>
  DocumentRoot "c:/xampp/htdocs/website-example"
  ServerName website-example.org
</VirtualHost>


[Nobbie]

I made the change to *:443 but I still get the same error and Apache won't start.

Which error? You did not apply any error message before, instead you told that Apache started but delivered the Xampp page instead of yours. Your explanation is still very poor.

Look into the error log. What does it say?

[Nobbie]

On every other forum I've been a part of, they did not need to know the website address.

Ok, why dont you proceed to "every other forum" if they can help you better? Good luck!

[Neuner]

Ok, why dont you proceed to "every other forum" if they can help you better? Good luck!

Your demand of needing to know the actual website address has been the mark of a phishing or hacking attack. Majority of forum assist types won't even allow you to post an actual site. When I was seeking help in the beginning, no one requested or needed that info to assist so this is very suspicious.

16. May 2024 19:20 post has the error listed.

[Altrea]

Your demand of needing to know the actual website address has been the mark of a phishing or hacking attack.

The internet is full of port scanners. No need for a public placed domain name on a community forum to get harmed.
In fact it is much much more dangerous to have a badly configured xampp server public accessible in the internet with a not known Domain and IP, than a properly secured webserver with publicly known domain and ip.

Majority of forum assist types won't even allow you to post an actual site. When I was seeking help in the beginning, no one requested or needed that info to assist so this is very suspicious.

A helper might ask and need specific information that is only clear after a few posts. Nothing suspicious here. But if you already don't trust a community support forum, than i do not see how we can really help you efficiently. You do have a problem with your virtualhost configuration. But without knowing what exactly you configured, how should we continue?

16. May 2024 19:20 post has the error listed.

No you did not. This messages are generous XAMPP control panel messages. We need the full Apache messages.
Nobbie already asked you to look into your Apache error.log. Another way is to execute the apache_start.bat script to get a command line output of the current log messages.

[Nobbie]

Your demand of needing to know the actual website address has been the mark of a phishing or hacking attack.

Bla bla bla .... thats soo dumb. If your website is so unsafe that you fear hacking attack, you should not put it online. Its that easy.

Of course its your decision not to answer any questions, therefore good luck. I am out.