Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an SSL certificate which is valid for multiple (sub-) domains. In Apache I have configured this as follows:

In /etc/apache2/apache2.conf

NameVirtualHost <my ip>:443

Then for one named virtual host I have

<VirtualHost <my ip>:443>
    ServerName ...

    SSLEngine on
    SSLCertificateFile ...
    SSLCertificateKeyFile ...
    SSLCertificateChainFile ...
    SSLCACertificateFile ...
</VirtualHost>

Finally, for every other site I want to be accessible over HTTPS I just have a

<VirtualHost <my ip>:443>
    ServerName ...
</VirtualHost>

The good news is that it works. However, when I start Apache I get warning messages

[warn] Init: SSL server IP/port conflict: Domain A:443 (...) vs. Domain B:443 (...)
[warn] Init: SSL server IP/port conflict: Domain C:443 (...) vs. Domain B:443 (...)
[warn] Init: You should not use name-based virtual hosts in conjunction with SSL!!

So, my question is: how should I be configuring this? Clearly from the warning messages I am doing something wrong (although it does work!), however, the above configuration was the only one I could get to work. It is somewhat annoying as the configuration files have an explicit dependence on my IP address.

share|improve this question
add comment

4 Answers

up vote 1 down vote accepted

The configuration is right.

Apache barks because it thinks it is a mistake on your part to have more SSL VirtualHosts with the same certificate (because most of the time, configurations like this manifest as a certificate error on the client). You can ignore the warning messages, mostly because, like you said, it works the way you want.

If you want the config to be independent from the IP address, you can specify

<VirtualHost *:80>

in your config files. Naturally, you'll have to have the corresponding NameVirtualHost entry:

NameVirtualHost *:80
share|improve this answer
add comment

you can use the same certificate into each VirtualHost directive and define as well your server configuration - basically combine what you wrote above.

the NameVirtualHost directive is used for NON ssl traffic when you want apache to look at the incoming headers and route based on the Host string sent by the client to the actual virtual server.

share|improve this answer
add comment

You can only have a https site per socket, so you have to change the VHost port and associate it with the new certificate. If all those sites need to run on 443 port you need more IPs.

share|improve this answer
1  
Abject nonsense ;) You are limited to one certificate per IP, however, a certificate can be valid for multiple domains, hence allowing virtual hosts to be used. –  Freddie Witherden Dec 28 '10 at 19:10
add comment

You can use nginx instead of or in front of apache.

Most web servers (apache, iis, etc.) don't work properly with named ssl hosts because they determine the virtual website before determining which ssl cert to use, negotiating, etc.. The SNI thing is sort of a hack that doesn't work with lots of browsers.

nginx, however, does name based SSL hosts gracefully, because it allows you to associate the cert with the IP/port and then inspect the host header to determine where to route the request. The destination can be served by nginx or reverse proxied to apache, iis, other machines, whatever.. It's the swiss army knife of incoming tcp/ip requests. It has many of the same capabilities of ssl offloading and redirecting commonly done with hardware load balancers, including simple load balancing.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.