Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've just setup Apache 2.2.18 with mod_ssl enabled and its configured to listen to one IP address on port 443. There are many domains with A DNS record poiting to this IP address. But I want to configure Apache with "VirtualHost"s for specific domains with their DocumentRoot.

My config in httpd.conf is this:

Listen          1.2.3.4:443
NameVirtualHost 1.2.3.4:443

<VirtualHost 1.2.3.4:443>
  DocumentRoot /data/www/domain.com
  ServerName www.domain.com
  SSLEngine On
</VirtualHost>

However, my problem and question is, that this Apache is using this VirtualHost for ANY domain pointing to the same IP address. It looks like its ignoring the "ServerName" parameter. I want to run this SSL-Apache only on specific domains. Anybody can help ?

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

This happens because of the way SSL works. To understand this, you first need to know what actually happens when you're requesting a page from a website.

A quick summary for a request of https://example.com/:

  1. You connect with the IP 1.2.3.4 on port 443
  2. SSL handshake and key exchange. Here, the certificate comes in play
  3. The actual data is sent encrypted:

    GET / HTTP/1.1
    Host: www.example.com
    

    The issue is, the domain www.example.com will be known after the certificate has been determined.

A solution would be SNI in which the Host header field is send before the SSL handshake. This is a relative new technology which may not be supported by all browsers.

share|improve this answer
    
Ok, so now I am little confused... So is it possible to run VirtualHosts in SSL enabled Apache ? From your answer it almost seems as it is not possible as I am trying to do... –  Frodik May 15 '11 at 8:35
    
It IS possible, but if you've visitors using old iPhones (1G) or IE7 on XP, the SNI solution would not work. For company websites (intranet), it might be acceptable if you've control over the browser that will be used. –  Lekensteyn May 15 '11 at 8:40
    
Oh, so better would be the domain I want to be accessible by SSL to configure it on custom IP address where no other domain would be used, right ? –  Frodik May 15 '11 at 8:45
    
@Frodik: if that's within your abilities, yes, use custom IP addresses for each SSL domain. –  Lekensteyn May 15 '11 at 8:55
add comment

Normally, SSL are established BEFORE any communication in.

HTTP protocol tells what servername IN communcation via Host: header.

So, SSL established BEFORE known what hostname are requestsed.

To make sure SSL cert are accepted by almost browsers, you should do one of following things:

  1. Create Wildcard SSL. Then, all requests to *.somedomain.com will be accepted by browser.

  2. Create SSL cert with all required you domain names as alternatives in "Subject Alternative Name". Working not for all browsers, but for most major.

  3. Use SNI: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI that works again in major browsers... F.e. our best friend IE6 doesn't support SNI.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.