CODEWITHSUNDEEP
djangoamazon-web-servicessslhttpsbitnami
Andrey Masunov
Andrey Masunov

Reputation: 11

SSL for Django project on bitnami

I have an Django project deployed on ubuntu AWS instance with Bitnami and configured with Lightsail, Route53.

The project is working for HTTP.

I've tried to migrate to HTTPs using the bncert-tool and got DNS with HTTPS, although I see: "You are now running Bitnami Django 3.1.6 in the Cloud" instead of my project. HTTP://<static_ip> is showing my project.

ps: I didn't enable: sample-vhost.conf and sample-https-vhost.conf, as if I do that I see "You don't have permission".

Is there additional steps that should be executed after bncert-tool?

bitnami.conf:

<VirtualHost _default_:80>
  # BEGIN: Configuration for letsencrypt
  Include "/opt/bitnami/apps/letsencrypt/conf/httpd-prefix.conf"
  # END: Configuration for letsencrypt
  # BEGIN: Support domain renewal when using mod_proxy without Location
  <IfModule mod_proxy.c>
    ProxyPass /.well-known !
  </IfModule>
  # END: Support domain renewal when using mod_proxy without Location
  # BEGIN: Enable HTTP to HTTPS redirection
  RewriteEngine On
  RewriteCond %{HTTPS} !=on
  RewriteCond %{HTTP_HOST} !^localhost
  RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
  RewriteCond %{REQUEST_URI} !^/\.well-known
  RewriteRule ^/(.*) https://%{SERVER_NAME}/$1 [R,L]
  # END: Enable HTTP to HTTPS redirection
  # BEGIN: Enable non-www to www redirection
  RewriteCond %{HTTP_HOST} !^www\. [NC]
  RewriteCond %{HTTP_HOST} !^localhost
  RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
  RewriteCond %{REQUEST_URI} !^/\.well-known
  RewriteRule ^(.*)$ http://www.%{HTTP_HOST}%{REQUEST_URI} [R=permanent,L]
  # END: Enable non-www to www redirection
    WSGIScriptAlias / /opt/bitnami/projects/referralfirst/referralfirst/wsgi.py
    Alias /static "/opt/bitnami/projects/referralfirst/static

    <Directory /opt/bitnami/projects/referralfirst>
        AllowOverride all
        Require all granted
        Options FollowSymlinks
    </Directory>

    DocumentRoot /opt/bitnami/projects/referralfirst
  # BEGIN: Support domain renewal when using mod_proxy within Location
  <Location /.well-known>
    <IfModule mod_proxy.c>
      ProxyPass !
    </IfModule>
  </Location>
  # END: Support domain renewal when using mod_proxy within Location
</VirtualHost>

Include "/opt/bitnami/apache/conf/bitnami/bitnami-ssl.conf"

bitnami-ssl.conf

# Default SSL Virtual Host configuration.

<IfModule !ssl_module>
  LoadModule ssl_module modules/mod_ssl.so
</IfModule>

Listen 443
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384 EECDH+ECDSA+SHA256 EECDH+aRSA+SHA384 EECDH+aRSA+SHA256 EECDH !aNULL !eNULL !LOW !3DES !MD5 !EXP !PSK !SRP !DSS !EDH !RC4"
SSLPassPhraseDialog  builtin
SSLSessionCache "shmcb:/opt/bitnami/apache/logs/ssl_scache(512000)"
SSLSessionCacheTimeout  300

<VirtualHost _default_:443>
  DocumentRoot "/opt/bitnami/apache/htdocs"
  SSLEngine on
  SSLCertificateFile "/opt/bitnami/apache/conf/findreferral.link.crt"
  SSLCertificateKeyFile "/opt/bitnami/apache/conf/findreferral.link.key"

  # BEGIN: Configuration for letsencrypt
  Include "/opt/bitnami/apps/letsencrypt/conf/httpd-prefix.conf"
  # END: Configuration for letsencrypt
  # BEGIN: Support domain renewal when using mod_proxy without Location
  <IfModule mod_proxy.c>
    ProxyPass /.well-known !
  </IfModule>
  # END: Support domain renewal when using mod_proxy without Location
  # BEGIN: Enable non-www to www redirection
  RewriteEngine On
  RewriteCond %{HTTP_HOST} !^www\. [NC]
  RewriteCond %{HTTP_HOST} !^localhost
  RewriteCond %{HTTP_HOST} !^[0-9]+.[0-9]+.[0-9]+.[0-9]+(:[0-9]+)?$
  RewriteCond %{REQUEST_URI} !^/\.well-known
  RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [R=permanent,L]
  # END: Enable non-www to www redirection
  <Directory "/opt/bitnami/apache/htdocs">
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
  </Directory>

  # Error Documents
  ErrorDocument 503 /503.html
  # BEGIN: Support domain renewal when using mod_proxy within Location
  <Location /.well-known>
    <IfModule mod_proxy.c>
      ProxyPass !
    </IfModule>
  </Location>
  # END: Support domain renewal when using mod_proxy within Location
</VirtualHost>

Upvotes: 1

Views: 288

Answers (1)

Raghav
Raghav

Reputation: 21

I tried what Nagaraj Tantri said in the comments and it working for me! This is how my bitnami-ssl.conf looks like.

...

<VirtualHost _default_:443>
WSGIScriptAlias / /opt/bitnami/projects/PROJECT/PROJECT/wsgi.py

DocumentRoot "/opt/bitnami/projects/PROJECT"

...

<Directory "/opt/bitnami/projects/PROJECT">
   Options Indexes FollowSymLinks
   AllowOverride All
   Require all granted
</Directory>

...

Upvotes: 1

Related Questions