Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've never setup SSL before and I think I got it to work and everything works right, but I have this odd issue right now. Lets say my website is called www.example.com. I also have a staging.example.com site on the same server. Someone who was using staging a little while ago was actually editing the production site. After some investigation I found out that https://staging.example.com is actually www.example.com! By using HTTPS it defaults to the the production site.

I'm assuming the issue is that if you put in the IP address of the server, it brings up the production site and https is just directing people to that. Is there a way to work around this or disable HTTPS for staging? Thanks.

share|improve this question
    
What's your config for the vhosts look like? –  Shane Madden Dec 8 '11 at 18:27
    
I just redid my config and noticed that the server name was blank. I put in the proper name. Now when I visit HTTPS staging I get a certificate error, which is big step up from nothing! Can I get it to block the site altogether? –  DrZaiusApeLord Dec 13 '11 at 16:00
    
Also: <VirtualHost 127.0.1.1:433> ServerName www.example.com ServerAlias www.example.com DocumentRoot /var/wwww SSLCertificateFile /etc/apache2/ssl/webcert.crt SSLCertificateKeyFile /etc/apache2/ssl/private.crt SSLCACertificateFile /etc/apache2/ssl/intermediate.crt </VirtualHost> –  DrZaiusApeLord Dec 13 '11 at 16:13

2 Answers 2

To prevent someone accessing the production site with https://staging.example.com, you'll want to separate those requests out from the production requests.

The simpler way to do it would be something like this:

NameVirtualHost *:443

#existing SSL vhost
<VirtualHost *:443>
    ServerName production.example.com
    SSLEngine on
    #...
    #all of your existing config
    #...
</VirtualHost>

#staging - will deny all requests
<VirtualHost *:443>
    ServerName staging.example.com
    SSLEngine on
    SSLCertificateFile /cert/file.pem
    #...
    #other SSL config, logging, etc
    #...
    Order allow,deny
    Deny from all
</VirtualHost>

If for some reason you're not able to mess with NameVirtualHost, you can also get the same effect (but a bit less efficient) with some mod_rewrite:

RewriteEngine on
RewriteCond %{HTTP_HOST} ^staging [NC]
RewriteRule ^ - [F]
share|improve this answer
    
Just saw that your existing vhost is 127.0.1.1:433 - I'm assuming that you've got something proxying requests to Apache? In that situation, just replace *:443 in the 3 locations in the first option with 127.0.1.1:443. –  Shane Madden Dec 13 '11 at 16:28

HTTPS does not support virtualhosts. When you access a HTTPS site, no matter what domain name you have typed in, you'll get the default SSL virtualhost for that IP.

share|improve this answer
    
Yeah I kinda figured that. Hmm, any workarounds? I guess I can detect URL with php and throw an error, but I dont want to run this php on every single page. Can I tell apache no default site via htacess? –  DrZaiusApeLord Dec 8 '11 at 16:02
    
@ceejayoz Huh? Even without SNI (even if the Apache server isn't running with SNI support at all), an HTTPS port with NameVirtualHost set on it will direct to different vhosts based on host header. Multiple vhosts all running with the same wildcard or alternate name certificate is a common deployment for this scenario. –  Shane Madden Dec 8 '11 at 18:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.