0

I have mass virtual hosting set up on one of our servers allowing me to basically create a symlink in a certain directory and immediately have that host available on both http as well as https. This works great if all of the hostnames are in the same domain (wildcard certificate) but not otherwise. Let me show you my VirtualHost container:

<VirtualHost 1.2.3.4:443>
    SSLEngine on
    SSLProtocol all -SSLv2
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

    ### Mass SSL Vhosts ###
    RewriteEngine on

    #   define two maps: one for fixing the URL and one which defines
    #   the available virtual hosts with their corresponding
    #   DocumentRoot.
    RewriteMap    lowercase    int:tolower

    #   2. make sure we have a Host header
    RewriteCond   %{HTTP_HOST}  !^$

    #   3. lowercase the hostname
    RewriteCond   ${lowercase:%{HTTP_HOST}|NONE}  ^(.+)$

    #   5. finally we can map the URL to its docroot location
    #      and remember the virtual host for logging puposes
    RewriteRule ^/(.*)$ /wwwroot/vhosts/%{HTTP_HOST}/$1 [E=VHOST:${lowercase:%{HTTP_HOST}}]

    <Directory "/wwwroot/vhosts/">
        Options FollowSymLinks
        AllowOverride All
    </Directory>
    <Files ~ "\.(cgi|shtml|phtml|php3?)$">
        SSLOptions +StdEnvVars
    </Files>
    <Directory "/var/www/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>

    ErrorLog /var/log/httpd/ssl_error_log
    TransferLog /var/log/httpd/ssl_access_log
    LogLevel warn

    SSLCertificateFile /etc/pki/tls/certs/wildcard.foo.com.crt
    SSLCACertificateFile /etc/pki/tls/certs/wildcard.foo.com.intermediate.crt
    SSLCertificateKeyFile /etc/pki/tls/private/www.foo.com.key

    SetEnvIf User-Agent ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
    CustomLog logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

This setup works anytime I want to create a something.foo.com domain. I just create a symbolic link in /wwwroot/vhosts to a user's directory and bam it works. I now want to create a something.bar.com domain. Once again, I can just create it and drop it in and http://something.bar.com will work. What I cannot get working however, is https://something.bar.com because of the explicitly defined certificates above.

Is there any way to branch inside the VirtualHost container to use different SSL certificates depending on the hostname?

1 Answer 1

2

Have you looked into SNI (Server Name Indication)? E.g. with mod_ssl or mod_gnutls:

4
  • Yes, the problem is: "SNI has only recently gained support in browsers. The browsers that have been confirmed to support SNI are: Opera 8.0+, Firefox 2+, Internet Explorer 7+, Safari 3.2.1+, Chrome (NOT Chromium) ((Chromium 11.0.696.28 seems to do sni fine -mt))"
    – Vic
    Jun 25, 2011 at 19:49
  • I'm curious-- what happens if someone visits the site using IE6?
    – Vic
    Jun 25, 2011 at 19:53
  • SNI in older browsers (i.e. IE6) won't work... It's called progress. ;-)
    – Henk
    Jun 25, 2011 at 20:53
  • So I guess people with older browsers will see the very first virtual host? I agree that it's progress, however there are plenty of corporate IT environments where the update cycle hasn't caught up to progress because of bureaucratic nonsense.
    – Vic
    Jun 25, 2011 at 21:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .