0

I have a server with a number of virtualhosts, most of which do not have or need https:// connections, and some that do. What I want to happen is for users who accidentally type in "https://mynonsecuresite.com" to get a default error message (or get redirected to the port 80 site).

At present, if somebody types in https://mynonsecuresite.com/ they get redirected somehow to https://mysecuresite.com/

Note, it's not a matter of Apache serving default pages from a virtualhost earlier in the config setup list, the URL is actually altered to https://mysecuresite.com/ via what seems like a redirect, but not an apache mod_rewrite redirect.

I tried to created a default virtual host, which was placed in 000-default in Apache site-enabled directory.

<VirtualHost 123.123.123.123:443>
        ServerName default-web
        ServerAlias mynonsecuresite.com www.mynonsecuresite.com
        DocumentRoot /home/virtual/default-web
        ErrorDocument 404 /index.php
</VirtualHost>

After restarting the server, the website is still redirected to https://mysecuresite.com/

Looking at Apache's rewrite log, there isn't an errant rewrite at work, so I'm not quite sure how this is happening.

Not sure if it's relevant, but it's an Ubuntu 12.04 server. I don't recall this being a problem on a previous Debian machine. I also have shibboleth2 installed for secure federated login for a website.

2 Answers 2

1

Since the domain requested is in the http headers (and thus still encrypted when apache has to decide which vhost config to use) your users are getting the https://mysecuresite.com/ content no matter what domain they enter as long as it is sent to the IP and port 443 of https://mysecuresite.com/

Off the top of my head I could suggest the following snippet in the vhost of mysecuresite.com to redirect everyone to the http version of the requested site if it doesn't match "mysecuresite.com"

RewriteEngine On
RewriteCond %{HTTP_HOST} !^mysecuresite.com$
RewriteRule ^(.*)$ http://%{HTTP_HOST}$1 [L,R]
0

Make sure TLS SNI Server Name Indication is supported in the browser and enabled, so that the client can send the correct hostname desired to Apache.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .