Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a VHOST configuration that I need a fresh set of eyes on. We have SSLEngine enabled in two virtual hosts - on on port 443 and another on port 4432. For some reason, regardless of whether the connection comes in on 443 or 4432 it automatically resorts to the first vhost defined. If I put 443 on top it uses that config for 443 and 4432 and if I put 4432 on top it uses that config for 443 and 4432. Can anyone tell me why it's just grabbing the top virtual host even though they only should be going to their respective ports? I know that SSL needs it's own IP but it's my understanding a separate Port should suffice too?

Listen *:443
<VirtualHost *:443>
  SSLEngine On
  SSLCertificateFile ...
  SSLCertificateKeyFile ...
  SSLCertificateChainFile ...
  ...
</VirtualHost>

Listen *:4432
<VirtualHost *:4432>
  SSLEngine On
  SSLCertificateFile a_different_file...
  SSLCertificateKeyFile a_different_file...
  SSLCertificateChainFile a_different_file...
  ...
</VirtualHost>
share|improve this question

1 Answer 1

up vote -1 down vote accepted

Why not make all the SSL on port 443 and use vHosts to use multiple domains? You're trying to do that, but you're overlooking it. Try this:

NameVirtualHost *:443

<VirtualHost *:443>
insert ssl stuff1 here
    ServerAdmin email@you.com
    DocumentRoot "C:/xampp/htsecure1/"
    ServerName domain1.com
    ServerAlias www.domain1.com
</VirtualHost>

<VirtualHost *:443>
insert ssl stuff2 here
    ServerAdmin email@you.com
    DocumentRoot "C:/xampp/htsecure2/"
    ServerName domain2.com
    ServerAlias www.domain2.com
</VirtualHost>

<VirtualHost *:443>
insert ssl stuff3 here
    ServerAdmin email@you.com
    DocumentRoot "C:/xampp/htsecure3/"
    ServerName domain3.com
    ServerAlias www.domain3.com
</VirtualHost>
share|improve this answer
    
Looks like the issue was I had name-based virtual hosts above. I moved them down and everything seems to work now. –  Dan Sep 6 '11 at 23:56
2  
Please remember that you can only use have one certificate per socket (address:port). The described would result in certificate errors if you are not using a wildcard/san certificate. SNI (en.wikipedia.org/wiki/Server_Name_Indication) is not supported by clients well enough for it to be considered a valid option. –  Zoredache Sep 7 '11 at 0:05
    
Ah, well I've got a multi-domain SSL cert and never realized that one. Hey, you learn something new twice a day. –  U4iK_HaZe Sep 7 '11 at 0:18

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.