Я устанавливаю в Azure шлюз приложений, который хочу иметь сквозное SSL-соединение с моим httpd-сервером apache, который обслуживает мою страницу с виртуальной машины.
Я установил параметры Listener и HTTP, похоже, он работает с простым http для внешнего и внутреннего интерфейса.
Мой сервер обслуживает https с сертификатом ".crt"
Чтобы сквозной https работал на шлюзе приложений, вам необходимо внести сертификат серверной части в белый список. Для этого вам нужно добавить файл «.cer» в настройку HTTP.
Когда я запрашиваю страницу, я получаю следующую ошибку:
502 Bad Gateway
Microsoft-Azure-Application-Gateway/v2
Я уже следовал следующим руководствам, предоставленным Microsoft
- https://docs.microsoft.com/el-gr/azure/application-gateway/ssl-overview
- https://docs.microsoft.com/el-gr/azure/application-gateway/end-to-end-ssl-portal
- https://docs.microsoft.com/el-gr/azure/application-gateway/application-gateway-troubleshooting-502#problems-with-default-health-probe
Как упоминалось в первой ссылке, полное доменное имя внутреннего пула должно быть таким же, как CN сертификата.
Кроме того, я попытался сгенерировать «.pfx», а затем безуспешно экспортировать файлы «.cer» и «.crt».
Проверка работоспособности серверной части возвращает, что внутренний сервер исправен, поэтому шлюз приложения может связаться с внутренним хостом. Я использую V2 и добавляю кодировку base 64 ".cer". Полное доменное имя совпадает с именем DNS внутреннего узла.
Я использовал следующие команды для создания сертификатов
openssl genrsa -des3 -out rootCA.key 4096
openssl req -x509 -new -nodes -key rootCA.key -sha256 \
-days 1024 -out rootCA.crt
openssl genrsa -out my.domain.com.key 2048
openssl req -new -sha256 -key my.domain.com.key \
-subj "/C=GR/ST=Attica/O=mycompany/CN=my.domain.com" \
-out my.domain.com.csr
openssl x509 -req -in my.domain.com.csr \
-CA rootCA.crt -CAkey rootCA.key -CAcreateserial \
-out my.domain.com.crt -days 500 -sha256
После этого я импортировал файл «rootCA.crt» в диспетчер сертификации Windows и экспортировал его как base64 «.cer». Я использовал экспортированный сертификат в разделе «Надежные корневые сертификаты» в шлюзе приложений.
Шаблон развертывания следующий:
{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"serverapplicationGateways_name_app_gateway_name": {
"defaultValue": "name-app-gateway",
"type": "String"
},
"virtualNetworks_name_app_gateway_externalid": {
"defaultValue": "/subscriptions/[subscription-id]/resourceGroups/name-app-gateway-rg/providers/Microsoft.Network/virtualNetworks/name-app-gateway",
"type": "String"
},
"publicIPAddresses_name_app_gateway_pip_externalid": {
"defaultValue": "/subscriptions/[subscription-id]/resourceGroups/name-app-gateway-rg/providers/Microsoft.Network/publicIPAddresses/name-app-gateway-pip",
"type": "String"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Network/applicationGateways",
"apiVersion": "2019-04-01",
"name": "[parameters('serverapplicationGateways_name_app_gateway_name')]",
"location": "westeurope",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "20beed4d-2ff5-440b-918f-5772d6c91ad2",
"sku": {
"name": "Standard_v2",
"tier": "Standard_v2"
},
"gatewayIPConfigurations": [
{
"name": "appGatewayIpConfig",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"subnet": {
"id": "[concat(parameters('virtualNetworks_name_app_gateway_externalid'), '/subnets/default')]"
}
},
"type": "Microsoft.Network/applicationGateways/gatewayIPConfigurations"
}
],
"sslCertificates": [
{
"name": "company",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"publicCertData": "MIIDvgYJKoZIhvcNAQcCoIIDrzCCA6sCAQExADALBgkqhkiG9w0BBwGgggOTMIIDjzCCAnegAwIBAgIUCgwbAVCKmec/OdsO1bwmpDX/6/UwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCR1IxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDEQMA4GA1UEAwwHZmxleGZpbjAeFw0xOTA3MDMxNTI5MDlaFw0yMDA3MDIxNTI5MDlaMFcxCzAJBgNVBAYTAkdSMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQxEDAOBgNVBAMMB2ZsZXhmaW4wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDfOIiBjcolw2GI+ZO1KYLR/En/2CQ8sQ+rBgocSFybHOsIbdm+nFvFSQLtdQf5lVjYFqhhBfhOP9otIa1UdEq0Mb+k0sZptJgW/ZziqLBsK5SwJxdwSxZgsfm4wKedS1bpYgVBBayKraKYCeUwUsUEoV/e5tjqRqC6i3Z3ZYAVdm4pf2vYJxjwKG1U0X3qyvjtv9nkJ2U3R3O1KILB1HPPdEe5nHHjkDravcghBxMjaI0YKgKcw2PyNiVcrcDZ3mrMoAvAzpLcbLIGvwfISjIMcI1wNYBfIC4qiLhlUASbudWGL8GFJ5/KZbsFNzq9ontwbjgeT8OLUJ47m+at3BN9AgMBAAGjUzBRMB0GA1UdDgQWBBSB4kKSMWZQ+Lxn1yiXdEvaT/H1BTAfBgNVHSMEGDAWgBSB4kKSMWZQ+Lxn1yiXdEvaT/H1BTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAEeaAMSAZWqlPGmM+Rzrxuj1joD514pxuSEmJfiDUf8TczNjh1g6sLC0eGqzI+Om4APz/mn2z8t5ziWnxDD+jtzLM4CjWGxOR1873fsAPjz/PdBfaNCpXBeXvS4LMrAYnZocFel1ypIAfty+KGWWkE7z6hbQr8OCrlnpmHnU/+OdtjuEPKqQVFVmJUHDzwiOSQgqCDIq0CYDKii1+1OCIVdce7VmWFMiGucqujM2Q8QbWZILVb82Yee6AnnyenmvWsO6pJawrOtg0IYYnGJPILqjFU1yk1ox7OBZHjoxz9U43JL2FnwVdMphU1vIU5huW22tRigHnvjuSUPRhXL0ejMQA="
