Amazon Linux 2023单实例Beanstalk Apache PHP8 SSL配置故障排查

背景 #

原有环境为Amazon Linux 1 + PHP 7的单实例Elastic Beanstalk环境，通过eb extensions配置SSL证书（无负载均衡），HTTP/HTTPS访问正常。迁移至Amazon Linux 2023 + PHP 8.2（Apache）后，已将mod24_ssl替换为mod_ssl，HTTP访问正常，但HTTPS连接时客户端提示"无法连接服务器"或"连接被拒绝"。

当前使用的ebextensions文件 #

文件1 #

packages:
  yum:
    mod_ssl : []

files:
  /etc/httpd/conf.d/ssl.conf:
    mode: "000644"
    owner: root
    group: root
    content: |
      LoadModule ssl_module modules/mod_ssl.so
      Listen 443
      <VirtualHost *:443>
        <Proxy *>
          Order deny,allow
          Allow from all
        </Proxy>

        SSLEngine             on
        SSLCertificateFile    "/etc/pki/tls/certs/server.crt"
        SSLCertificateKeyFile "/etc/pki/tls/certs/server.key"
        SSLCipherSuite        EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
        SSLProtocol           All -SSLv2 -SSLv3
        SSLHonorCipherOrder   On
        SSLSessionTickets     Off

        Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
        Header always set X-Frame-Options DENY
        Header always set X-Content-Type-Options nosniff

        ProxyPass / http://localhost:80/ retry=0
        ProxyPassReverse / http://localhost:80/
        ProxyPreserveHost on
        RequestHeader set X-Forwarded-Proto "https" early

      </VirtualHost>

  /etc/pki/tls/certs/server.crt:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN CERTIFICATE-----
      ~~~~~~~
      -----END CERTIFICATE-----

文件2 #

Resources:
  AWSEBAutoScalingGroup:
    Metadata:
      AWS::CloudFormation::Authentication:
        S3Auth:
          type: "s3"
          buckets: ["elasticbeanstalk-us-east-2-xxx"]
          roleName:
            "Fn::GetOptionSetting":
              Namespace: "aws:autoscaling:launchconfiguration"
              OptionName: "IamInstanceProfile"
              DefaultValue: "aws-elasticbeanstalk-ec2-role"
files:
  # Private key
  "/etc/pki/tls/certs/server.key":
    mode: "000400"
    owner: root
    group: root
    authentication: "S3Auth"
    source: https://s3.us-east-2.amazonaws.com/elasticbeanstalk-us-east-2-xxx/xxx.pem

文件3 #

Resources:
  sslSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

排查与修复步骤 #

1. 解决Apache配置冲突 #

Amazon Linux 2023的Apache默认存在mod_ssl的基础配置，直接替换默认ssl.conf易引发模块加载或端口监听冲突：

• 改为创建自定义配置文件（如/etc/httpd/conf.d/custom_ssl.conf），避免覆盖默认配置
• 移除LoadModule ssl_module modules/mod_ssl.so，安装mod_ssl后Apache会自动加载该模块，重复加载会导致启动报错

2. 修正Apache授权语法 #

AL2023使用的Apache版本已废弃旧版授权语法，将<Proxy>块内容替换为：

<Proxy *>
  Require all granted
</Proxy>

3. 开放实例本地防火墙端口 #

Amazon Linux 2023默认启用firewalld，即使安全组已开放443端口，本地防火墙仍可能拦截请求，需添加命令放行：

commands:
  open_https_port:
    command: firewall-cmd --add-port=443/tcp --permanent && firewall-cmd --reload

4. 验证证书与密钥有效性 #

• 登录实例执行以下命令，确认证书与密钥匹配：

  openssl x509 -noout -modulus -in /etc/pki/tls/certs/server.crt | openssl md5
  openssl rsa -noout -modulus -in /etc/pki/tls/certs/server.key | openssl md5
  

  两次输出需完全一致
• 确保密钥权限为000400，所有者为root:root，可添加命令强制修复：

  commands:
    fix_key_perms:
      command: chmod 400 /etc/pki/tls/certs/server.key && chown root:root /etc/pki/tls/certs/server.key
      ignoreErrors: true
  

5. 查看日志定位问题 #

• 查看Apache错误日志：/var/log/httpd/error_log，查找SSL加载、端口监听相关报错
• 查看Elastic Beanstalk部署日志：/var/log/eb-engine.log，确认ebextensions是否正确执行

修改后的完整ebextensions示例（.ebextensions/ssl.config） #

packages:
  yum:
    mod_ssl: []

commands:
  open_https_port:
    command: firewall-cmd --add-port=443/tcp --permanent && firewall-cmd --reload
  fix_key_perms:
    command: chmod 400 /etc/pki/tls/certs/server.key && chown root:root /etc/pki/tls/certs/server.key
    ignoreErrors: true

files:
  /etc/httpd/conf.d/custom_ssl.conf:
    mode: "000644"
    owner: root
    group: root
    content: |
      Listen 443
      <VirtualHost *:443>
        <Proxy *>
          Require all granted
        </Proxy>

        SSLEngine             on
        SSLCertificateFile    "/etc/pki/tls/certs/server.crt"
        SSLCertificateKeyFile "/etc/pki/tls/certs/server.key"
        SSLCipherSuite        EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
        SSLProtocol           All -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
        SSLHonorCipherOrder   On
        SSLSessionTickets     Off

        Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains; preload"
        Header always set X-Frame-Options DENY
        Header always set X-Content-Type-Options nosniff

        ProxyPass / http://localhost:80/ retry=0
        ProxyPassReverse / http://localhost:80/
        ProxyPreserveHost on
        RequestHeader set X-Forwarded-Proto "https" early

      </VirtualHost>

  /etc/pki/tls/certs/server.crt:
    mode: "000400"
    owner: root
    group: root
    content: |
      -----BEGIN CERTIFICATE-----
      ~~~~~~~
      -----END CERTIFICATE-----

  /etc/pki/tls/certs/server.key:
    mode: "000400"
    owner: root
    group: root
    authentication: "S3Auth"
    source: https://s3.us-east-2.amazonaws.com/elasticbeanstalk-us-east-2-xxx/xxx.pem

Resources:
  AWSEBAutoScalingGroup:
    Metadata:
      AWS::CloudFormation::Authentication:
        S3Auth:
          type: "s3"
          buckets: ["elasticbeanstalk-us-east-2-xxx"]
          roleName:
            "Fn::GetOptionSetting":
              Namespace: "aws:autoscaling:launchconfiguration"
              OptionName: "IamInstanceProfile"
              DefaultValue: "aws-elasticbeanstalk-ec2-role"

  sslSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0

内容的提问来源于stack exchange，提问作者Steven L Smith