Apache2配置异常：请求HTTPS却返回HTTP的问题排查

我有一个运行在本地7530端口的Web应用，通过curl访问本地服务无问题，但使用域名访问时出现错误，提示HTTPS响应实际为HTTP响应。

执行curl -vvv https://myapp.mydomain.com得到以下输出：

*   Trying 12.345.67.89:443...
* TCP_NODELAY set
* Connected to myapp.mydomain.com (12.345.67.89) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

Firefox提示错误SSL_ERROR_RX_RECORD_TOO_LONG。

我的配置文件/etc/apache2/sites-enabled/010-myapp.mydomain.com-le-ssl.conf和/etc/apache2/sites-available/010-myapp.mydomain.com-le-ssl.conf内容如下：

<IfModule mod_ssl.c>
    <VirtualHost *:443>
        DEFINE myapp_url 127.0.0.1
        DEFINE myapp_port 7530


        ServerName myapp.mydomain.com


        ProxyRequests       Off
        ProxyPreserveHost   On
        AllowEncodedSlashes NoDecode


        RequestHeader    set X-Forwarded-Proto "https"
        RequestHeader    set X-Forwarded-Port "443"

        ProxyPass / http://${myapp_url}:${myapp_port}/
        ProxyPassReverse / http://${myapp_url}:${myapp_port}/

        SSLCertificateFile /etc/letsencrypt/live/myapp.mydomain.com/fullchain.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/myapp.mydomain.com/privkey.pem
        Include /etc/letsencrypt/options-ssl-apache.conf
    </VirtualHost>
</IfModule>

执行sudo apachectl -S的输出为：

AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1. Set the 'ServerName' directive globally to suppress this message
VirtualHost configuration:
*:80                   is a NameVirtualHost
         default server 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1)
         port 80 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/000-default.conf:1)
         port 80 namevhost files.otherdomain.org (/etc/apache2/sites-enabled/001-files.otherdomain.org.redir.conf:1)
                 alias files.otherdomain.org
         port 80 namevhost media.otherdomain.org (/etc/apache2/sites-enabled/002-media.otherdomain.org.conf:1)
                 alias media.otherdomain.org
         port 80 namevhost app2.otherdomain.org (/etc/apache2/sites-enabled/004-app2.otherdomain.org.conf:1)
         port 80 namevhost app1.mydomain.com (/etc/apache2/sites-enabled/005-app1.mydomain.com.conf:1)
         port 80 namevhost admin.otherdomain.org (/etc/apache2/sites-enabled/006-admin.otherdomain.org.conf:1)
         port 80 namevhost app3.mydomain.com (/etc/apache2/sites-enabled/008-app3.mydomain.com.conf:1)
         port 80 namevhost myapp.mydomain.com (/etc/apache2/sites-enabled/010-myapp.mydomain.com.conf:1)
*:443                  is a NameVirtualHost
         default server files.otherdomain.org (/etc/apache2/sites-enabled/001-files.otherdomain.org.https.redir.conf:2)
         port 443 namevhost files.otherdomain.org (/etc/apache2/sites-enabled/001-files.otherdomain.org.https.redir.conf:2)
                 alias files.otherdomain.org
         port 443 namevhost media.otherdomain.org (/etc/apache2/sites-enabled/002-media.otherdomain.org-le-ssl.conf:10)
         port 443 namevhost app2.otherdomain.org (/etc/apache2/sites-enabled/004-app2.otherdomain.org-le-ssl.conf:2)
         port 443 namevhost app1.mydomain.com (/etc/apache2/sites-enabled/005-app1.mydomain.com-le-ssl.conf:2)
         port 443 namevhost admin.otherdomain.org (/etc/apache2/sites-enabled/006-admin.otherdomain.org-le-ssl.conf:2)
         port 443 namevhost app3.mydomain.com (/etc/apache2/sites-enabled/008-app3.mydomain.com-le-ssl.conf:2)
         port 443 namevhost myapp.mydomain.com (/etc/apache2/sites-enabled/010-myapp.mydomain.com-le-ssl.conf:2)
         port 443 namevhost 127.0.1.1 (/etc/apache2/sites-enabled/default-ssl.conf:2)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
Mutex default: dir="/var/run/apache2/" mechanism=default 
Mutex mpm-accept: using_defaults
Mutex watchdog-callback: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
Define: wiki_url=127.0.0.1
Define: wiki_port=5410
Define: serv_name=admin.otherdomain.org
Define: myapp_url=127.0.0.1
Define: myapp_port=7530
User: name="www-data" id=33

请问我的配置哪里存在错误？

你遇到的ssl3_get_record:wrong version number和SSL_ERROR_RX_RECORD_TOO_LONG错误，本质是客户端向443端口发送TLS握手请求，但服务器返回的是普通HTTP响应，核心问题出在Apache的443端口虚拟主机未正确启用SSL/TLS配置，以下是具体排查和修复步骤：

1. 确认mod_ssl模块已启用 #

你的SSL虚拟主机配置被<IfModule mod_ssl.c>包裹，如果该模块未启用，整个443虚拟主机的SSL配置不会生效，Apache会将443端口当作普通HTTP端口处理，从而触发错误。执行以下命令启用并重启服务：

a2enmod ssl
sudo systemctl restart apache2

2. 验证Let's Encrypt SSL配置文件有效性 #

你的配置中引用了/etc/letsencrypt/options-ssl-apache.conf，该文件包含了Let's Encrypt推荐的SSL安全参数，若文件缺失或损坏会导致SSL配置不完整。执行以下命令检查文件是否存在：

ls -l /etc/letsencrypt/options-ssl-apache.conf

若文件不存在，可重新生成Let's Encrypt配置：

sudo certbot renew --dry-run

3. 排查默认443虚拟主机的干扰 #

从sudo apachectl -S输出可见，*:443的默认虚拟主机是files.otherdomain.org对应的001-files.otherdomain.org.https.redir.conf。检查该配置文件是否包含完整的SSL证书配置（SSLCertificateFile、SSLCertificateKeyFile等指令）：

• 若该配置仅做重定向却未配置SSL，当虚拟主机匹配异常时会导致443端口返回HTTP响应；
• 可调整虚拟主机文件名前缀（比如将你的010-改为000-），让myapp.mydomain.com的SSL虚拟主机优先级更高，避免默认虚拟主机干扰。

4. 确保证书文件权限正确 #

Apache用户（www-data）需要具备证书文件的读取权限，执行以下命令修正权限：

sudo chown -R root:www-data /etc/letsencrypt/live/myapp.mydomain.com/
sudo chmod -R 750 /etc/letsencrypt/live/myapp.mydomain.com/

完成上述步骤后，重启Apache并再次测试curl -vvv https://myapp.mydomain.com，确认TLS握手正常完成并成功代理到本地7530端口。

内容的提问来源于stack exchange，提问作者xgb84j