WHMCS SSL redirect loop

[fossxplorer]

Is anyone using WHMCS with Kloxo-MR?
I've been using 5 hours to find out why i get redirect loop to it's SSL pages. Worked just fine with cPanel, but after moving it won't.

EDIT: It looks like an issue related to Hiawatha/proxy as it works fine using Apache only. I'd very much like to use Hiawatha for it's security features.

Any idea Mustafa?

[chrisf]

Try using straight Apache, not a proxy.  If this works, we will go from there.

[MRatWork]

Yes, better try other options (like chrisf say) because we want to know the side in trouble.

[fossxplorer]

Uff, had to get a few hours sleep after a sleepless night.
Yes, it works fine with Apache alone . Testing with Nginx proxy now.

[fossxplorer]

I can confirm it isn't working with Nginx proxy neither
And IT WORKS with Apache as a standalone web server.

EDIT: i'm in contact with WHMCS support to check whether such a setup is supported which i assume should be.

[MRatWork]

Using Kloxo-MR 6.5.0 or 6.5.1. Asking about it because different call certificate file. Call .crt file in 6.5.0 and call .pem file in 6.5.1.

[fossxplorer]

I only use 6.5.1.
I also discovered that .pem file for Hiawatha wasn't set up correctly. Hiawatha needs everything inside one file: private key, public key, intermediate , CA root.
I fixed this manually and checked again with SSL cert checkers on web.

[MRatWork]

What you mean 'fixed this manually'?. How?.

[Kloxo-DR]

Hello Mustafa,

What you mean 'fixed this manually'?. How?.

Listen, everybody has to go through fixing manually.

To avoid that, I have written a cron for every five minutes to do the following:

cp /etc/webmin/miniserv.pem /var/qmail/control/servercert.pem
chown root:qmail /var/qmail/control/servercert.pem
chmod 0644 /var/qmail/control/servercert.pem

This helps me to not to fix things manually. Its been a long time I have stopped reporting such things after I found your attitudes to development to be very restrictive.

I have suggested so many times that you should make every area of Kloxo-MR using SSL to work really proper. For this, a proper management is required.

Servercert.pem in /var/qmail/control/servercert.pem is one of the problem.

[chrisf]

THIS HAS NOTHING TO DO WITH SSL CERTIFICATES!

I am so tired of the negativity of this forums members, why not leave!  If you are so unhappy, why keep using KloxoMR?   Go back to kloxo official!

This redirect happens because php is served through Apache, under proxy Apache doesn't know you are using https, since the proxy serves the pages.  The $_SERVER['HTTPS'] is never set by Apache, therefore any program checking this will forever loop.  This is NOT a KloxoMR bug, but how proxied Apache works.

This is why I had you test pure Apache.

Now, to the fix, what proxy are you using?  With a few tricks we will get php recognizing https.

If nginx proxy is what you are using, simply follow my instructions here:
http://forum.mratwork.com/kloxo-mr-tips-and-tricks/php-force-redirect-ssl-nginxproxy-endless-loop/

All will work well!

[Kloxo-DR]

THIS HAS NOTHING TO DO WITH SSL CERTIFICATES!
I am so tired of the negativity of this forums members, why not leave!  If you are so unhappy, why keep using KloxoMR?   Go back to kloxo official!

I never said anywhere in the messages above that "my complain regarding SSL" has anything to do with the problem reported by Mella.

Nor Mella has anywhere directly mentioned that it could be regarding SSL.

It is your "arrogant mentality to boss around and feel that you kow the best"  that lets you see the world how you see it.

You are the guy hanging around here to make your own profit using a free panel. We are not doing that way. We are working hard to suppiort non-profit organizations. Kloxo and Kloxo-Mr are both fine for non-profits.

You should leave and pay for a panel and leave all users of non-profits in peace.

I do think, and shall not change my mind if you bark any further, that Mustafa has made dramatic mistakes in the developments.

