up vote 0 down vote favorite
share [g+] share [fb]

I already have SSL running on the main domain for my site, but when I use the following configuration SSL will not run on the subdomain. Should I replace * with the name of the subdomain or something?

#
#  domain.com (/etc/apache2/sites-available/domain.com)
#
<VirtualHost *:80 *:443>
 ServerAdmin webmaster@domain.com
 ServerName  www.domain.com
 ServerAlias domain.com
 ServerAlias XX.XX.XX.XX

 # Directory Root.
 DocumentRoot /sites/domain.com/www/

 # CGI Directory
 ScriptAlias /cgi-bin/ /sites/domain.com/cgi-bin/
 <Location /cgi-bin>
   Options +ExecCGI
 </Location>

 # Logfiles
 ErrorLog  /sites/domain.com/logs/error.log
 CustomLog /sites/domain.com/logs/access.log combined

 # Enable SSL
 SSLEngine On
 SSLCertificateFile  /sites/domain.com/ssl/star_domain_com.crt
 SSLCertificateKeyFile /sites/domain.com/ssl/domain.key
 SSLCertificateChainFile /sites/domain.com/ssl/DigiCertCA.crt
 SetEnvIf User-Agent ..*MSIE.*. nokeepalive ssl-unclean-shutdown
</VirtualHost>


#
#  support.domain.com (/etc/apache2/sites-available/support.domain.com)
#
<VirtualHost *:80 *:443>
 ServerName support.domain.com
 ServerAlias support.domain.com:443

 # Enable SSL
 SSLEngine On
 SSLCertificateFile  /sites/ikeyless.com/ssl/star_domain_com.crt
 SSLCertificateKeyFile /sites/ikeyless.com/ssl/domain.key
 SSLCertificateChainFile /sites/ikeyless.com/ssl/DigiCertCA.crt
 SetEnvIf User-Agent ..*MSIE.*. nokeepalive ssl-unclean-shutdown

 # Directory Root.
 DocumentRoot /sites/support.domain.com/www/

 # Logfiles
 ErrorLog  /sites/support.domain.com/logs/error.log
 CustomLog /sites/support.domain.com/logs/access.log combined
</VirtualHost>

update

I'd like for this single SSL certificate (It's a wildcard cert) to run across the main domain and all subdomains (including support.domain.com and live.support.domain.com). How should I go about getting that setup?

link|improve this question
90% accept rate
feedback

1 Answer

up vote 0 down vote accepted

You can only run one SSL website per IP address with HTTP 1.1 as the HOST header is encrypted inside the request, so the server doesn't know which vhost it's aiming for until it is decrypted.

If you have more than one IP address, replace with where xxx.xxx.xxx.xxx is the IP address in both and it should work, but try a configtest:
/etc/init.d/httpd configtest or just restart apache if it's not a live server.

link|improve this answer
SNI allows you to run do SSL virtual hosting, mod_gnutls and recent versions of mod_ssl support it. The only issue is client support, most crap ware browsers do not support it. – topdog Aug 11 '10 at 14:22
Well, I'd like for the SSL we have installed to spread across our primary domain and all of it's sub domains. We went and purchased a wildcard SSL cert so I know our certificate supports that. – Webnet Aug 11 '10 at 18:04
sorry I didn't know you had a wildcard cert. Add the following line under ServerName: ServerAlias *.domain.com – James Lawrie Aug 11 '10 at 23:32
I've updated my original post with the latest configuration. I have a feeling I'm closer to what I need, I tried a few things but none are working as they should. – Webnet Aug 12 '10 at 13:41
Does *:80 *:443> work? I'm not sure. Anyway, apart from this the first VirtualHost is correct if you want www.example.com, example.com and your IP address all to go the same place. The second VirtualHost, replace ServerAlias support.domain.com:443 with ServerAlias *.domain.com and it should work. – James Lawrie Aug 12 '10 at 14:05
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.