How do I rewrite httpd-vhosts.conf to allow SSL connections to a private web-server? - macos

Question

I am running Apache 2.4.34 (Unix) on a mid-2012 Mac mini running Mac OS 10.14.6 and I'm using this machine as a personal web-server.
When I uncomment "#Include /private/etc/apache2/extra/httpd-vhosts.conf " in httpd.conf, my browser tells me that it can't connect to the server, i.e. my Mac mini, as neither "localhost" nor using the domain name "www.ocetacea.net".
I've followed
https://www.ssl.com/how-to/csr-generation-in-macos-keychain-access/
to install my SSL certificates and
https://www.ssl.com/how-to/ssl-tls-installation-macos-mojave/#apache
to modify httpd.conf and httpd-vhosts.conf.
My /private/etc/apache2/extra/httpd-vhosts.conf currently looks like:
<VirtualHost *:443>
DocumentRoot "/Library/WebServer/Documents"
ServerName ocetacea.net
SSLEngine on
SSLCertificateFile "/private/etc/apache2/ocetacea.crt"
SSLCertificateKeyFile "/private/etc/apache2/ocetacea.key"
SSLCertificateChainFile "/private/etc/apache2/ocetacea_bundle.crt"
</VirtualHost>
<VirtualHost *:80>
DocumentRoot "/Library/WebServer/Documents"
ServerName ocetacea.net
SSLEngine on
SSLCertificateFile "/private/etc/apache2/ocetacea.crt"
SSLCertificateKeyFile "/private/etc/apache2/ocetacea.key"
SSLCertificateChainFile "/private/etc/apache2/ocetacea_bundle.crt"
</VirtualHost>
sudo apachectl configtest
results in:
Syntax OK
and
sudo apachectl -k restart
appears to do what I want, i.e. start the server.
My concern is that I didn't install the SSL certificates correctly.
/private/etc/apache2/ocetacea.crt
begins with
-----BEGIN CERTIFICATE-----
and ends with
-----END CERTIFICATE-----
while
/private/etc/apache2/ocetacea.key
starts with:
-----BEGIN RSA PRIVATE KEY-----
and ends with
-----END RSA PRIVATE KEY-----
and
/private/etc/apache2/ocetacea_bundle.crt
begins with:
-----BEGIN RSA PRIVATE KEY-----
and ends with:
-----END RSA PRIVATE KEY-----
which is not what I would expect--I would expect one of these three files to start with something like
-----BEGIN RSA PUBLIC KEY-----
and end with
-----END RSA PUBLIC KEY----
But this is my first time trying to set up a secured server, so I really don't know.
Any help would be greatly appreciated.
My system.log reads:
The system log repeats the following:
Aug 14 18:40:55 jnorrisMM com.apple.xpc.launchd[1] (org.apache.httpd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug 14 18:41:06 jnorrisMM com.apple.xpc.launchd[1] (org.apache.httpd[18660]): Service exited with abnormal code: 1
Aug 14 18:41:06 jnorrisMM com.apple.xpc.launchd[1] (org.apache.httpd): Service only ran for 0 seconds. Pushing respawn out by 10 seconds.
Aug 14 18:41:16 jnorrisMM com.apple.xpc.launchd[1] (org.apache.httpd[18667]): Service exited with abnormal code: 1

Answer 1

If you uncommented this line "#Include /private/etc/apache2/extra/httpd-vhosts.conf" and your server worked on port 80 then you don't need 2nd VirtualHost conf for port 80 because it's already configured in some file. Also in you don't need to add SSL Engine ON and certificates.
After you clear this, you should focus on your certificates. You have 2 certs and 1 key (private) that matches 1 of your certs which is use to secure server.
This file /private/etc/apache2/ocetacea_bundle.crt is bundle and may contain more then 1 certificate inside of it not the keys.
Configuration seems fine, and you are almost there since Syntax is OK. Also make sure you open port 443 in your firewall before accessing it outside.
Best regards