Apache VirtualHost Alias Issue with wildcard subdomain

Question

I have an issue with Aliases on Apache on Ubuntu 10.04.3

What I am trying to do is as follows :-

• One subdomain (mydomain.domain.com) on port 80 - that redirects to port 443 of mydomain.domain.com

• One subdomain (mydomain.domain.com) on port 443 with SSlEngine on

• Wildcard subdomains (*.domain.com) on port 80 - that redirects to port 443 of *.domain.com:443

• Wildcard subdomains (*.domain.com) on port 443 with SSlEngine on

I've got one file in /etc/apache2/sites-available folder

<VirtualHost *:80>
    ServerName mydomain.domain.com
    DocumentRoot /var/www/mydomain
    DirectoryIndex index.cfm

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

<VirtualHost *:443>
    ServerName mydomain.domain.com:443
    DocumentRoot /var/www/mydomain
    DirectoryIndex index.cfm

RewriteEngine On
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-d
RewriteRule ^([a-zA-Z0-9/_/-]+)$ /index.cfm%{REQUEST_URI} [PT]


SSLEngine on
SSLProtocol -all +SSLv3 +TLSv1
...
...
</VirtualHost>

<VirtualHost *:80>
    ServerName something.domain.com
    ServerAlias *.domain.com
    DocumentRoot /var/www/mydomain_all
    DirectoryIndex index.cfm

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI}
</VirtualHost>

<VirtualHost *:443>
    ServerName something.domain.com:443
    ServerAlias *.domain.com:443
    DocumentRoot /var/www/mydomain_all
    DirectoryIndex index.cfm

RewriteEngine On
RewriteCond %{DOCUMENT_ROOT}%{REQUEST_URI} !-d
RewriteRule ^([a-zA-Z0-9/_/-]+)$ /index.cfm%{REQUEST_URI} [PT]


SSLEngine on
SSLProtocol -all +SSLv3 +TLSv1
...
...
</VirtualHost>

The problem is that all requests to anything.domain.com actually go to the first ssl VH ie mydomain.domain.com - have I got the order wrong? or something else wrong?

Answer 1

You'll need a NameVirtualHost *:443 directive for vhosts other than the first one on the port to function.

Depending on your Apache and OpenSSL versions, it may throw a warning during startup about multiple vhosts on an SSL port - feel free to ignore it.

Are you using the same certificate (hopefully a wildcard) for the two SSL vhosts, or different ones? If they're different, then connecting clients that do not support SNI will always get the certificate for the first vhost.