Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have two different sites, foo.com and bar.com, each running on a different (virtual) machine. Each has an SSL-enabled Ruby-on-Rails site running as follows:

# foo.com:/etc/apache2/sites-availables/foo.com.conf:

<VirtualHost *:80>
    ServerName foo.com
    ServerAlias www.foo.com
    DocumentRoot /var/www/apps/foo.com/current/public
</VirtualHost>

<VirtualHost *:443>
    ServerName foo.com
    ServerAlias www.foo.com
    DocumentRoot /var/www/apps/foo.com/current/public

    SSLEngine On
    SSLCertificateKeyFile /etc/apache2/ssl/foo.com.key
    SSLCertificateFile /etc/apache2/ssl/WWW.FOO.COM.crt
    SSLCertificateChainFile /etc/apache2/ssl/Apache_Plesk_Install.txt
</VirtualHost>

(Replace "foo.com" with "bar.com" as appropriate.)

I am in the process of merging the two code-bases in order to ease ease between users of foo.com and bar.com. Eventually they will both reside on the same server (foo.com) and both domain names will point to the same IP. The single server will be perfectly capable of handling the traffic from both sites -- they only get on order of a few dozen unique users each day, with peak load in the hundreds or low thousands.

The following is my proposed checklist of things to do for the merge. My question is: what am I forgetting?

  1. copy the private key, certificate, and certificate chain file from bar.com:/etc/apache2/ssl/* to foo.com:/etc/apache2/ssl/bar.com/*
  2. copy the bar.com site configuration from bar.com:/etc/apache2/sites-available/bar.com.conf to foo.com:/etc/apache2/sites-available/bar.com/conf and edit the SSL configuration as per the previous point
  3. (possibly change the foo.com SSL configuration to look more like the new bar.com ones)
  4. restart Apache on foo.com
  5. change the bar.com name listing to an alias to foo.com

Will that work? Will users get the right certificates or will they see certificate warnings?

share|improve this question

1 Answer 1

up vote 4 down vote accepted

both domain names will point to the same IP

If you want to avoid certificate warnings with 2 different sites sharing the same IP:port, you will need to use a SAN/UCC certificate that supports multiple/alternate names in one cert.

Take a look at this thread:

http://serverfault.com/questions/113076/apache-ssl-virtualhosts-on-a-single-ip-using-ucc-san-certificate

If ordering a SAN/UCC cert is not an option, you will need to use multiple IP addresses.

share|improve this answer
    
+1, Hit the nail on the head. –  Chris S Mar 1 '10 at 19:30
    
or multiple ports on same IP –  sumar Mar 1 '10 at 20:26
    
This is because the SSL part of the request is resolved before the virtual-host, right? Hmm, I might have to figure out how to get the host to point two public IPs at the same virtual machine. Thanks :) –  James A. Rosen Mar 2 '10 at 13:23
    
James, correct. SSL certificates are exchanged before any HTTP headers are sent. –  micah Mar 10 '10 at 14:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.