如何设置与应用程序网关和 apache httpd 的端到端 ssl 连接？答案

【问题标题】：How can I setup an end to end ssl conection with application gateway and apache httpd?如何设置与应用程序网关和 apache httpd 的端到端 ssl 连接？
【发布时间】：2019-07-04 16:27:52
【问题描述】：

我正在 Azure 上设置一个应用程序网关，我希望与我的 apache httpd 服务器建立端到端 SSL 连接，该服务器从 vm 为我的页面提供服务

我已经设置了监听器和 HTTP 设置，它似乎可以在前端和后端使用简单的 http

我的服务器使用“.crt”证书为 https 提供服务

为了使端到端 https 在应用程序网关上工作，您需要将后端证书列入白名单。为此，您需要在 HTTP 设置中添加“.cer”文件。

当我请求页面时，我收到以下错误：

502 Bad Gateway Microsoft-Azure-Application-Gateway/v2

我已经按照 Microsoft 提供的以下指南进行操作

在第一个参考中提到，后端池的FQDN应该与证书的CN相同。

另外，我尝试生成一个“.pfx”，然后导出“.cer”和“.crt”文件，但没有任何运气。

后端健康探测返回后端服务器是健康的所以appgateway可以到达后端主机。我正在使用 V2 并添加 base 64 编码的“.cer” FQDN与后端节点的dns名称相同

我使用以下命令来生成证书

openssl genrsa -des3 -out rootCA.key 4096

openssl req -x509 -new -nodes -key rootCA.key -sha256 \
-days 1024 -out rootCA.crt

openssl genrsa -out my.domain.com.key 2048


openssl req -new -sha256 -key my.domain.com.key \
-subj "/C=GR/ST=Attica/O=mycompany/CN=my.domain.com" \
 -out my.domain.com.csr


openssl x509 -req -in my.domain.com.csr \
-CA rootCA.crt -CAkey rootCA.key -CAcreateserial \
-out my.domain.com.crt -days 500 -sha256

之后，我将“rootCA.crt”文件导入到 Windows 认证管理器并导出为 base64“.cer” 我在应用程序网关的 Trusted Root Certificates 部分使用了导出的证书

部署模板如下：

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "serverapplicationGateways_name_app_gateway_name": {
            "defaultValue": "name-app-gateway",
            "type": "String"
        },
        "virtualNetworks_name_app_gateway_externalid": {
            "defaultValue": "/subscriptions/[subscription-id]/resourceGroups/name-app-gateway-rg/providers/Microsoft.Network/virtualNetworks/name-app-gateway",
            "type": "String"
        },
        "publicIPAddresses_name_app_gateway_pip_externalid": {
            "defaultValue": "/subscriptions/[subscription-id]/resourceGroups/name-app-gateway-rg/providers/Microsoft.Network/publicIPAddresses/name-app-gateway-pip",
            "type": "String"
        }
    },
    "variables": {},
    "resources": [
        {
            "type": "Microsoft.Network/applicationGateways",
            "apiVersion": "2019-04-01",
            "name": "[parameters('serverapplicationGateways_name_app_gateway_name')]",
            "location": "westeurope",
            "properties": {
                "provisioningState": "Succeeded",
                "resourceGuid": "20beed4d-2ff5-440b-918f-5772d6c91ad2",
                "sku": {
                    "name": "Standard_v2",
                    "tier": "Standard_v2"
                },
                "gatewayIPConfigurations": [
                    {
                        "name": "appGatewayIpConfig",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "subnet": {
                                "id": "[concat(parameters('virtualNetworks_name_app_gateway_externalid'), '/subnets/default')]"
                            }
                        },
                        "type": "Microsoft.Network/applicationGateways/gatewayIPConfigurations"
                    }
                ],
                "sslCertificates": [
                    {
                        "name": "company",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "publicCertData": "MIIDvgYJKoZIhvcNAQcCoIIDrzCCA6sCAQExADALBgkqhkiG9w0BBwGgggOTMIIDjzCCAnegAwIBAgIUCgwbAVCKmec/OdsO1bwmpDX/6/UwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR1IxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEQMA4GA1UEAwwHZmxleGZpbjAeFw0xOTA3MDMxNTI5MDlaFw0yMDA3MDIxNTI5MDlaMFcxCzAJBgNVBAYTAkdSMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEDAOBgNVBAMMB2ZsZXhmaW4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDfOIiBjcolw2GI+ZO1KYLR/En/2CQ8sQ+rBgocSFybHOsIbdm+nFvFSQLtdQf5lVjYFqhhBfhOP9otIa1UdEq0Mb+k0sZptJgW/ZziqLBsK5SwJxdwSxZgsfm4wKedS1bpYgVBBayKraKYCeUwUsUEoV/e5tjqRqC6i3Z3ZYAVdm4pf2vYJxjwKG1U0X3qyvjtv9nkJ2U3R3O1KILB1HPPdEe5nHHjkDravcghBxMjaI0YKgKcw2PyNiVcrcDZ3mrMoAvAzpLcbLIGvwfISjIMcI1wNYBfIC4qiLhlUASbudWGL8GFJ5/KZbsFNzq9ontwbjgeT8OLUJ47m+at3BN9AgMBAAGjUzBRMB0GA1UdDgQWBBSB4kKSMWZQ+Lxn1yiXdEvaT/H1BTAfBgNVHSMEGDAWgBSB4kKSMWZQ+Lxn1yiXdEvaT/H1BTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAEeaAMSAZWqlPGmM+Rzrxuj1joD514pxuSEmJfiDUf8TczNjh1g6sLC0eGqzI+Om4APz/mn2z8t5ziWnxDD+jtzLM4CjWGxOR1873fsAPjz/PdBfaNCpXBeXvS4LMrAYnZocFel1ypIAfty+KGWWkE7z6hbQr8OCrlnpmHnU/+OdtjuEPKqQVFVmJUHDzwiOSQgqCDIq0CYDKii1+1OCIVdce7VmWFMiGucqujM2Q8QbWZILVb82Yee6AnnyenmvWsO6pJawrOtg0IYYnGJPILqjFU1yk1ox7OBZHjoxz9U43JL2FnwVdMphU1vIU5huW22tRigHnvjuSUPRhXL0ejMQA="
                        },
                        "type": "Microsoft.Network/applicationGateways/sslCertificates"
                    }
                ],
                "trustedRootCertificates": [
                    {
                        "name": "server-uat",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "data": "sertificate data"
                        },
                        "type": "Microsoft.Network/applicationGateways/trustedRootCertificates"
                    }
                ],
                "frontendIPConfigurations": [
                    {
                        "name": "appGwPublicFrontendIp",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "type": "Microsoft.Network/applicationGateways/frontendIPConfigurations",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "privateIPAllocationMethod": "Dynamic",
                            "publicIPAddress": {
                                "id": "[parameters('publicIPAddresses_name_app_gateway_pip_externalid')]"
                            }
                        }
                    }
                ],
                "frontendPorts": [
                    {
                        "name": "port_443",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "port": 443
                        },
                        "type": "Microsoft.Network/applicationGateways/frontendPorts"
                    },
                    {
                        "name": "http-port",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "port": 80
                        },
                        "type": "Microsoft.Network/applicationGateways/frontendPorts"
                    }
                ],
                "backendAddressPools": [
                    {
                        "name": "server",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "backendAddresses": [
                                {
                                    "fqdn": "server-prod.internal.company.com"
                                }
                            ]
                        },
                        "type": "Microsoft.Network/applicationGateways/backendAddressPools"
                    }
                ],
                "backendHttpSettingsCollection": [
                    {
                        "name": "server-http-setting",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "port": 443,
                            "protocol": "Https",
                            "cookieBasedAffinity": "Disabled",
                            "pickHostNameFromBackendAddress": true,
                            "requestTimeout": 20,
                            "trustedRootCertificates": [
                                {
                                    "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/server')]"
                                },
                                {
                                    "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/httpd')]"
                                },
                                {
                                    "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/server-http-settingeeab8427-4514-4ef4-8e94-7d155a76f037')]"
                                },
                                {
                                    "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/httpd-root')]"
                                },
                                {
                                    "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/server-uat')]"
                                }
                            ]
                        },
                        "type": "Microsoft.Network/applicationGateways/backendHttpSettingsCollection"
                    },
                    {
                        "name": "server-http-80-setting",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "port": 80,
                            "protocol": "Http",
                            "cookieBasedAffinity": "Disabled",
                            "pickHostNameFromBackendAddress": false,
                            "affinityCookieName": "ApplicationGatewayAffinity",
                            "requestTimeout": 20
                        },
                        "type": "Microsoft.Network/applicationGateways/backendHttpSettingsCollection"
                    }
                ],
                "httpListeners": [
                    {
                        "name": "server-l",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "frontendIPConfiguration": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/frontendIPConfigurations/appGwPublicFrontendIp')]"
                            },
                            "frontendPort": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/frontendPorts/port_443')]"
                            },
                            "protocol": "Https",
                            "sslCertificate": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/sslCertificates/company')]"
                            },
                            "requireServerNameIndication": false
                        },
                        "type": "Microsoft.Network/applicationGateways/httpListeners"
                    },
                    {
                        "name": "server-http-l",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "frontendIPConfiguration": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/frontendIPConfigurations/appGwPublicFrontendIp')]"
                            },
                            "frontendPort": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/frontendPorts/http-port')]"
                            },
                            "protocol": "Http",
                            "requireServerNameIndication": false
                        },
                        "type": "Microsoft.Network/applicationGateways/httpListeners"
                    }
                ],
                "urlPathMaps": [],
                "requestRoutingRules": [
                    {
                        "name": "server-rr",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "ruleType": "Basic",
                            "httpListener": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/httpListeners/server-l')]"
                            },
                            "backendAddressPool": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/backendAddressPools/server')]"
                            },
                            "backendHttpSettings": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/backendHttpSettingsCollection/server-http-setting')]"
                            }
                        },
                        "type": "Microsoft.Network/applicationGateways/requestRoutingRules"
                    },
                    {
                        "name": "redirect-to-https",
                        "etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
                        "properties": {
                            "provisioningState": "Succeeded",
                            "ruleType": "Basic",
                            "httpListener": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/httpListeners/server-http-l')]"
                            },
                            "backendAddressPool": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/backendAddressPools/server')]"
                            },
                            "backendHttpSettings": {
                                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/backendHttpSettingsCollection/server-http-80-setting')]"
                            }
                        },
                        "type": "Microsoft.Network/applicationGateways/requestRoutingRules"
                    }
                ],
                "probes": [],
                "rewriteRuleSets": [],
                "redirectConfigurations": [],
                "enableHttp2": false,
                "autoscaleConfiguration": {
                    "minCapacity": 2,
                    "maxCapacity": 10
                }
            }
        }
    ]
}

