tl;dr
Thanks again for the script, it was a great help. Looks like I was using an A record when I needed a CNAME - sorry for the earlier interaction was a misunderstanding on my part.
edited to clear my earlier posts up:
the script did in fact take care of the problem of directing SSL traffic as a reverse-proxy
(using Lets Encrypt SAN with 4 entries does lock both domains now)
to a windows server 2008R2 instance hosting an owncloud version once I added the proper CNAME record in my DNS records to match the subdomain, and sanitized IIS7.5 of all bindings to 443 and flushed the old SSL paid cert thoroughly. The main domain did not bind to port 443 so wouldnt lock, and just needed another xyz.conf file added to the sites-enabled folder to match to the univention portal, and then worked a charm!
"Lets dumb this all down. Since you want to use letsencrypt for ssl its the easiest if you configure your firewall to have port 80 and 443 coming out on your univention system (instead of your old windows server). we’ll then use the apache on the univention host to proxy all requests to your old domain to the windows system. for this you basically only have to put create the file /etc/apache2/sites-available/old-server.conf with below content (and activate it with a2ensite old-server afterwards):
<VirtualHost *:80>
ServerName cloud.myexternaldomain.com
ErrorLog ${APACHE_LOG_DIR}/proxy-error.log
CustomLog ${APACHE_LOG_DIR}/proxy-access.log combined
# Enforce HTTPS:
RewriteEngine On
RewriteCond %{REQUEST_URI} !^/.well-known/acme-challenge/
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://cloud.myexternaldomain.com/$1 [R,L]
</VirtualHost>
<VirtualHost *:443>
SSLEngine on
ServerName cloud.myexternaldomain.com
SSLCertificateFile /etc/univention/letsencrypt/signed_chain.crt
SSLCertificateKeyFile /etc/univention/letsencrypt/domain.key
SSLCACertificateFile /etc/univention/ssl/ucsCA/CAcert.pem
SSLCertificateChainFile /etc/univention/letsencrypt/intermediate.pem
ErrorLog ${APACHE_LOG_DIR}/proxy-error.log
CustomLog ${APACHE_LOG_DIR}/proxy-access.log combined
ProxyPass / http://ip-of-windows/
ProxyPassReverse / http://ip-of-windows/
ProxyPreserveHost On
ProxyRequests Off
</VirtualHost>
``"
---
So this by itself did not work, and I was stuck for about a week
before this sent me in the right direction -
it eventually needed a copy of this default-ssl.conf added to sites-available
and then enabled, that matched the
host domain univention doing the proxying
request to windows, but it had to be with
name-based virtualhost
(ip-based virtual hosts failed consistently) that matched my config:
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName sub.somedomain.tld
SSLEngine on
SSLProxyEngine on
SSLProxyCheckPeerCN off
SSLProxyCheckPeerName off
SSLProxyCheckPeerExpire off
SSLCertificateFile /etc/univention/letsencrypt/signed_chain.crt
SSLCertificateKeyFile /etc/univention/letsencrypt/domain.key
SSLCACertificateFile /etc/univention/ssl/ucsCA/CAcert.pem
SSLCertificateChainFile /etc/univention/letsencrypt/intermediate.pem
ErrorLog ${APACHE_LOG_DIR}/proxy-error.log
CustomLog ${APACHE_LOG_DIR}/proxy-access.log combined
ProxyPass / http://192.168.100.100/
ProxyPassReverse / http://192.168.100.100/
ProxyPreserveHost On
ProxyRequests Off
</VirtualHost>
</IfModule>
After enabling the site with a2ensite sub and restarting Apache I have the following result:
all sites that are served by somedomain.tld are still accessible as before
on https/sub.somedomain.tld I see the page that is served by the internal host at 192.168.100.100
For me there was no need to add a VirtualHost for Port 80 as I have apache2/force_https=yes which also matches.
Note that I have not checked a real application, my internal host only serves a static page.
hth,
Dirk Ahrnke