Mustafa may contradict to my statements. You may not. You may not bark on other users on any negative expressions.

The non-profit I was supporting has already decided not to use Kloxo-MR any more because of many real and severe problems.

So either keep your mouth shut or just take a distance on my messages and exchanges with Mustafa. After all, Mustafa knows that I do not hate him or his work. The opposite, he knows, or should have known that I like his work and thats the reason why I support other users of his work.

You should look for a different forum to bark and express your arrogance.

I did not receive a lot of help from any one here, not from you, not from Mustafa or anyone.

I am here to help people of Mustafa's community and I do not need to leave.

[chrisf]

Do you even read your own posts?  Every post you have made says something bad about KloxoMR or Mustafa, EVERY SINGLE post.

I have countless hours helping, debugging and testing.  I have been on over 10 forum members servers fixing problems, FOR FREE!

Yes I run a hosting company, my motivation for using KloxoMR has nothing to do with free or not, the monthly fee for cPanel would not be a problem.  It is my choice!

Spectrahost, Mustafa's hosting, uses KloxoMR and is not free!  Your rant is ironic at best, most of the senior members of this forum run hosting for profit!

I am not arrogant, I am dedicated and intelligent.  I work hard for those who trust me to do so.  People in glass houses should not throw stones, you attack this project in every post!  You are what you claim to hate!

You have told more people to stop using KloxoMR than you have helped.

I was not referring to Mella at all, I am, and will help Mella resolve this issue. This conversation is over, use personal messages if you wish to further this discussion, this forum is not for personal attacks.

[fossxplorer]

OMG! I didn't read @chrisf's post before now, but i used almost 24 hours to try to find a solution, but only on Nginx proxy to Nginx webserver backend (not on Kloxo-MR though). On Kloxo i use Hiawatha + Apache, and i see _SERVER["HTTP_HTTPS"] and not _SERVER["HTTPS"] . I was very close finding out this myself, but i did a mistake with SetEnvIf, trying to translate Nginx config to Apache's.
If you use Nginx in the backend as well (note this is NOT possible with Kloxo-MR), this will fix it:
in nginx.conf:
map $http_x_forwarded_proto $ssl_switch {
                    default off;
                    https   on;
    }

And in the vhost's .php location:
fastcgi_param HTTPS $ssl_switch;

With the above changes, WHMCS is finally working, but as i said, it's not inside Kloxo-MR.

I'll test your solution in the link. Thanks a billion @chrisf!
EDIT 2: btw, i saw that Hiawatha is sending X-Forwarded-Protocol to the backend, so i assume no changes needs to done on proxy's side.


And @Mustafa: what i had to do manually was to 'cat domain.key domain.crt  intermediate{1,2}.crt ca.crt > domain.pem'
Then Hiawatha loaded it successfully

EDIT: Hiawatha loaded what ever Kloxo-MR created, but it failed on SSL checks since intermediate/ca root certs were missing hence my manual fix above.

THIS HAS NOTHING TO DO WITH SSL CERTIFICATES!

I am so tired of the negativity of this forums members, why not leave!  If you are so unhappy, why keep using KloxoMR?   Go back to kloxo official!

This redirect happens because php is served through Apache, under proxy Apache doesn't know you are using https, since the proxy serves the pages.  The $_SERVER['HTTPS'] is never set by Apache, therefore any program checking this will forever loop.  This is NOT a KloxoMR bug, but how proxied Apache works.

This is why I had you test pure Apache.

Now, to the fix, what proxy are you using?  With a few tricks we will get php recognizing https.

If nginx proxy is what you are using, simply follow my instructions here:
http://forum.mratwork.com/kloxo-mr-tips-and-tricks/php-force-redirect-ssl-nginxproxy-endless-loop/

All will work well!

[chrisf]

No problem Mella.  Let me know if you get it resolved.  If not we'll figure it out.  Hiawatha setup shouldn't be much different.