Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to set up SSL, with SNI, in my apache and am getting the often-seen "ssl_error_rx_record_too_long" error in Firefox when accessing the site (https://test.me.dev.xxxx.net), from which I can conclude that the server is listening on port 443, but doesn't know to use SSL on it.

The server is Ubuntu 9.04 with Apache 2.2.11 I enabled SSL in the default way (a2enmod ssl).

Here is my relevant config:

NameVirtualHost *:*
Listen 80

<IfModule mod_ssl.c>
    Listen 443
</IfModule>

...

<VirtualHost *:*>

        DocumentRoot /home
        ServerAlias *.dev.xxxx.net
        UseCanonicalName Off
        # project.user.dev.xxxx.net
        VirtualDocumentRoot /home/%2/dev/%1/web

        SSLEngine On
        SSLCertificateFile /etc/apache2/certs/dev.crt
        SSLCertificateKeyFile /etc/apache2/certs/dev.key

</VirtualHost>

What is wrong?

share|improve this question
2  
mod_ssl didn't have SNI (Server Name Indication) support until Apache 2.2.12, yours is just a little too old. –  grawity Feb 25 '10 at 13:00
1  
Also may be helpful: wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI –  grawity Feb 25 '10 at 13:01
add comment

2 Answers

up vote 1 down vote accepted

This is part of my server working config. Hope you will it handy.

<VirtualHost *:80>
    ServerAdmin webmaster@xxx.com
    ServerName  xxx.com
    ServerAlias www.xxx.com

    DocumentRoot /srv/www/htdocs/xxx.com

    ErrorLog  /var/log/apache2/xxx.com-error_log
    CustomLog /var/log/apache2/xxx.com-access_log vhost_common

    <Directory "/srv/www/htdocs/xxx.com">
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
</VirtualHost>

<VirtualHost *:80>
    ServerName mail.xxx.com
    Redirect / https://mail.xxx.com/
</VirtualHost>

<IfDefine SSL>
<IfDefine !NOSSL>
<VirtualHost _default_:443>
    ServerAdmin webmaster@xxx.com
    ServerName  mail.xxx.com

    DocumentRoot  /srv/www/htdocs/roundcube

    ErrorLog  /var/log/apache2/roundcube-error_log
    CustomLog /var/log/apache2/roundcube-access_log vhost_common
    CustomLog /var/log/apache2/roundcube-ssl_log ssl_combined

    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCertificateFile    /etc/ssl/xxx/apache2.crt
    SSLCertificateKeyFile /etc/ssl/xxx/apache2.key
    SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
</VirtualHost>
</IfDefine>
</IfDefine>
share|improve this answer
1  
So there's no way around duplicating the config for sites that need access via both? –  Bart van Heukelom Feb 26 '10 at 12:13
    
If you want to force either SSL or non-SSL you can configure Apache to redirect to the other (i.e. if you force SSL, then have the non-SSL do automatic redirect to the SSL domain). This shortens your config because it's just a one line redirect. Otherwise you should use Include statements as a way to follow DRY principles and shorten the config. –  Van Gale Feb 26 '10 at 17:15
1  
@Bart van Heukelom: To configure similar virtual hosts, put the common directives in a separate file and use the Include directive. Alternatively, use mod_macro cri.ensmp.fr/~coelho/mod_macro . –  200_success Jun 20 '10 at 13:33
add comment
<VirtualHost *:443>
</VirtualHost>
share|improve this answer
    
But I also need sites to be available over normal HTTP –  Bart van Heukelom Feb 25 '10 at 10:29
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.