Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've got quite a big VirtualHost definition which I don't want to duplicate just so the site will also run over HTTPS.

Here's what I want to do:

<VirtualHost *>
    ServerName example.com

    <If port=443>
        SSLEngine on
        SSLCertificateFile ...
        SSLCertificateKeyFile ...
        SSLCertificateChainFile ...
    </If>

    (other config)

</VirtualHost>

Is there some way to do this?
Am I missing some other method of not duplicating the config?

share|improve this question

3 Answers 3

up vote 6 down vote accepted

the current stable version of the Apache(2.2) doesn't have that feature, but the 2.4 does have the IF directive: http://httpd.apache.org/docs/2.4/mod/core.html#if

so you have to create two virtualhost for now. but you can set some stuff through environments or apache global variables and use that in you virtualhost config (setting the documentroot for example), this way if you want to change that, you can do it with just one line of modification.

and of course, you can use Include to do something like this:

<VirtualHost *:80>
        include /etc/apache2/vhost.conf.d/site1
</VirtualHost>

<VirtualHost *:443>
        include /etc/apache2/vhost.conf.d/site1
        include /etc/apache2/vhost.conf.d/site1-ssl
</VirtualHost>

ps: SNI will be mainstream years before the IPv6 adaptation... currently the only major browser that doesn't support it is the Safari and IE on Windows XP.

Tyrael

share|improve this answer
1  
Attempting to put SSLEngine On in an <If> will give SSLEngine not allowed here, so the suggested use-case at the start of this answer sadly doesn't appear to be possible. This seems to be because the requirement that "Only directives that support the directory context can be used within this configuration section." (ref) and SSLEngine is server config, virtual host (ref), not directory. –  fooquency Aug 28 '14 at 18:24

For SSL virtual hosts, you either have to use a second port ala

<VirtualHost *:443>
    ServerName abc.com
</VirtualHost>
<VirtualHost *:4443>
    Servername def.com
</VirtualHost>

or you have to use separate IPs

<VirtualHost 192.168.0.1:443>
    ServerName abc.com
</VirtualHost>
<VirtualHost 192.168.0.2:443>
    Servername def.com
</VirtualHost>

There's actaully a very good explanation in the Apache SSL docs http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html

Search down for "Why can't I use SSL with name-based/non-IP-based virtual hosts?"

share|improve this answer
1  
Be aware of this for the future, though: en.wikipedia.org/wiki/Server_Name_Indication –  mattdm Dec 16 '10 at 1:39
    
Ironically, by the time SNI is widely-accepted enough to be safely used for the majority of virtual hosting sites, IPv6 will probably be commonplace enough to make it irrelevant. –  jgoldschrafe Dec 16 '10 at 3:23

No. You can move most things to the Global config and inherit it in the VirtualHost.

share|improve this answer
    
Unfortunately I have a few VirtualHosts, each with different config and most needing to work over HTTP and HTTPS. –  Jake Dec 16 '10 at 1:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.