【问题讨论】：

标签： apache azure azure-application-gateway

【解决方案1】：

首先，您可以在应用网关的监控中查看backend health。查找有关 502 错误的错误详细信息，然后按照this link 中的步骤进行故障排除。如果在使用 HTTP 协议设置正常设置时可行，也许您也可以缩小方案范围。

身份验证证书已被弃用，并在应用程序网关 v2 SKU 中被 可信根证书 取代。看来您需要确保使用根证书在 HTTP 设置 中将后端列入白名单。

对于 V2 SKU，您应该注意以下参考 here。

由知名 CA 机构签署的证书，其 CN 与 HTTP 后端设置中的主机名匹配，不需要任何端到端 SSL 工作的额外步骤。

例如，如果后端证书由知名 CA 颁发并且具有 contoso.com 的 CN，并且后端 http 设置的主机字段也设置为 contoso.com，则无需其他步骤必需的。您可以将后端 http 设置协议设置为 HTTPS 和健康探测和数据路径都将启用 SSL。如果你是使用 Azure App Service 或其他 Azure Web 服务作为后端，那么这些也是隐式信任的，并且没有进一步的步骤端到端 SSL 所必需的。

如果证书是自签名的，或由未知中介签名，则要在 v2 SKU 中启用端到端 SSL 信任根必须定义证书。应用程序网关只会通信具有服务器证书的根证书匹配一个的后端后端 http 设置中受信任的根证书列表与池相关联。

除了根证书匹配之外，应用程序网关还会验证后端 http 设置中指定的主机设置是否与后端服务器提供的通用名称 (CN) 匹配 SSL 证书。尝试建立 SSL 连接到后端，应用程序网关设置服务器名称指示 (SNI) 扩展后端 http 设置中指定的主机。

如果选择 pick hostname from backend address 而不是后端 http 设置中的 Host 字段，则 SNI 标头始终为设置为后端池 FQDN 和 后端服务器 SSL 上的 CN 证书必须匹配其 FQDN。具有 IP 的后端池成员不是在这种情况下支持。

根证书是来自后端服务器证书的 base64 编码根证书。

如果以上都不起作用，您可以上传您的设置并隐藏一些敏感数据以获得进一步的帮助。

【讨论】：

健康探测返回一个健康的响应，这意味着应用程序网关可以到达后端池
健康探测设置是否与协议、主机、路径等 HTTP 设置匹配？您的应用网关子网中有 NSG 吗？
app网关子网没有NSG，主机和网关不在同一个子网但允许连接
运行状况探测是否与使用协议 https 的 HTTP 设置匹配？
我有两个健康问题，https 和 https，它们都很健康