Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up SSL, with SNI, in my apache and am getting the often-seen "ssl_error_rx_record_too_long" error in Firefox when accessing the site (, from which I can conclude that the server is listening on port 443, but doesn't know to use SSL on it.

The server is Ubuntu 9.04 with Apache 2.2.11 I enabled SSL in the default way (a2enmod ssl).

Here is my relevant config:

NameVirtualHost *:*
Listen 80

<IfModule mod_ssl.c>
    Listen 443


<VirtualHost *:*>

        DocumentRoot /home
        ServerAlias *
        UseCanonicalName Off
        VirtualDocumentRoot /home/%2/dev/%1/web

        SSLEngine On
        SSLCertificateFile /etc/apache2/certs/dev.crt
        SSLCertificateKeyFile /etc/apache2/certs/dev.key


What is wrong?

share|improve this question
mod_ssl didn't have SNI (Server Name Indication) support until Apache 2.2.12, yours is just a little too old. – grawity Feb 25 '10 at 13:00
Also may be helpful: – grawity Feb 25 '10 at 13:01
up vote 2 down vote accepted

This is part of my server working config. Hope you will it handy.

<VirtualHost *:80>

    DocumentRoot /srv/www/htdocs/

    ErrorLog  /var/log/apache2/
    CustomLog /var/log/apache2/ vhost_common

    <Directory "/srv/www/htdocs/">
        AllowOverride All
        Order allow,deny
        Allow from all

<VirtualHost *:80>
    Redirect /

<IfDefine SSL>
<IfDefine !NOSSL>
<VirtualHost _default_:443>

    DocumentRoot  /srv/www/htdocs/roundcube

    ErrorLog  /var/log/apache2/roundcube-error_log
    CustomLog /var/log/apache2/roundcube-access_log vhost_common
    CustomLog /var/log/apache2/roundcube-ssl_log ssl_combined

    SSLEngine on
    SSLCertificateFile    /etc/ssl/xxx/apache2.crt
    SSLCertificateKeyFile /etc/ssl/xxx/apache2.key
    SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
share|improve this answer
So there's no way around duplicating the config for sites that need access via both? – Bart van Heukelom Feb 26 '10 at 12:13
If you want to force either SSL or non-SSL you can configure Apache to redirect to the other (i.e. if you force SSL, then have the non-SSL do automatic redirect to the SSL domain). This shortens your config because it's just a one line redirect. Otherwise you should use Include statements as a way to follow DRY principles and shorten the config. – Van Gale Feb 26 '10 at 17:15
@Bart van Heukelom: To configure similar virtual hosts, put the common directives in a separate file and use the Include directive. Alternatively, use mod_macro . – 200_success Jun 20 '10 at 13:33
<VirtualHost *:443>
share|improve this answer
But I also need sites to be available over normal HTTP – Bart van Heukelom Feb 25 '10 at 10:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.