Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm running Apache as an HTTPS reverse proxy, with many real hosts proxied through a single VirtualHost (single public IP, wildcard certificate), using mod_rewrite and mod_proxy.

Basically, something like:

<VirtualHost *:443>
SSLEngine On
...
RewriteEngine On
RewriteCond %{SERVER_NAME} ^(server1|server2|server3)\.domain\.net$
RewriteRule ^/(.*)$ https://%{SERVER_NAME}/$1 [P]   # Forward requests for listed servers
RewriteRule ^.*$ - [F]                              # Block anything else
</VirtualHost>`

Now I need to set Timeout to a larger value than default, but only for requests going to one of these servers (sync server for mobile devices).

Can this be done without requiring a separate VirtualHost (and thus another public IP) ?

share|improve this question

1 Answer 1

Having an extra VirtualHost doesn't demand a new public IP; your wildcard certificate will (I'm assuming?) be valid for the new sync server's listener.

Apache will gladly throw a warning when you set a NameVirtualHost *:443 directive, but using host headers over an SSL connection will work just fine. Give your existing VirtualHost a wildcard ServerAlias and make sure it loads first.

You can then make your second VirtualHost attached to the same IP (with a ServerName that gives it the requests for the mobile sync server).

share|improve this answer
    
What about doing just the opposite, one VirtualHost for the mobile sync server with a ServerName first, then a second VirtualHost with no ServerAlias/ServerName directive at all, and the config described above? Would that work too? –  Nico57 Apr 14 '11 at 22:43
    
@Nico57 No good. If you enable NameVirtualHost on the port, then every VirtualHost on the port must have at least a ServerName directive (and yours should get a ServerAlias directive so that it gets all the requests that don't exactly match a ServerName). The only reason I'm saying that the catch-all one loads first is that the first to load is considered the default for requests that come in on the port with a missing or unmatched Host header. –  Shane Madden Apr 14 '11 at 22:49
    
I'm indeed using NameVirtualHost *:443 at the top of the config file, do you mean that I should remove that? –  Nico57 Apr 14 '11 at 23:00
    
No matter how hard I try, Apache does not want to branch connections to a second virtualhost. Which is somewhat expected: it's not able to select the right VirtualHost before the mod_ssl gets involved, and since the SSL settings are inside the VirtualHost, it's too late when it gets here, it WON'T hop out of the current virtualhost to the next one. The SSL and VirtualHosts features are layered according to a "one certificate, one server" vision. Do you really think this could/should work otherwise Shane? –  Nico57 Apr 14 '11 at 23:20
    
Well, kinda.. It's not able to decide with cert to use unless the server and the client both support TLS server name indication. That aside; even if it can't decide which cert to connect with, that has no bearing on its ability to pick a vhost based on the Host: header. Couple things: 1) The SSL config should be identical in both VirtualHost blocks; you'll want to make sure that's the case. 2) Check out your error.log, anything interesting? Should give some hints on what's going on, and probably some warnings for using SSL'd NameVirtualHost. What version of Apache, too? –  Shane Madden Apr 15 '11 at 1:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.