3

I need configure multiple SSL certificates on a single Apache server. I already know that I need multiple external IP addresses as I cannot use SNI (only running Apache 2.2.3 on this server).

I assumed that I had everything configured correctly, unfortunately things are not working as they should (or maybe I should say, as I expected them to work)...

In my httpd.conf I have:

NameVirtualHost *:80
NameVirtualHost *:443

Lets say my public IP is 12.0.0.1 and my private IP is 192.168.0.1.

When I use the public IP in my vhost my default website is being shown instead the one defined in my vhost, e.g.:

<VirtualHost 12.0.0.1:443>
   ServerAdmin [email protected]

   ServerName blablabla.site.com

   DocumentRoot /data/sites/blablabla.site.com

   ErrorLog /data/sites/blablabla.site.com-error.log
   #CustomLog /data/sites/blablabla.site.com-access.log common

   SSLEngine On
   SSLCertificateFile /etc/httpd/conf/ssl/blablabla.site.com.crt
   SSLCertificateKeyFile /etc/httpd/conf/ssl/blablabla.site.com.key
   SSLCertificateChainFile /etc/httpd/conf/ssl/blablabla.site.com.ca-bundle

   <Location />
       SSLRequireSSL On
       SSLVerifyDepth 1
       SSLOptions +StdEnvVars +StrictRequire
   </Location>

</VirtualHost>

When I use the private IP in my vhost everything works as it should (the website defined in my vhost is being shown), e.g.:

<VirtualHost 192.168.0.1:443>
...same as above...
</VirtualHost>

My server is listening on all interfaces:

[root@grbictwebp02 httpd]# netstat -tulpn | grep :443
tcp        0      0 0.0.0.0:443                 0.0.0.0:*                   LISTEN      5585/httpd

What am I doing wrong? If I cannot get this to work I cannot continue to add the second SSL certificate on the other public IP...

If more information is required just let me know!

Improve this question

3 Answers 3

Reset to default
1

You need to be configuring your virtual hosts with the IP addresses bound to the server.

It sounds like you have a NAT device that's translating your public IP to a private IP that your server has assigned to a network interface. After the NAT occurs, there's no record in that packet of the public IP, so the mapping needs to occur on your private IPs.

(If you have both public IPs NATing to the same private IP, you'll need to change that - have a different private IP per public IP.)

Improve this answer
5
  • Did not think of that, I was too focussed on finding an error in my config files ;-) But I am pretty sure that this is indeed what is happening. Will have a chat with the network people here. Many thanks!
    – St. Even
    Dec 18, 2012 at 8:04
  • I find this unlikely. The traffic is actually arriving at the server, even when St Even connects to the outside interface. The thing is that once the connection goes through, the wrong virtual host is chosen. This points to a config issue, not a network issue.
    – Jenny D
    Dec 18, 2012 at 13:39
  • @JennyD Not sure what you mean? I agree that it's a config issue, but in addition, a configuration where two public IPs are NATed to the same private IP won't ever successfully support IP-based virtual hosting.
    – Shane Madden
    Dec 19, 2012 at 2:25
  • Shane, I see what you mean now. But there's no information in the post that tells us whether the IP address is in fact NATed or not, or if so whether it arrives on the same interface as the "private" one or not.
    – Jenny D
    Dec 19, 2012 at 7:35
  • @JennyD Fair enough - I interpreted it that way on the first read, but you're right, it's not necessarily the case.
    – Shane Madden
    Dec 19, 2012 at 16:50
1

What do you mean when you say 'not working'? Any errors in the Apache error log? Please post the complete VirtualHost declaration.

State your question as: "I did the following steps, added the following configuration here, then did this, and I would have expected it to do this. But it says this. What's wrong?" The clearer you write your post the bigger the chance of you finding the answer yourself as well.

Improve this answer
1

You should start by removing the 

NameVirtualHost

lines. NameVirtualHost is used for when you use the hostnames to separate the virtual hosts - since you're not doing that, you should remove those lines. You also need to specify the port for your virtual hosts, like this:

<VirtualHost 192.168.0.1:443>

The reason that your private host works, but not the public one, is that when you're using NameVirtualHosts and your server can't be sure which host you want, it will always use the first one listed because that's the default.

Improve this answer
3
  • My bad, I forgot to type the :443 in my original question (I did not copy/paste the data). In my actual vhosts those ports are specified. And my question has been edited....
    – St. Even
    Dec 18, 2012 at 8:18
  • It's not a good idea to re-type the data, it's too easy to miss important information.
    – Jenny D
    Dec 18, 2012 at 9:08
  • Another matter - there's no reason to put the SSLRequire within a Location entry, unless you want it to be on for only part of the site. Since your Location specifies "/", I'm assuming that's not the case.
    – Jenny D
    Dec 18, 2012 at 9:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .