Django+mod_wsgi HTTP正常但HTTPS报“Client denied by server configuration”

Hey there, let's tackle that "Client denied by server configuration" error you're hitting with mod_wsgi and HTTPS. I've run into similar headaches before, so here are the most likely fixes to try out:

1. Double-check Directory & File Permissions #

Since you're running as the apache user/group, make sure every part of your Django setup is accessible to them:

• Set ownership for your Django project root:

  sudo chown -R apache:apache /path/to/your/django/project
  

• Restrict SSL certificate/key permissions (they shouldn't be world-readable) while keeping them accessible to apache:

  sudo chmod 600 /path/to/ssl/cert.pem /path/to/ssl/key.pem
  sudo chown apache:apache /path/to/ssl/cert.pem /path/to/ssl/key.pem
  

• Ensure all parent directories of your project and certificates have at least execute permission for the apache user (so the server can traverse into them).

2. Verify Apache Access Rules in HTTPS Configuration #

Sometimes the auto-generated HTTPS config misses critical access grants. Look for the <Directory> block targeting your Django project's wsgi.py file in the generated httpd.conf (usually in /etc/mod_wsgi-express-443/ if you used port 443) and make sure it includes:

<Directory /path/to/your/django/project>
    <Files wsgi.py>
        # For Apache 2.4+
        Require all granted
        # For older Apache versions, use: Allow from all
    </Files>
</Directory>

Also confirm this block is correctly linked to your HTTPS virtual host (not just the HTTP one).

3. Validate SSL Certificate Configuration #

Make sure you're generating the HTTPS config with the right SSL parameters. Your command should look something like this:

sudo python3.6 manage.py runmodwsgi --setup-only --port=443 \
  --ssl-certificate=/path/to/your/cert.pem \
  --ssl-certificate-key=/path/to/your/key.pem \
  --user apache --group apache \
  --server-root=/etc/mod_wsgi-express-443

After generating, check the config file to ensure SSLCertificateFile and SSLCertificateKeyFile point to the correct paths. Run sudo apachectl configtest to catch any syntax errors.

4. Check SELinux Settings (For RHEL/CentOS Systems) #

SELinux often blocks Apache access even when file permissions look correct. Try temporarily disabling it to test:

sudo setenforce 0

If HTTPS works after this, you'll need to set up permanent SELinux rules:

• Label your Django project directory for Apache access:

  sudo semanage fcontext -a -t httpd_sys_content_t "/path/to/your/django/project(/.*)?"
  sudo restorecon -Rv /path/to/your/django/project
  

• Label your SSL certificate directory:

  sudo semanage fcontext -a -t cert_t "/path/to/ssl(/.*)?"
  sudo restorecon -Rv /path/to/ssl
  

5. Dig Into Apache Error Logs #

The most direct way to pinpoint the issue is checking the error logs. Look for entries in:

• /var/log/httpd/error_log
• Or the logs directory inside your mod_wsgi server root (e.g., /etc/mod_wsgi-express-443/logs/error_log)

Logs will tell you exactly why access was denied—whether it's a permission issue, SELinux block, or misconfigured directive.

内容的提问来源于stack exchange，提问作者user1768233