How to keep SSL access only on subdomain

Question

I have Apache2 configured with a

<VirtualHost *:80>
    ServerName y.com
</VirtualHost>

and subdomain

<VirtualHost *:443>
    ServerName x.y.com
</VirtualHost>

The goal is to have https://x.y.com only accessible with SSL. But when I enter any other subdomain, e.g. https://any.y.com I see the same page as https://x.y.com

How do I disable any urls like https://any.y.com to show the same page as https://x.y.com. I expect that such sites shouldn't be accessible at all.

Answer 1

You've got to set up a virtual host for only x.y.com on port 443, and only y.com for port 80.

Namevirtualhost *:80
Namevirtualhost *443

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile "conf/ssl.crt/certificate.crt"
    SSLCertificateKeyFile "conf/ssl.key/certificate.key"
    SSLCertificateChainFile "conf/ssl.crt/chain-file.ca-bundle"
    ServerAdmin you@mails.com
    DocumentRoot "C:/apache/htsecure/"
    ServerName secure.u4ik.us
    ServerAlias secure.u4ik.us
</VirtualHost>

<VirtualHost *:80>
    ServerAdmin you@mails.com
    DocumentRoot "C:/apache/htdocs/"
    ServerName u4ik.us
    ServerAlias www.u4ik.us
</VirtualHost>

Notice the two different document roots. Also notice that they listen for a specific domain. For the other part of making all subdomains go to x.y.com, use mod_rewrite:

Pop this in the .htaccess file:

<IfModule mod_rewrite.c>
   Options +FollowSymLinks
   Options +Indexes
   RewriteEngine On
   RewriteBase /
   RewriteCond %{HTTP_HOST} !www.domain.com$ [NC]
   RewriteCond %{HTTP_HOST} ^(www.)?([a-z0-9-]+).domain.com [NC]
   RewriteRule (.*) %2/$1 [L]
</IfModule>