0

I've just setup Apache 2.2.18 with mod_ssl enabled and its configured to listen to one IP address on port 443. There are many domains with A DNS record poiting to this IP address. But I want to configure Apache with "VirtualHost"s for specific domains with their DocumentRoot.

My config in httpd.conf is this:

Listen          1.2.3.4:443
NameVirtualHost 1.2.3.4:443

<VirtualHost 1.2.3.4:443>
  DocumentRoot /data/www/domain.com
  ServerName www.domain.com
  SSLEngine On
</VirtualHost>

However, my problem and question is, that this Apache is using this VirtualHost for ANY domain pointing to the same IP address. It looks like its ignoring the "ServerName" parameter. I want to run this SSL-Apache only on specific domains. Anybody can help ?

2 Answers 2

3

This happens because of the way SSL works. To understand this, you first need to know what actually happens when you're requesting a page from a website.

A quick summary for a request of https://example.com/:

  1. You connect with the IP 1.2.3.4 on port 443
  2. SSL handshake and key exchange. Here, the certificate comes in play
  3. The actual data is sent encrypted:

    GET / HTTP/1.1
    Host: www.example.com
    

    The issue is, the domain www.example.com will be known after the certificate has been determined.

A solution would be SNI in which the Host header field is send before the SSL handshake. This is a relative new technology which may not be supported by all browsers.

4
  • Ok, so now I am little confused... So is it possible to run VirtualHosts in SSL enabled Apache ? From your answer it almost seems as it is not possible as I am trying to do...
    – Frodik
    May 15, 2011 at 8:35
  • It IS possible, but if you've visitors using old iPhones (1G) or IE7 on XP, the SNI solution would not work. For company websites (intranet), it might be acceptable if you've control over the browser that will be used.
    – Lekensteyn
    May 15, 2011 at 8:40
  • Oh, so better would be the domain I want to be accessible by SSL to configure it on custom IP address where no other domain would be used, right ?
    – Frodik
    May 15, 2011 at 8:45
  • @Frodik: if that's within your abilities, yes, use custom IP addresses for each SSL domain.
    – Lekensteyn
    May 15, 2011 at 8:55
0

Normally, SSL are established BEFORE any communication in.

HTTP protocol tells what servername IN communcation via Host: header.

So, SSL established BEFORE known what hostname are requestsed.

To make sure SSL cert are accepted by almost browsers, you should do one of following things:

  1. Create Wildcard SSL. Then, all requests to *.somedomain.com will be accepted by browser.

  2. Create SSL cert with all required you domain names as alternatives in "Subject Alternative Name". Working not for all browsers, but for most major.

  3. Use SNI: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI that works again in major browsers... F.e. our best friend IE6 doesn't support SNI.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .