Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Linux server with Gentoo Linux 64 bit.

I have Apache 2.2.17 installed and I have several vhosts configured on it that work correctly. When I try to add SSL vhosts, apache detects only the first one.

This is how each virtual host is configured:

<VirtualHost *:443>
    ServerName myserver
    serverAlias [server name]
    Include /etc/apache2/vhosts.d/magento_vhost.include
    ErrorLog /var/log/apache2/[server]_ssl_error_log

    <IfModule log_config_module>
            TransferLog /var/log/apache2/[server]_ssl_access_log

    SSLEngine on


    SSLCertificateFile /etc/ssl/apache2/server.crt

    SSLCertificateKeyFile /etc/ssl/apache2/server.key

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
            SSLOptions +StdEnvVars

    <Directory "/var/www/localhost/cgi-bin">
            SSLOptions +StdEnvVars

    <IfModule setenvif_module>
            BrowserMatch ".*MSIE.*" \
                    nokeepalive ssl-unclean-shutdown \
                    downgrade-1.0 force-response-1.0

    <IfModule log_config_module>
            CustomLog /var/log/apache2/ssl_request_log \
                    "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

this is the include file:


DocumentRoot "/var/www/[server dir]"

<Directory "/var/www/[server dir]">
    Options Indexes FollowSymLinks

    AllowOverride All
    Order allow,deny
    Allow from all

in the following url i read that regarding ssl virtual hosts apache will fetch only the first ssl vhost configuration.

I have a linux server with dozens of domains forwarded to my ip and each has it's own vaild ssl certificate. how can I configure my system to allow that? do I really need to allocate my IP address to resolve this issue?


share|improve this question

migrated from Apr 4 '11 at 14:00

This question came from our site for computer enthusiasts and power users.

What do you have for your NameVirtualHost configuration directive? – Majenko Apr 4 '11 at 13:47
Your main problem is the one that Douglas gave in his answer. Your other options are: A wildcard SSL certificate or TLS Server name indication (see the nginx page - you could place nginx before apache). – initall Apr 4 '11 at 14:08
I didn't have NameVirtualHost to *:443. that resolve the problem that always the first virtualhost got detected – ufk Apr 4 '11 at 18:21
up vote 4 down vote accepted

Apache will "detect" and serve any number of vhosts on an SSL port. The problem is, specifically, with which certificate to use.

Think about how a vhost is selected; the client transmits a Host: header as part of the request that it sends. An SSL tunnel is already established by the time that info is sent to the server, so it's impossible for Apache to select a cert based on something it doesn't know when the certificate is selected. In this situation, it always selects the cert on the first vhost to load.

However, when the client and server both support TLS Server Name Indication, the client can indicate as part of the session negotiation which hostname it's going to hit, allowing Apache to use the correct certificate. Your server should support it (as long as your OpenSSL library is new enough, but Apache 2.2.17 is fine), so it's a question of client support.

If you've got clients still on Windows XP, then that's out; your best options are a wildcard certificate if your sites share a parent domain, or a Subject Alternate Name certificate if they do not.

share|improve this answer
thank you for your awesome information! I forgot to add NameVirtualHost *:443. that resolved one of my problems. and with you information here i'll know how to handle the licenses properly. thanks! – ufk Apr 4 '11 at 18:21

Consider what apache does:

It gets a new connection to a given IP and port number, and it has to setup an SSL connection; for this it needs an SSL certificate. How is it supposed to select between multiple certificates?

So each IP/port combination can only serve use one SSL certificate. And if you also want to use the default https port, then that's one certificate per IP.

share|improve this answer

In my configuration, I have multiples <VirtualHost *:443> sections with different ServerName matching the sites addresses.

For each you have a SSL configuration section, with certificates etc...

For browser recent enough, it should work. (On win XP there it won't work due to libraries of crypto that do not handle the multiple SSL hosts request)

If your package of ssl and apache are recent enough, it should work.

Related: SF where you will see example of config and info on the SNI (Server Name Indication)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.