0

My goal is to have multiple SSL sites on multiple IP address, but I'm struggling with the Apache setup:

// I want this:
http + https example.com
http + https example.net

// On these IPs:
http example.com 1.1.1.1:80
http example.net 1.1.1.1:80
https example.com 2.2.2.2:443
https example.net 3.3.3.3:443

Note that the DocumentRoot is different for all 4 sites.

In my current Apache setup, when a client visits https://example.com, Apache serves up 1.1.1.1 (connection refused, assume :443) instead of 2.2.2.2:443. The same is true with https://example.net (instead of 3.3.3.3:443). I assume this is because of my DNS a records for @ and www pointing to 1.1.1.1. The non-SSL 1.1.1.1 name-based-vhosts work fine.

I'm not sure if this is intended Apache behavior or not. So the core of my question is, "is this intended Apache behavior? If so, could someone give me an example of how the IPs should look in this situation? Should BOTH http and https example.com be on ONE IP instead of me splitting them up like this?"

My httpd.conf is like this right now:

# http example.com and http example.net:
Listen 1.1.1.1:80
# https example.com:
Listen 2.2.2.2:443
# https example.net:
Listen 3.3.3.3:443

NameVirtualHost *:80

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/example.com
</VirtualHost>

<VirtualHost *:80>
    ServerName example.net
    DocumentRoot /var/www/example.net
</VirtualHost>

<VirtualHost 2.2.2.2:443>
    SSLEngine on
    ServerName example.com
    DocumentRoot /var/www/example.com-ssl
</VirtualHost>

<VirtualHost 3.3.3.3:443>
    SSLEngine on
    ServerName example.net
    DocumentRoot /var/www/example.net-ssl
</VirtualHost>

Edit: Every google search I do returns tons of SNI guides (multiple SSL vhosts on one IP, which is not what I'm looking for.

4
  • 1
    The setup seems reasonable. What exactly is your question? Jul 18, 2013 at 20:12
  • Heh, I knew this wasn't asked right. I guess I'm looking for the proper top-level Apache directives for setting up multiple SSL sites with multiple IPs. My httpd.conf setup above requires a new A-record because https'ing to example.net serves up 1.1.1.1 instead of 3.3.3.3 per my httpd.conf. Hope that clears up my question a bit.
    – Jeff
    Jul 18, 2013 at 20:17
  • Hm. Perhaps you should start over from the beginning. Add as much detail as you can about every part of your process, and we'll see if we can figure out what's going wrong where. Jul 18, 2013 at 20:23
  • Understood. I basically rewrote the thing. Just think, "How To: multiple SSL sites on multiple IPs..." and we'll be on the same page.
    – Jeff
    Jul 18, 2013 at 20:42

2 Answers 2

2

You seem to have misunderstood how DNS works.

DNS in this case resolves names such as example.com to IP addresses such as 203.0.113.1. You can't have a different IP address for a different port or service.

Thus, you need to use the same IP address for HTTP, HTTPS and every other service that might be served with that domain name.

4
  • And that is exactly what I wanted to know. Apache can't just internally forward the client to the correct vhost, right? If not, then the proper way to set this up is to put http example.com and https example.com on the SAME IP ADDRESS, right? I can't even find a sample config online to compare notes with because all the search results are about SNI.
    – Jeff
    Jul 18, 2013 at 20:48
  • Right. The IP addresses in your Apache config should match your A records. Jul 18, 2013 at 20:54
  • Actually I think he wants name-based hosts on 1.1.1.1:80 only, IP-based on the others.
    – xofer
    Jul 18, 2013 at 20:54
  • @xofer, exactly. I thought that's what I was doing already. Name-based on :80 and IP-based on the SSL's. It doesn't work.
    – Jeff
    Jul 18, 2013 at 20:55
0

I think the problem is the NameVirtualHost directive. You want to use IP-based virtual hosting, not name-based.

4
  • Oh yes, I missed your edit -- @Michael Hampton is correct, you cannot have the same domain point to different IP addresses. However you can configure Apache to use a different virtual host based on the port/service, so leaving my answer as it is what you want to do (I think).
    – xofer
    Jul 18, 2013 at 20:52
  • I would pay money to see an example of what you have in mind. :)
    – Jeff
    Jul 18, 2013 at 20:56
  • The Apache config you have will actually work, but you cannot setup the DNS like you want as @M.H. said. You'll need to point exmaple.com to 2.2.2.2 and example.net to 3.3.3.3 and it should work -- the name-based config will pick up the http requests while the IP-based config will pick up the https requests.
    – xofer
    Jul 18, 2013 at 21:00
  • Thank you for the info. Since that's not what I want, I guess it's SNI for me!
    – Jeff
    Jul 18, 2013 at 21:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .