1

So I have multiple IP's on one server and for each IP I have a SSL website configured. This is working fine.

However I server a number of non-SSL sites on the primary IP. The problem occurs when a user tries to visit the https version of one of these non-https websites. They are presented with the certificate for the main SSL website and then if they accept it they are forwarded to the https website.

What would be the best way to deal with this? I have tried to set up an apache default ssl host to catch these other requests but it doesn't seem to work. Maybe some redirect logic to forward requests not for the default ssl domain to the non https versions of the requested site? Any ideas are appreciated.

1 Answer 1

3

The SSL handshake happens before the HTTP, so the redirect logic will not be invoked before the user is presented with an SSL warning in the browser.

The only way to keep that warning from happening is to have a certificate that presents with the servernames used by those vhosts, using, say, Subject Alternate Name, or Server Name Indication. This way, the SSL handshake happens without issue, and you can redirect after that. But, whatever you do, you will need a valid certificate for those non-SSL sites.

The other way is to get another IP address for the non-SSL sites, and vhost on that. Basically, you need to separate the non-SSL sites from the SSL sites. That way, a user won't be accidentally going to the SSL vhost and seeing the browser warning. On the other hand, the user will just get a timeout, as the SSL port is not available for the non-SSL site.

A third way is to not care about people going to the SSL host if they're trying to get to a non-SSL site. This is perhaps the cheapest and least effort option, but it may not be available to you.

2
  • 2
    Careful about SNI though. Windows XP does not support it and there are still many users on XP. Jan 7, 2013 at 13:38
  • Ok thanks. I think the separate IP will have to be the solution.
    – b3n
    Jan 8, 2013 at 21:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .