Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This configuration works ok, but it asks for certificate on all subdomains.

<VirtualHost IP:443>
ServerName *.domain.tld
ServerAlias www.*.domain.tld
VirtualDocumentRoot /home/domaintld/subdomains/%1
ServerAdmin webmaster@*.domain.tld

UseCanonicalName off
UserDir public_html

SSLEngine on
SSLVerifyClient require
SSLVerifyDepth 1
SSLCertificateFile /path/to/cert.crt
SSLCACertificateFile /path/to/CAcert.crt
SSLCertificateKeyFile /path/to/key.key

<Directory "/home/domaintld/subdomains/%1">
  SSLRequire %{SSL_CLIENT_S_DN_O} eq "Company" 
and %{SSL_CLIENT_S_DN_OU} in {"Department"} 
# this one is not splitted, only here to avoid horiz. scroll
</Directory>

CustomLog /usr/local/apache/domlogs/domain.tld-ssl_log combined
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

</VirtualHost>

But I want to make it to ask for only on subdomain, supposedly "theone.domain.tld"

I tried:

#...
SSLEngine on
SSLCertificateFile /path/to/cert.crt
SSLCACertificateFile /path/to/CAcert.crt
SSLCertificateKeyFile /path/to/key.key

<Directory "/home/domaintld/subdomains/theone">
  SSLVerifyClient require
  SSLVerifyDepth 1
  SSLRequire %{SSL_CLIENT_S_DN_O} eq "Company" 
and %{SSL_CLIENT_S_DN_OU} in {"Department"} 
# this one is not splitted, only here to avoid horiz. scroll
</Directory>
#...

Also with the <Directory ..> outside <VirtualHost ..>

Even added SSLCACertificateFile within <Directory ..>

I get the other subdomains working through HTTPS but "theone" gives an Error 107 (net::ERR_SSL_PROTOCOL_ERROR)

I have to mention that the whole VirtualHost and Directory are/were within <IfDefine SSL></IfDefine>

Any suggestions?

Thanks.

share|improve this question
    
i suspect wildcard certs do not work with the "www" theme you applied . it should be name.domain.tld rather than www.name.domain.tld for each site belonging to the cert. if not, then you need to buy a combined cert pack that supports 5 site names in one cert rather than use a wildcard. thats my guess anyway. –  djangofan Aug 2 '10 at 16:03
    
Yes, true. But that's not what I need, it works fine without www for all. My issue is with the client certificates.. those required by user to access the website. –  Andi T Aug 2 '10 at 16:09

1 Answer 1

up vote 0 down vote accepted

SSL negotiation is completed before the the HTTP header that includes the criteria to select the proper virtual host is transmitted. This means you cannot use any unique SSL options per virtual host. The only option I am aware of would be to get another IP address and setup an IP based virtual host for the the sites you require certificate authentication on.

http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts

share|improve this answer
    
I guess the wildcards certificates dont help on this issue, so the only way to do it was with different IP for that particular subdomain. –  Andi T Aug 3 '10 at 12:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.