2

I have two different sites in one server: a.com and b.com.

If I use named virtualhost on ssl port, IE won't work.

So, I decided to use port 444 for SSL for b.com. However, it seems all browsers give error message:

Chrome: Error 107 ssl protocol error
Firefox: Error code: ssl_error_rx_record_too_long
Epiphany: SSL handshake failed

Umm.. I don't know why, but I do have seen some web sites can be accessed like https://example.com:1443.

Or did I miss something?


ports.conf:

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    NameVirtualHost *:443
    NameVirtualHost *:444
    Listen 443
    Listen 444
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
    Listen 444
</IfModule>

b.site:

<VirtualHost *:444>
    ServerName  www.b.com:444
    ServerAdmin [email protected]

    LogLevel  error
    ErrorLog  /var/log/apache2/b_error.log
    CustomLog /var/log/apache2/b_access.log combined

    DocumentRoot ...

    <Directory ...>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/b.crt
    SSLCertificateKeyFile /etc/ssl/private/b.pem

</VirtualHost>

CA config file to generate the certificate:

[ca]
default_ca              = CA_default

[CA_default]
x509_extensions         = root_ca_extensions

[req]
default_bits            = 4096
default_keyfile         = 
distinguished_name      = req_distinguished_name
attributes              = req_attributes
prompt                  = no
x509_extensions         = v3_ca
req_extensions          = v3_req

[req_distinguished_name]
C     = ...
ST   = ..
O     = ...
OU   = ..
CN   = ...
emailAddress        = [email protected]

[req_attributes]

[root_ca_extensions]
basicConstraints        = CA:true

[v3_ca]
basicConstraints        = CA:true

[v3_req]
basicConstraints        = CA:false
keyUsage                = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName          = @alt_names

[alt_names]
DNS.1 = b.com
DNS.2 = www.b.com
3

2 Answers 2

1

The answer is yes.

It's my mistake, I have setup 127.0.0.1 www.b.com in the /etc/hosts. Then, however I change the apache config files in the remote server, my browser always resolves www.b.com to my localhost, where there is a broken certificate.

0

Not 100% sure if this is the problem.. but try to remove the :444 from the ServerName line so it looks like

ServerName  www.b.com

The port isn't needed since the browser connects on that port but the host header will still be www.b.com no matter what port is used..

2
  • I've just added the port number to see if it works. So, no luck whether or not there is a port number.
    – Lenik
    Jun 7, 2012 at 2:34
  • generally when I see this it means the browser is talking https on a http port. Is there anything in the error log for the main server or the vhost on startup or connection?
    – Mike
    Jun 7, 2012 at 2:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .