Be part of JetBrains PHPverse 2026 on June 9 – a free online event bringing PHP devs worldwide together.

insight's avatar

After SSL my site URL not working shows 403 Forbidden . How to fix it ?

Dear Friends, I am using Laravel 10, Apache, RHEL server hosting. Before getting domain I use a private IP to develop the application in staging server. On that time the URL http://10.5.92.128/ksrtcCareers/public/index.php/Vacancies/ works fine. But after make a domain and put SSL I got 403 (Forbidden) error for URL https://careers-ksrtc.karnataka.gov.in/ksrtcCareers/public/index.php/Vacancies/

I have 2 .htaccess files , one is in path /var/www/html/ksrtcCareers as below


RewriteEngine on
RewriteRule ^(phpmyadmin) - [L]
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://careers-ksrtc.karnataka.gov.in/ [R,L]
RewriteCond %{REQUEST_URI} !^public
RewriteRule ^(.*)$ public/ [L]

and also in /public path in /var/www/html/ksrtcCareers/public as below

<IfModule mod_rewrite.c>
    <IfModule mod_negotiation.c>
        Options -MultiViews -Indexes
    </IfModule>

    RewriteEngine On

    # Handle Authorization Header
    RewriteCond %{HTTP:Authorization} .
    RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

    # Redirect Trailing Slashes If Not A Folder...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_URI} (.+)/$
    RewriteRule ^ %1 [L,R=301]

    # Send Requests To Front Controller...
    RewriteCond %{REQUEST_FILENAME} !-d
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteRule ^ index.php [L]
</IfModule>

My .env File as

APP_NAME=Laravel
APP_ENV=production
APP_KEY=base64:7SBUI3aIXlVE9T2igKwVbKC07x2Ox2jtiUN2511XXXX=
APP_DEBUG=true
APP_URL=https://careers-ksrtc.karnataka.gov.in/ksrtcCareers
APP_ASSET_URL=https://careers-ksrtc.karnataka.gov.in/ksrtcCareers/assets
LOG_CHANNEL=stack
LOG_DEPRECATIONS_CHANNEL=null
LOG_LEVEL=debug
DB_CONNECTION=mysql
DB_HOST=localhost
DB_PORT=3306
DB_DATABASE=itdb
DB_USERNAME=careerman
DB_PASSWORD=Maria@2255

BROADCAST_DRIVER=log
CACHE_DRIVER=file
FILESYSTEM_DISK=local
QUEUE_CONNECTION=sync
SESSION_DRIVER=file
SESSION_LIFETIME=120
SESSION_SECURE_COOKIE=false

XSRF_LIFETIME=session

MEMCACHED_HOST=127.0.0.1

REDIS_HOST=127.0.0.1
REDIS_PASSWORD=null
REDIS_PORT=6379

MAIL_MAILER=smtp
MAIL_HOST=mailpit
MAIL_PORT=1025
MAIL_USERNAME=null
MAIL_PASSWORD=null
MAIL_ENCRYPTION=null
MAIL_FROM_ADDRESS="[email protected]"
MAIL_FROM_NAME="${APP_NAME}"

AWS_ACCESS_KEY_ID=
AWS_SECRET_ACCESS_KEY=
AWS_DEFAULT_REGION=us-east-1
AWS_BUCKET=
AWS_USE_PATH_STYLE_ENDPOINT=false

PUSHER_APP_ID=
PUSHER_APP_KEY=
PUSHER_APP_SECRET=
PUSHER_HOST=
PUSHER_PORT=443
PUSHER_SCHEME=https
PUSHER_APP_CLUSTER=mt1

VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
VITE_PUSHER_HOST="${PUSHER_HOST}"
VITE_PUSHER_PORT="${PUSHER_PORT}"
VITE_PUSHER_SCHEME="${PUSHER_SCHEME}"
VITE_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"

my httpd.conf file in path as /etc/httpd/conf as

#

ServerRoot "/etc/httpd"
Listen 80
Listen 443
Include conf.modules.d/*.conf
User apache
Group apache
ServerAdmin root@localhost
<Directory />
    AllowOverride none
    Require all denied
</Directory>

#DocumentRoot "/var/www/html/"
DocumentRoot "/var/www/html/ksrtcCareers/public/"

<Directory "/var/www/html/ksrtcCareers/public">
    Options Indexes FollowSymLinks
    AllowOverride All
    Require all granted
</Directory>


<Directory "/var/www">
    AllowOverride None
    Require all granted
</Directory>

<Directory "/var/www/html">
    Options -Indexes -FollowSymLinks +SymLinksIfOwnerMatch
    AllowOverride None
    Require all granted
</Directory>

<IfModule dir_module>
    DirectoryIndex index.html index.php
</IfModule>

#<Files ".ht*">
#    Require all denied
#</Files>

ErrorLog "logs/error_log"

LogLevel warn

<IfModule log_config_module>
    
    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common

    <IfModule logio_module>
         LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    </IfModule>
    CustomLog "logs/access_log" combined
</IfModule>

<IfModule alias_module>
    ScriptAlias /cgi-bin/ "/var/www/cgi-bin/"
</IfModule>

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>

<IfModule mime_module>
    TypesConfig /etc/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddType text/html .shtml
    AddOutputFilter INCLUDES .shtml
</IfModule>

AddDefaultCharset UTF-8

<IfModule mime_magic_module>
   MIMEMagicFile conf/magic
</IfModule>

EnableSendfile on

ServerTokens Prod
ServerSignature Off
Timeout 60
TraceEnable Off
KeepAlive On
MaxKeepAliveRequests 100
KeepAliveTimeout 15

<IfModule prefork.c>
StartServers       5
MinSpareServers    5
MaxSpareServers   20
ServerLimit      500
MaxClients       500
MaxRequestsPerChild  1000
</IfModule>

IncludeOptional conf.d/*.conf

<VirtualHost *:80>
    RewriteEngine On
    RewriteCond %{SERVER_PORT} 80
    RewriteRule ^(.*)$ https://careers-ksrtc.karnataka.gov.in [R,L]
    DocumentRoot /var/www/html/ksrtcCareers/public
    ServerName careers-ksrtc.karnataka.gov.in
    ServerAlias www.careers-ksrtc.karnataka.gov.in
</VirtualHost>


<VirtualHost *:443>
   DocumentRoot /var/www/html/ksrtcCareers/public
   SSLEngine On
   SSLCertificateFile   /etc/ssl/ksrtccareer/career.crt 
   SSLCertificateKeyFile /etc/ssl/ksrtccareer/career.key
   SSLCertificateChainFile /etc/ssl/ksrtccareer/career.ca.crt
   ServerName careers-ksrtc.karnataka.gov.in
   ServerAlias www.careers-ksrtc.karnataka.gov.in
<IfModule mod_security2.c>
SecRuleEngine Off
</IfModule>   
 <Directory /var/www/html/ksrtcCareers/public>
      AllowOverride All
   </Directory>
<FilesMatch \.php$>
    SetHandler "proxy:unix:/var/run/php-fpm-www.sock|fcgi://127.0.0.1:9000/"
</FilesMatch>
</VirtualHost>

My SSL Certificate works fine , but site is not working.

Please help

Thanks

Anes

0 likes
6 replies
Snapey's avatar

Why would you publicly post the details of your database?

insight's avatar

@Snapey all are placement values corresponding to my real web site. I could not post exact value openly here. So please help with the concept..

Thanks Anes

Snapey's avatar

@insight So why share it at all?

Its not relevant to the problem, your DNS does not have an entry for careers-ksrtc

insight's avatar
insight
OP
Best Answer
Level 2

I got the solution last , it's a Middleware blocking. As part of security auditing I block host based on IP's . But when put in domain it will block and got 403 Forbidden error. I changed the middleware function below

public function handle($request, Closure $next)
    {
        $allowedHosts = ['127.0.0.1:8000', '10.50.192.128'];

        if (!in_array($request->getHost(), $allowedHosts)) {
            abort(403);
        }

        return $next($request);
    }

as

public function handle($request, Closure $next)
    {
        $allowedHosts = ['careers-ksrtc.karnataka.gov.in'];

        if (!in_array($request->getHost(), $allowedHosts)) {
            abort(403);
        }

        return $next($request);
    }

The problem fixed. Thanks to all especially my collegue Aruna .

1 like

Please or to participate in this conversation.