Trying to switch to hiawatha proxy, fails

[chrisf]

IT IS DUE TO SSL BINDING / port 443.  Proof.  I deleted the conf file from hiawatha/conf/domains for the domain which has the ssl.  Hiawatha started perfectly.

Ran fixweb to recreate the domain with ssl.  Hiawatha FAILS!

SSH transcript:

Code: [Select]

[root@cc-server domains]# rm convictionshosting.com.conf
rm: remove regular file `convictionshosting.com.conf? y
[root@cc-server domains]# sh /script/restart-web
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
Stopping Hiawatha web server:                              [FAILED]
Starting Hiawatha web server:                              [  OK  ]
Stopping php-fpm:                                          [  OK  ]
Starting php-fpm:                                          [  OK  ]
[root@cc-server domains]# sh /script/restart-web
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
Stopping Hiawatha web server:                              [  OK  ]
Starting Hiawatha web server:                              [  OK  ]
Stopping php-fpm:                                          [  OK  ]
Starting php-fpm:                                          [  OK  ]
[root@cc-server domains]# sh /script/fixweb

- For help, type '/script/fixweb --help'
- No argument supplied. Defaulting to localhost (master) servers

Fixing Web server config
- 'defaults' pages at 'localhost'
- 'cc-server.us' ('admin') at 'localhost'
- '.htaccess' for 'cc-server.us' ('admin') at 'localhost'
- 'convictionshosting.com' ('admin') at 'localhost'
- '.htaccess' for 'convictionshosting.com' ('admin') at 'localhost'
[root@cc-server domains]# sh /script/restart-web
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
Stopping Hiawatha web server:                              [  OK  ]
Starting Hiawatha web server:                              [  OK  ]
listen(http(s)): Address already in use
Stopping php-fpm:                                          [  OK  ]
Starting php-fpm:                                          [  OK  ]
[root@cc-server domains]# sh /script/restart-web
Stopping httpd:                                            [  OK  ]
Starting httpd:                                            [  OK  ]
Stopping Hiawatha web server:                              [FAILED]
Starting Hiawatha web server:                              [  OK  ]
listen(http(s)): Address already in use
Stopping php-fpm:                                          [  OK  ]
Starting php-fpm:                                          [  OK  ]
[root@cc-server domains]#

Hiawatha fails with a domain with SSL.   It is through admin and IP (old way).

Please investigate and fix,

[MRatWork]

Using latest version of Kloxo-MR 6.5.1.b and ssl self-assign?.

[chrisf]

Yes, latest KloxoMR 6.5.1b.  The SSL is assigned through old way (admin ->IP->SSL) because it has been assigned for nearly half a year running Apache no proxy.

So there is a IP assigned to this domain as well.  I was reading on Hiawatha forums this error normally happens when using the 'interface' option under binding - but don't know for sure.

I just know that Hiawatha will not start.

[MRatWork]

Try not using .ca file if using self-assign (not ssl from thirdparty) in /home/kloxo/httpd/ssl.

[chrisf]

It is a rapidSSL and the intermediate file (ca) is required.  It could also be the additional IP - there are different reasons for that error to be displayed - BUT, they all are due to configuration errors.

Something is wrong.

[MRatWork]

Check your /home/hiawatha/tpl/domains.conf.tpl. In previous you will see 'if (file_exists("{$certname}.ca")) {' and also using '.pem' instead '.crt'.

[chrisf]

I switched back to pure Apache.   This is a live site, and customers use it.  I reported all of this because there is a obvious error in the Hiawatha configuration.

I don't know if it is due to the additional IP or the ssl, but I am sure it's wrong.

[chrisf]

Have you found the cause of this error ?

[MRatWork]

Because I didn't have thirdparty ssl certificate, I don't know what's happen for your ssl.

If you permit, send to my PM your thirdparty ssl certificate.

[GentZu]

try

yum remove hiawatha -y
yum install hiawatha -y
service restart hiawatha

[MRatWork]

try

yum remove hiawatha -y
yum install hiawatha -y
service restart hiawatha

If you try this commands, '/etc/hiawatha/hiawatha.conf' file is from hiawatha.rpm ('generic' hiawatha.conf). Kloxo-MR use 'special' hiawatha and taken from '/home/hiawatha/etc/conf/hiawatha.conf'.

As we know, other services (like apache, nginx, lighttpd and others) also using 'special' config.

[chrisf]

I am not sure this is related to the CA file.  I think it has to do with additional IP and ssl.  I am not sure.  I can not get Hiawatha to start.  I have no idea why the configuration is wrong.

Sorry, I can not give you a copy of my ssl.

This actually is a serious problem.  Add a ssl and IP to Hiawatha and it stops working.

[MRatWork]

Try update Kloxo-MR and then run 'sh /script/cleanup'.

I am not sure, but try install polarssl with 'yum install polarssl'.

[chrisf]

running latest 6.5.1b, installed polarssl, same error.

Code: [Select]

listen(http(s)): Address already in use

In Hiawatha forums this error is due to incorrect binding.  I use an additional IP with this site, could that be a problem.

I changed all my servers to Hiawatha proxy, if a customer wants ssl, is everything going to break?

This is a critical bug in the configuration of Hiawatha.

[chrisf]

Found the problem.  It is not because of the SSL, it is because of the IP set for that domain.

From Creator of Hiawatha:

Hugo Leisink

When not specifying an interface in a Binding block, Hiawatha will bind all available interfaces. When a second block has the interface option, that interface is already binded by the previous binding block. To solve this, specify an interface in the first binding block.

In Hiawatha defaults init.conf you don't use the interface option, you bind Hiawatha to all IP's.  In my website, I added exclusive IP, and you use interface option in binding it.  But, it is already bound to first init.conf binding id port_443.

You have to list all available ip's in the init.conf, using interface option.

This is a critical bug in KloxoMR and adding any exclusive IP to a website will break Hiawatha.

Please fix.  Thank you.