Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have mass virtual hosting set up on one of our servers allowing me to basically create a symlink in a certain directory and immediately have that host available on both http as well as https. This works great if all of the hostnames are in the same domain (wildcard certificate) but not otherwise. Let me show you my VirtualHost container:

<VirtualHost 1.2.3.4:443>
    SSLEngine on
    SSLProtocol all -SSLv2
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

    ### Mass SSL Vhosts ###
    RewriteEngine on

    #   define two maps: one for fixing the URL and one which defines
    #   the available virtual hosts with their corresponding
    #   DocumentRoot.
    RewriteMap    lowercase    int:tolower

    #   2. make sure we have a Host header
    RewriteCond   %{HTTP_HOST}  !^$

    #   3. lowercase the hostname
    RewriteCond   ${lowercase:%{HTTP_HOST}|NONE}  ^(.+)$

    #   5. finally we can map the URL to its docroot location
    #      and remember the virtual host for logging puposes
    RewriteRule ^/(.*)$ /wwwroot/vhosts/%{HTTP_HOST}/$1 [E=VHOST:${lowercase:%{HTTP_HOST}}]

    <Directory "/wwwroot/vhosts/">
        Options FollowSymLinks
        AllowOverride All
    </Directory>
    <Files ~ "\.(cgi|shtml|phtml|php3?)$">
        SSLOptions +StdEnvVars
    </Files>
    <Directory "/var/www/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>

    ErrorLog /var/log/httpd/ssl_error_log
    TransferLog /var/log/httpd/ssl_access_log
    LogLevel warn

    SSLCertificateFile /etc/pki/tls/certs/wildcard.foo.com.crt
    SSLCACertificateFile /etc/pki/tls/certs/wildcard.foo.com.intermediate.crt
    SSLCertificateKeyFile /etc/pki/tls/private/www.foo.com.key

    SetEnvIf User-Agent ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
    CustomLog logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

This setup works anytime I want to create a something.foo.com domain. I just create a symbolic link in /wwwroot/vhosts to a user's directory and bam it works. I now want to create a something.bar.com domain. Once again, I can just create it and drop it in and http://something.bar.com will work. What I cannot get working however, is https://something.bar.com because of the explicitly defined certificates above.

Is there any way to branch inside the VirtualHost container to use different SSL certificates depending on the hostname?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Have you looked into SNI (Server Name Indication)? E.g. with mod_ssl or mod_gnutls:

share|improve this answer
    
Yes, the problem is: "SNI has only recently gained support in browsers. The browsers that have been confirmed to support SNI are: Opera 8.0+, Firefox 2+, Internet Explorer 7+, Safari 3.2.1+, Chrome (NOT Chromium) ((Chromium 11.0.696.28 seems to do sni fine -mt))" –  Vic Jun 25 '11 at 19:49
    
I'm curious-- what happens if someone visits the site using IE6? –  Vic Jun 25 '11 at 19:53
    
SNI in older browsers (i.e. IE6) won't work... It's called progress. ;-) –  Henk Jun 25 '11 at 20:53
    
So I guess people with older browsers will see the very first virtual host? I agree that it's progress, however there are plenty of corporate IT environments where the update cycle hasn't caught up to progress because of bureaucratic nonsense. –  Vic Jun 25 '11 at 21:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.