<div dir="ltr">Hi everyone,<div><br></div><div>I have what I hope is a simple question with a simple answer that I'm just overlooking. I have a need to temporarily put our application in maintenance mode, and display a static page from our web server stating that the application is temporarily unavailable.</div><div><br></div><div>The Web Server is Apache 2.2, and it contains Include lines for rewrite.conf and nss.conf.</div><div><br></div><div>Here are those files respectively.</div><div><br></div><div>rewrite.conf</div><div><br></div><div><div># When maintenance mode is enabled, ALL requests are redirected to the</div><div># maintenance page, except for the page itself and the images on the page.</div><div><br></div><div>RewriteEngine on</div><div><br></div><div>RewriteCond %{REQUEST_METHOD} ^TRACE</div><div>RewriteRule .* - [F]</div><div><br></div><div>RewriteCond %{SERVER_PROTOCOL} !https</div><div>RewriteCond %{REQUEST_URI} !^/favicon.ico</div><div>RewriteCond %{REQUEST_URI} !^/dseLogo.png</div><div>RewriteCond %{REQUEST_URI} !^/maintenance.html$</div><div>RewriteRule ^/(.*)$ <a href="https://testweb01.novetta.com/maintenance.html">https://testweb01.novetta.com/maintenance.html</a> [L,R]</div><div><br></div><div><br></div><div>nss.conf</div><div><br></div><div><div>Listen 443</div><div><br></div><div>AddType application/x-x509-ca-cert .crt</div><div>AddType application/x-pkcs7-crl .crl</div><div><br></div><div>NSSPassPhraseDialog file:/etc/httpd/.password.conf</div><div>#NSSPassPhraseDialog builtin</div><div><br></div><div>NSSPassPhraseHelper /usr/sbin/nss_pcache</div><div><br></div><div>NSSSessionCacheSize 10000</div><div>NSSSessionCacheTimeout 100</div><div>NSSSession3CacheTimeout 86400</div><div>NSSSessionTickets off</div><div><br></div><div>NSSRandomSeed startup builtin</div><div><br></div><div><br></div><div><VirtualHost _default_:443></div><div><br></div><div>DocumentRoot "/var/www/docroot"</div><div>NSSProxyCheckPeerCN Off</div><div>NSSEngine on</div><div>NSSProxyEngine on</div><div>NSSEnforceValidCerts off</div><div>NSSRenegotiation on</div><div>NSSRequireSafeNegotiation on</div><div><br></div><div>NSSCipherSuite +rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha</div><div><br></div><div>NSSProxyCipherSuite +rsa_3des_sha,-rsa_des_sha,-rsa_rc4_40_md5,-rsa_rc2_40_md5,-rsa_null_md5,-rsa_null_sha,+fips_3des_sha,-fips_des_sha,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,-rsa_des_56_sha,-rsa_rc4_56_sha,+rsa_aes_128_sha,+rsa_aes_256_sha</div><div><br></div><div>NSSProtocol TLSv1</div><div>NSSNickname Server-Cert</div><div>NSSCertificateDatabase /etc/httpd/alias</div><div>NSSFIPS on</div><div>NSSOCSP off</div><div><br></div><div>ProxyPreserveHost On</div><div><br></div><div><br></div><div><Location /></div><div>NSSRenegBufferSize 26214400</div><div> NSSVerifyClient optional</div><div> NSSOptions +ExportCertData +StdEnvVars</div><div> ProxyPass <a href="https://testweb01.novetta.com/maintenance.html">https://testweb01.novetta.com/maintenance.html</a></div><div> ProxyPassReverse <a href="https://testweb01.novetta.com/maintenance.html">https://testweb01.novetta.com/maintenance.html</a></div><div></Location></div><div><br></div><div><Files ~ "\.(cgi|shtml|phtml|php3?)