Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've never setup SSL before and I think I got it to work and everything works right, but I have this odd issue right now. Lets say my website is called I also have a site on the same server. Someone who was using staging a little while ago was actually editing the production site. After some investigation I found out that is actually! By using HTTPS it defaults to the the production site.

I'm assuming the issue is that if you put in the IP address of the server, it brings up the production site and https is just directing people to that. Is there a way to work around this or disable HTTPS for staging? Thanks.

share|improve this question
What's your config for the vhosts look like? – Shane Madden Dec 8 '11 at 18:27
I just redid my config and noticed that the server name was blank. I put in the proper name. Now when I visit HTTPS staging I get a certificate error, which is big step up from nothing! Can I get it to block the site altogether? – DrZaiusApeLord Dec 13 '11 at 16:00
Also: <VirtualHost> ServerName ServerAlias DocumentRoot /var/wwww SSLCertificateFile /etc/apache2/ssl/webcert.crt SSLCertificateKeyFile /etc/apache2/ssl/private.crt SSLCACertificateFile /etc/apache2/ssl/intermediate.crt </VirtualHost> – DrZaiusApeLord Dec 13 '11 at 16:13

To prevent someone accessing the production site with, you'll want to separate those requests out from the production requests.

The simpler way to do it would be something like this:

NameVirtualHost *:443

#existing SSL vhost
<VirtualHost *:443>
    SSLEngine on
    #all of your existing config

#staging - will deny all requests
<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /cert/file.pem
    #other SSL config, logging, etc
    Order allow,deny
    Deny from all

If for some reason you're not able to mess with NameVirtualHost, you can also get the same effect (but a bit less efficient) with some mod_rewrite:

RewriteEngine on
RewriteCond %{HTTP_HOST} ^staging [NC]
RewriteRule ^ - [F]
share|improve this answer
Just saw that your existing vhost is - I'm assuming that you've got something proxying requests to Apache? In that situation, just replace *:443 in the 3 locations in the first option with – Shane Madden Dec 13 '11 at 16:28

HTTPS does not support virtualhosts. When you access a HTTPS site, no matter what domain name you have typed in, you'll get the default SSL virtualhost for that IP.

share|improve this answer
Yeah I kinda figured that. Hmm, any workarounds? I guess I can detect URL with php and throw an error, but I dont want to run this php on every single page. Can I tell apache no default site via htacess? – DrZaiusApeLord Dec 8 '11 at 16:02
@ceejayoz Huh? Even without SNI (even if the Apache server isn't running with SNI support at all), an HTTPS port with NameVirtualHost set on it will direct to different vhosts based on host header. Multiple vhosts all running with the same wildcard or alternate name certificate is a common deployment for this scenario. – Shane Madden Dec 8 '11 at 18:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.