Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a CentOS 6 server with Apache (httpd-2.2.15-15.el6.centos.x86_64). Now I configured TLS SNI using OpenSSL and that was pretty easy.

Now I have two TLS vhosts on the same ip and I want to specify which one should be the default it the client does not support TLS SNI (yes, I'm looking at you, git/hg).

Looking at the Apache docs there should be at least two ways to do this:

  • set for the default host (and *:443 for all others)
  • set "SSLStrictSNIVHostCheck on" for the non-default hosts.

Unfortunately neither method works for me. Can someone explain to me how to achieve the goal anyway and why the two methods above don't work as I expected?

share|improve this question

1 Answer 1

1st enabled will be the default one so rename the config file of the default vhost to something like 00-config_file_name so it is the 1st loaded.

As you (rightfully) would like something documented:

From Apache docs: An In-Depth Discussion of Virtual Host Matching

Name-based vhost

If the entry corresponds to a name-based vhost the name list contains one or more vhost structures. This list contains the vhosts in the same order as the VirtualHost directives appear in the config file.

The first vhost on this list (the first vhost in the config file with the specified IP address) has the highest priority and catches any request to an unknown server name or a request without a Host: header field.

If the client provided a Host: header field the list is searched for a matching vhost and the first hit on a ServerName or ServerAlias is taken and the request is served from that vhost. A Host: header field can contain a port number, but Apache always matches against the real port to which the client sent the request.

So if you use only 1 config file for your vhosts, you need to order them in the file and if you include several separated files (including ../sites-enabled directory which is the way Apache2 sample site is defined) you need to load the files in the order you need to define the default site first and they are loaded according to the directory alphabetical order.

Always according to the same Apache doc (following examples link in the page), if you use _default_ vhost, it must be defined before other vhosts and that's exactly what you will be doing defining the vhost in the order you want but when using _default_ vhost, the main server will not respond anymore to requests.

share|improve this answer
    
If possible, I'd like to keep the vhost names like they are as they use a pretty structured format. Also I find the file naming workaround a bit clumsy as the knowledge about default vhost/file naming is implicit (as opposed to an apache directive which I can google/document). –  Felix Schwarz Jan 15 '12 at 21:02
    
@FelixSchwarz The first <VirtualHost> to load that matches your NameVirtualHost directive will be default. There is no way whatsoever to change this using directives or the _default_ address declaration (which will only serve to render that vhost completely inactive). –  Shane Madden Jan 15 '12 at 22:05
    
@FelixSchwarz, you don't need to change the vhost name, only the name of the file containing the vhost definition (or only the name of the slink that goes in .../apache2/sites-enabled directory.). The vhost files are loaded following the order they appear in .../sites-enabled directory –  laurent Jan 15 '12 at 22:24
    
updated answer with documentation link from Apache Docs –  laurent Jan 15 '12 at 23:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.