$"></div><div> NSSOptions +StdEnvVars</div><div></Files></div><div><Directory "/var/www/cgi-bin"></div><div> NSSOptions +StdEnvVars</div><div></Directory></div><div><br></div><div><br></div><div># initialize the SSL headers to a blank value to avoid http header forgeries</div><div>RequestHeader set SSL_CLIENT_CERT ""</div><div>RequestHeader set SSL_CIPHER ""</div><div>RequestHeader set SSL_SESSION_ID ""</div><div>RequestHeader set SSL_CIPHER_USEKEYSIZE ""</div><div><br></div><div>RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"</div><div>RequestHeader set SSL_CIPHER "%{SSL_CIPHER}s"</div><div>RequestHeader set SSL_SESSION_ID "%{SSL_SESSION_ID}s"</div><div>RequestHeader set SSL_CIPHER_USEKEYSIZE "%{SSL_CIPHER_USEKEYSIZE}s"</div><div><br></div><div>CustomLog /var/log/httpd/ssl_request_log "%t %h %{SSL_CLIENT_CERT}x %{SSL_CLIENT_S_DN}x %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"</div><div><br></div><div><br></div><div>ErrorLog /etc/httpd/logs/error_log</div><div>TransferLog /etc/httpd/logs/access_log</div><div>LogLevel info</div></div><div><br></div><div>Finally, here is the maintenance page in docroot</div><div><br></div><div><div><html></div><div><head></div><div><title>DoD Data Services Environment Maintenance</title></div><div></head></div><div><body><font face="Arial"></div><div> <center></div><div> <p></div><div> <img src=dseLogo.png><br></div><div> <br></div><div> The Data Services Environment is temporarily unavailable while site maintenance is being performed.</div><div> <br></div><div> <br></div><div> <br></div><div> </p></div><div> </center></div><div></font></body></div><div></html></div></div><div><br></div><div>What I'm getting in the error log when I try to bring this up in a browser is the following.</div><div><br></div><div><div>[Sat Mar 26 05:11:22 2016] [info] Connection to child 5 established (server <a href="http://testweb01.novetta.com:443">testweb01.novetta.com:443</a>, client x.x.16.58)</div><div>[Sat Mar 26 05:11:23 2016] [info] Initial (No.1) HTTPS request received for child 5 (server <a href="http://testweb01.novetta.com:443">testweb01.novetta.com:443</a>)</div><div>[Sat Mar 26 05:11:23 2016] [info] Requesting connection re-negotiation</div><div>[Sat Mar 26 05:11:26 2016] [info] Connection to child 0 established (server <a href="http://testweb01.novetta.com:443">testweb01.novetta.com:443</a>, client x.x.238.91)</div><div>[Sat Mar 26 05:11:26 2016] [info] Connection to child 3 established (server <a href="http://testweb01.novetta.com:443">testweb01.novetta.com:443</a>, client x.x.238.91)</div><div>[Sat Mar 26 05:11:26 2016] [info] SSL input filter read failed.</div><div>[Sat Mar 26 05:11:26 2016] [error] SSL Library Error: -12195 Peer does not recognize and trust the CA that issued your certificate</div><div>[Sat Mar 26 05:11:26 2016] [info] Connection to child 3 closed (server <a href="http://testweb01.novetta.com:443">testweb01.novetta.com:443</a>, client x.x.238.91)</div><div>[Sat Mar 26 05:11:26 2016] [info] SSL library error -8172 writing data</div><div>[Sat Mar 26 05:11:26 2016] [info] SSL Library Error: -8172 Certificate is signed by an untrusted issuer</div><div>[Sat Mar 26 05:11:26 2016] [error] (20014)Internal error: proxy: pass request body failed to <a href="http://10.3.238.91:443">10.3.238.91:443</a> (<a href="http://testweb01.novetta.com">testweb01.novetta.com</a>)</div><div>[Sat Mar 26 05:11:26 2016] [error] proxy: pass request body failed to x.x..238.91:443 (<a href="http://testweb01.novetta.com">testweb01.novetta.com</a>) from x.x.16.58 ()</div><div>[Sat Mar 26 05:11:26 2016] [info] Connection to child 5 closed (server...</div></div><div><br></div><div>I have tried this with :443 for the port in the nss.conf ProxyPass and ProxyPassReverse statements, but it still doesn't work. Any ideas?</div><div class="gmail_signature"><div dir="ltr"><p dir="ltr" style="font-family:'Lucida Grande','Lucida Sans',Verdana,Arial,sans-serif;font-size:13.3333px;line-height:1.2;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(147,149,152);font-family:Helvetica,sans-serif;vertical-align:baseline;white-space:pre-wrap"></span></p><table style="color:rgb(147,149,152);font-family:sans-serif;font-size:medium"><tbody><tr></tr><tr></tr><tr></tr></tbody></table><br> </div><div>Thanks,</div><div><br></div><div>Larry Cohen</div></div> </div></div>