且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

Mod_wsgi https错误连接被拒绝

更新时间:2022-05-21 21:25:31

您需要指定-server-name 选项,以及使用https地址可访问的站点名称.该名称应与设置SSL证书时使用的名称相匹配.

You need to specify the --server-name option with the name of the site it is accessible as using the https address. This should match the name the SSL certificates have been set up with.

python manage.py runmodwsgi --host 0.0.0.0 --port 8000 --https-port 8001 --ssl-certificate /path/to/cert/and/key --server-name host.example.com

然后您将使用带有FQDN的URL对其进行访问:

You would then access it using the URL with the FQDN:

https://host.example.com:8001

如果希望能够从本地主机(同一系统)访问它而无需提供FQDN主机名,则可以使用-allow-localhost 选项.

If you want to be able to access it from localhost (same system) without needing to provide a FQDN host name, you would use the --allow-localhost option.

python manage.py runmodwsgi --host 0.0.0.0 --port 8000 --https-port 8001 --ssl-certificate /path/to/cert/and/key --server-name host.example.com --allow-localhost

对于后者,即使使用正式证书作为主机名,您也会收到浏览器警告,说明证书不匹配.对于wget和curl等命令行HTTP工具,在这种情况下,您必须告诉他们这是一个不安全的站点.

With the latter, even if using an official certificate for the hostname, you will get the browser warning about certificate not matching. For command line HTTP tools like wget and curl you would have to tell them it is an insecure site in these cases.

这是因为这违背了通常使用HTTPS和SSL证书的方式,仅出于测试目的才允许从本地主机访问除正确服务器名称以外的名称.

It is because it is going against how HTTPS and SSL certificates would normally be used, access by name other than the proper server name is only allowed from localhost for testing purposes.

简而言之,在使用HTTPS时,实际上应该在访问站点时始终使用正确的主机名而不是IP地址.如有必要,可以在系统的主机服务文件中创建虚拟主机映射.

In short, when using HTTPS, you should really always be using a proper host name and not an IP address when accessing the site. If necessary you can create a dummy host mapping in host service file for your system.

例如,在/etc/hosts 文件中,您可以添加:

For example, in a /etc/hosts file you could add:

127.0.0.1       host.example.com

有关更多信息,建议您使用mod_wsgi邮件列表.我不习惯在这里闲逛或在此处回答有关mod_wsgi的问题,而这个问题很偶然地引起了我的注意.

For further information it is recommended that you use the mod_wsgi mailing list. I don't as a habit hang out here or answer questions about mod_wsgi here any more and it was by chance this question came to my attention.