},
"type": "Microsoft.Network/applicationGateways/sslCertificates"
}
],
"trustedRootCertificates": [
{
"name": "server-uat",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"data": "sertificate data"
},
"type": "Microsoft.Network/applicationGateways/trustedRootCertificates"
}
],
"frontendIPConfigurations": [
{
"name": "appGwPublicFrontendIp",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"type": "Microsoft.Network/applicationGateways/frontendIPConfigurations",
"properties": {
"provisioningState": "Succeeded",
"privateIPAllocationMethod": "Dynamic",
"publicIPAddress": {
"id": "[parameters('publicIPAddresses_name_app_gateway_pip_externalid')]"
}
}
}
],
"frontendPorts": [
{
"name": "port_443",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"port": 443
},
"type": "Microsoft.Network/applicationGateways/frontendPorts"
},
{
"name": "http-port",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"port": 80
},
"type": "Microsoft.Network/applicationGateways/frontendPorts"
}
],
"backendAddressPools": [
{
"name": "server",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"backendAddresses": [
{
"fqdn": "server-prod.internal.company.com"
}
]
},
"type": "Microsoft.Network/applicationGateways/backendAddressPools"
}
],
"backendHttpSettingsCollection": [
{
"name": "server-http-setting",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"port": 443,
"protocol": "Https",
"cookieBasedAffinity": "Disabled",
"pickHostNameFromBackendAddress": true,
"requestTimeout": 20,
"trustedRootCertificates": [
{
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/server')]"
},
{
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/httpd')]"
},
{
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/server-http-settingeeab8427-4514-4ef4-8e94-7d155a76f037')]"
},
{
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/httpd-root')]"
},
{
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/trustedRootCertificates/server-uat')]"
}
]
},
"type": "Microsoft.Network/applicationGateways/backendHttpSettingsCollection"
},
{
"name": "server-http-80-setting",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"port": 80,
"protocol": "Http",
"cookieBasedAffinity": "Disabled",
"pickHostNameFromBackendAddress": false,
"affinityCookieName": "ApplicationGatewayAffinity",
"requestTimeout": 20
},
"type": "Microsoft.Network/applicationGateways/backendHttpSettingsCollection"
}
],
"httpListeners": [
{
"name": "server-l",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"frontendIPConfiguration": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/frontendIPConfigurations/appGwPublicFrontendIp')]"
},
"frontendPort": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/frontendPorts/port_443')]"
},
"protocol": "Https",
"sslCertificate": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/sslCertificates/company')]"
},
"requireServerNameIndication": false
},
"type": "Microsoft.Network/applicationGateways/httpListeners"
},
{
"name": "server-http-l",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"frontendIPConfiguration": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/frontendIPConfigurations/appGwPublicFrontendIp')]"
},
"frontendPort": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/frontendPorts/http-port')]"
},
"protocol": "Http",
"requireServerNameIndication": false
},
"type": "Microsoft.Network/applicationGateways/httpListeners"
}
],
"urlPathMaps": [],
"requestRoutingRules": [
{
"name": "server-rr",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"ruleType": "Basic",
"httpListener": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/httpListeners/server-l')]"
},
"backendAddressPool": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/backendAddressPools/server')]"
},
"backendHttpSettings": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/backendHttpSettingsCollection/server-http-setting')]"
}
},
"type": "Microsoft.Network/applicationGateways/requestRoutingRules"
},
{
"name": "redirect-to-https",
"etag": "W/\"be033d5e-9b23-400a-b6ca-f5cbede2a4e5\"",
"properties": {
"provisioningState": "Succeeded",
"ruleType": "Basic",
"httpListener": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/httpListeners/server-http-l')]"
},
"backendAddressPool": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/backendAddressPools/server')]"
},
"backendHttpSettings": {
"id": "[concat(resourceId('Microsoft.Network/applicationGateways', parameters('serverapplicationGateways_name_app_gateway_name')), '/backendHttpSettingsCollection/server-http-80-setting')]"
}
},
"type": "Microsoft.Network/applicationGateways/requestRoutingRules"
}
],
"probes": [],
"rewriteRuleSets": [],
"redirectConfigurations": [],
"enableHttp2": false,
"autoscaleConfiguration": {
"minCapacity": 2,
"maxCapacity": 10
}
}
}
]
}
