Deploy Django app on Apache server on CentOS 7 - django

Question

I am following this article to deploy a Django app on Apache in CentOS 7.
I have some differences compared to that article:
1 - I used port 443 for https (my machine already has port 443 open with my_app_dns)
2 - My virtual host config file /etc/httpd/conf.d/django.conf is as following:
<VirtualHost *:80>
ServerAdmin xxx#xxx.com
ServerName my_app_dns
DocumentRoot /home/centos/path_to_my_app
Alias /static /home/centos/path_to_my_app/static
<Directory /home/centos/path_to_my_app/static>
Require all granted
</Directory>
#ErrorLog /logs/apis_error.log
#CustomLog /logs/apis_access.log combined
WSGIPassAuthorization On
WSGIDaemonProcess my_app python-path=/home/centos/path_to_my_app:/home/centos/.local/share/virtualenvs/my_app-8BiokhAz/lib/python3.9/site-packages
WSGIProcessGroup my_app
WSGIScriptAlias / /home/centos/path_to_my_app/wsgi.py
<Directory /home/centos/path_to_my_app>
<Files wsgi.py>
Require all granted
</Files>
</Directory>
</VirtualHost>
3 - My app uses Postgres database instead of SQlite3.
The DocumentRoot is set to /var/www in /etc/httpd/conf/httpd.conf. I have also set up self-signed SSL certificate with the file etc/httpd/conf.d/ssl.conf). Below is some of the content of the ssl.conf file:
Listen 443 https
...
<VirtualHost _default_:443>
DocumentRoot "/var/www"
ServerName my_app_dns:443
...
SSLEngine on
SSLCertificateFile /etc/ssl/certs/apache-selfsigned.crt
...
</VirtualHost>
With the above setup, when I go to https://my_app_dns, I see the sample Apache Test page.
If I change <VirtualHost *:80> to <VirtualHost *:443> in the file /etc/httpd/conf.d/django.conf, going to https://my_app_dns yields this error:
my_app_dns sends an invalid response
ERR_SSL_PROTOCOL_ERROR
In folder /etc/httpd/conf.d/, I have two files : ssl.conf and django.conf. Both of these define virtual hosts. It seems only the config in ssl.conf takes effect and not the file django.conf).
I followed this article for the SSL setup.
What am I missing in this setup sequence in order to deploy the Django app content instead of the Apache Test page?
Update:
Following #Lingyan Meng's comment, I transfer the django.conf virtual host info to the ssl.conf virtual host and delete django.conf. After restarting my webpage, I see this error on the browser:
Internal Server Error
The server encountered an internal error or misconfiguration and was unable to complete your request.
Please contact the server administrator at root#localhost to inform them of the time this error occurred, and the actions you performed just before this error.
More information about this error may be available in the server error log.
So I checked a few log files for clues. In this log file, /var/log/httpd/ssl_error_log, I see the following error:
[Wed Oct 13 22:37:05.642226 2021] [ssl:warn] [pid 2526] AH01906: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Wed Oct 13 22:37:05.697737 2021] [ssl:warn] [pid 2526] AH01906: RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Wed Oct 13 22:37:11.890802 2021] [mime_magic:error] [pid 2531] [client xxx.x.xxx.xx:62352] AH01512: mod_mime_magic: can't read `/home/centos/path_to_my_app/my_app/wsgi.py'
[Wed Oct 13 22:37:11.891123 2021] [mime_magic:error] [pid 2531] [client xxx.x.xxx.xx:62352] AH01512: mod_mime_magic: can't read `/home/centos/path_to_my_app/my_app/wsgi.py'
[Wed Oct 13 22:37:11.899659 2021] [:error] [pid 2527] (13)Permission denied: [remote xx.x.xx.xx:116] mod_wsgi (pid=2527, process='my_app', application='my_app_dns|'): Call to fopen() failed for '/home/centos/path_to_my_app/my_app/wsgi.py'.
[Wed Oct 13 22:37:12.185359 2021] [mime_magic:error] [pid 2532] [client xx.x.xx.xx:51889] AH01512: mod_mime_magic: can't read `/home/centos/path_to_my_app/my_app/wsgi.py', referer: https://my_app_dns/
I found a thread with a similar problem here. The suggested solution was to change the ownership of my_app folder. So I did this:
sudo chown -R apache:apache ~/path_to_myapp
Then, I verify it with:
ls -l ~/path_to_my_app
which shows:
drwxrwxr-x. 2 apache apache 89 Oct 8 21:33 my_app
-rwxrwxr-x. 1 apache apache 661 Oct 7 19:57 manage.py
drwxrwxr-x. 3 apache apache 19 Oct 8 21:59 static
So, server apache now owns the folder. But when I restart the server, I still see the same error message in ssl_error_log file.
Also, below is the full content of my /etc/httpd/conf.d/ssl.conf
Listen 443 https
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout 300
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
<VirtualHost _default_:443>
DocumentRoot "/home/centos/path_to_my_app"
ServerName my_app_dns
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLCertificateFile /etc/ssl/certs/apache-selfsigned.crt
SSLCertificateKeyFile /etc/ssl/private/apache-selfsigned.key
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
Alias /static /home/centos/path_to_my_app/static
<Directory /home/centos/path_to_my_app/static>
Options FollowSymLinks
Order allow,deny
Allow from all
Require all granted
</Directory>
WSGIPassAuthorization On
WSGIDaemonProcess my_app python-path=/home/centos/path_to_my_app:/home/centos/.local/share/virtualenvs/my_app-8BiokhAz/lib/python3.9/site-packages
WSGIProcessGroup my_app
WSGIScriptAlias / /home/centos/path_to_my_app/my_app/wsgi.py
<Directory /home/centos/path_to_my_app/my_app>
<Files wsgi.py>
Require all granted
</Files>
</Directory>
BrowserMatch "MSIE [2-5]" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
SSLCipherSuite EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
Header always set Strict-Transport-Security "max-age=63072000; includeSubdomains"
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff
SSLCompression off
SSLUseStapling off
SSLStaplingCache "shmcb:logs/stapling-cache(150000)"
If someone could advise what is going on?

Answer 1

You may remove the django.conf, and move your settings in VirualHost in django.conf into ssl.conf and try again.