1

I have foo.es site with a SSL wildcard certificate running since 2 years ago. Now I want to install another certificate for "**.foo.com*" in the same server. I've copied the new foo_com.crt and foo_com.key files to the new server and have added a new entry to ssl.conf:

<VirtualHost foo.com:443>
ServerAdmin [email protected]
DocumentRoot /var/www/foo.com/
Servername foo.com
ServerAlias www.foo.com

ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log

SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile /etc/httpd/ssl.crt/foo_com.crt
SSLCertificateKeyFile /etc/httpd/ssl.key/foo_com.key
SSLCertificateChainFile /etc/httpd/ca/sub.class2.server.ca.pem
SSLCACertificateFile /etc/httpd/ca/ca.pem

SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
CustomLog /usr/local/apache/logs/ssl_request_log \
      "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

With this, I expected to access to https://foo.com without any problem. Instead, the browser warns with a ssl_error_bad_cert_domain error code. When I've seen the certificate I found that the certificate common name is **.foo.es*, it is, the first certificate (note that I still have this certificate installed, I need both).

Apache error log says only this:

[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate wildcard CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate wildcard CommonName (CN) `*.foo.com' does NOT match server name!?

What's happening? Why the browser gets the foo.es certificate but the Apache log reports a problem with the foo.com cert?

Running: Apache/2.0.59 (Unix) mod_ssl/2.0.59 OpenSSL/0.9.8g on a Gentoo distro

Improve this question
3
  • 1
    Do the two hosts resolve to different IP addresses?
    – David Schwartz
    Jan 23, 2013 at 22:40
  • @DavidSchwartz No, the same IP address
    – Ivan
    Jan 23, 2013 at 22:52
  • 1
    Well there's your problem. How is it supposed to know which certificate to send to the client? (SNI is still unsupported by about 50% of browsers used on the Internet.) You need to either use different IPs, different ports, or get one certificate that covers both names.
    – David Schwartz
    Jan 23, 2013 at 22:53

1 Answer 1

Reset to default
3

Apache doesn't support SNI until version 2.2.12. Before this, Apache simply served the first certificate. After decrypting the request, it will still match the correct vhost.

If you only have one IP address, you will have to upgrade Apache. (Even if you do have more than one IP address, Apache has come a long way since 2.0.59. You really should upgrade unless you need the older version.)

Some browsers and operating systems don't support SNI either. If your website has visitors using one of the browsers that don't support SNI, you will have to look at getting a second IP address.

Improve this answer
3
  • SNI is still unsupported by a significant fraction of Internet browsers. Options are: 1) Use different ports. 2) Use different IP addresses. 3) Get one certificate that covers both names.
    – David Schwartz
    Jan 23, 2013 at 22:54
  • Option 3 is the most interesting for me. Thank you very much, I was going crazy with this. (I still upgrade Apache, thanks)
    – Ivan
    Jan 23, 2013 at 22:57
  • 1
    It depends on your traffic. My personal website gets practically no browsers that don't support SNI. The websites I run at work get about 10% - 15% browsers with no support. Getting a certificate that supports both names is a good idea that I totally forgot about. They are called SAN (Subject Alternative Name) certificates or UC (Unified Communication) certificates.
    – Ladadadada
    Jan 23, 2013 at 22:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .