Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got quite a big VirtualHost definition which I don't want to duplicate just so the site will also run over HTTPS.

Here's what I want to do:

<VirtualHost *>
    ServerName example.com

    <If port=443>
        SSLEngine on
        SSLCertificateFile ...
        SSLCertificateKeyFile ...
        SSLCertificateChainFile ...
    </If>

    (other config)

</VirtualHost>

Is there some way to do this?
Am I missing some other method of not duplicating the config?

share|improve this question
up vote 8 down vote accepted

The current stable version of the Apache(2.2) doesn't have that feature, but the 2.4 does have the IF directive.

You have to create two VirtualHosts for now, but you can set some stuff through environment or apache global variables and use that in your virtualhost config (setting the documentroot for example). This way if you want to change that you can do it with just one line of modification.

Of course, you can use include to do something like this:

<VirtualHost *:80>
        include /etc/apache2/vhost.conf.d/site1
</VirtualHost>

<VirtualHost *:443>
        include /etc/apache2/vhost.conf.d/site1
        include /etc/apache2/vhost.conf.d/site1-ssl
</VirtualHost>

ps: SNI will be mainstream years before the IPv6 adaptation. All of the mainstream browser support it already assuming you are on a supported OS.

edit: as fooquency spotted you can't put SSLEngine On to an If block so my answer is wrong.

share|improve this answer
5  
Attempting to put SSLEngine On in an <If> will give SSLEngine not allowed here, so the suggested use-case at the start of this answer sadly doesn't appear to be possible. This seems to be because the requirement that "Only directives that support the directory context can be used within this configuration section." (ref) and SSLEngine is server config, virtual host (ref), not directory. – fooquency Aug 28 '14 at 18:24

No. You can move most things to the Global config and inherit it in the VirtualHost.

share|improve this answer
    
Unfortunately I have a few VirtualHosts, each with different config and most needing to work over HTTP and HTTPS. – Jake Dec 16 '10 at 1:25
    
As unhelpful as this answer is, it's the only correct one. Please move to a web server that doesn't suck. :) – intgr Nov 10 '15 at 9:19

For SSL virtual hosts, you either have to use a second port ala

<VirtualHost *:443>
    ServerName abc.com
</VirtualHost>
<VirtualHost *:4443>
    Servername def.com
</VirtualHost>

or you have to use separate IPs

<VirtualHost 192.168.0.1:443>
    ServerName abc.com
</VirtualHost>
<VirtualHost 192.168.0.2:443>
    Servername def.com
</VirtualHost>

There's actaully a very good explanation in the Apache SSL docs http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html

Search down for "Why can't I use SSL with name-based/non-IP-based virtual hosts?"

share|improve this answer
2  
Be aware of this for the future, though: en.wikipedia.org/wiki/Server_Name_Indication – mattdm Dec 16 '10 at 1:39
    
Ironically, by the time SNI is widely-accepted enough to be safely used for the majority of virtual hosting sites, IPv6 will probably be commonplace enough to make it irrelevant. – jgoldschrafe Dec 16 '10 at 3:23
2  
@jgoldschrafe Hi 2010, it's future speaking here! Recent caniuse shows non-SNI browsers are <2% worldwide. From the first world it's probably much much less. IPv4 still alive and well :) – kubanczyk Dec 4 '15 at 22:43
    
@kubanczyk Got me! :) – jgoldschrafe Dec 8 '15 at 1:02

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.