Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

SETUP:

  • multiple SSL domains are configured on a single IP, by using vhosts with different port numbers (on which Apache listens)
  • Apache 2.2.8 on Windows 2003 (no comments on this pls)
  • too many Windows XP users so SNI isn't an option yet

There may be reasons why it's wrong to use this approach, but it works for now.

vhosts setup:

# secure domain 1
<VirtualHost IP:443>
  SSL stuff specifying certificate etc.
  ServerName domain1.org
</VirtualHost>

# secure domain 2
<VirtualHost IP:81>
  SSL stuff for domain2.org
  ServerName domain2.org
</VirtualHost>

GOAL: Some folders inside the domain2.org docroot need to be secure. I used a .htaccess file to rewrite the URL to https on port 81:

RewriteEngine On
RewriteCond %{SERVER_PORT} !^81$
RewriteRule (.*) https://%{HTTP_HOST}:81%{REQUEST_URI} [R]

Suppose I put the .htaccess in the folder 'secfolder'.
When accessing http://domain2.org/secfolder this gets succesfully rewritten to https://domain2.org:81/secfolder.


ISSUE: When accessing https://domain2.org/secfolder (without port 81), the certificate from the first vhost (domain1.org) is used and the browser complains that the site is insecure because the certificate is not valid for domain2.org.

I thought that RewriteCond %{SERVER_PORT} !^81$ would also rewrite https://domain2.org to https://domain2.org:81, but it doesn't. It seems that the .htaccess file is not being used at all in this case.

At this point I am not sure how to apply a RewriteRule to https://domain2.org. I tried creating an additional vhost for domain2 on port 443 before the one for domain1.org, but Apache seems to choke on that. I hope someone of you has an idea how to approach this. TIA.


Edit: There was an answer which has been deleted, but it said:
"You can't connect to the server without first verifying the certificate and because the certificate is for the wrong domain, you can't redirect." Is the certificate mismatch really the end of the line? No forced redirect/url rewrite possible after that?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

Remember that when you make an HTTPS connection to https://domain2.org (which is really a connection to https://domain2.org:443), the order is roughly

  1. Browser opens connection to IP on port 443
  2. Apache looks for a VirtualHost matching the combination IP:443
  3. In this case it finds the VirtualHost for domain1.org
  4. Apache sends the SSL certificate associated with that VirtualHost (i.e. the cert for domain1.org)
  5. [The rest of the SSL negotiation]
  6. Browser sends its HTTP request headers, including the Host: header telling Apache what domain it thinks it's talking to.
  7. If applicable, mod_rewrite processing of the HTTP request headers happens here.

i.e. when Apache decides which certificate to send, it hasn't yet received the information that mod_rewrite would use to do the redirect.

To get around this you'd need a single certificate that was valid for both domains. This could be either a wildcard certificate (if the situation is domain1.example.com and domain2.example.com, get a certificate for *.example.com), or you could try to get an SSL certificate with a Subject of "domain1.org", but a Subject Alternate Name of "domain2.org".

In either case you'd need to do the redirection in the main Apache config files - if it's in a .htaccess file in domain2.org's DocumentRoot, then requests that use domain1.org's VirtualHost will go to a different DocumentRoot directory, and won't ever see the file.

share|improve this answer
    
Thanks for the clarification, meulop. I was aware of points 1 through 4 and did consider that the docroot of domain1 was actually being used (the coin didn't completly drop though). I could theoretically still do a URL rewrite with a .htaccess in the domain1.org docroot, but the user would first have to accept the untrusted connection, which is out of the question of course. I guess I'm just out of luck and that this is the limitation of my setup which only SNI (or multiple IP's) will solve. –  Benjamin Jung May 1 '10 at 1:10

Do you have a wildcard certificate of some sort, or you are trying to host different domains with different SSL certificates on the same IP?

If it is not a wildcard, you will not be able to do it, because you can only use a single SSL cert per IP address, no matter what port its on...

share|improve this answer
    
@solefald: I am hosting different domains each with their own certificates and they are accessible on https as long as the port number is appended to the hostname, so it's not true what you are saying. –  Benjamin Jung Apr 30 '10 at 23:02
    
Hm.. this is very interesting... apparently it is possible with newer versions of Apache... linux-mag.com/cache/7480/1.html –  solefald Apr 30 '10 at 23:30
    
Note that I'm not using SNI. I'm using Apache 2.2.8 and SNI wasn't introduced until 2.2.12. –  Benjamin Jung May 1 '10 at 0:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.