4

I have recently created an SSL cert on my server *.key and a *csr file.

I then created the *crt and the *.ca-bundle with Comodo.

I have 2 current vhosts:

vhost for - http://www.example.com

NameVirtualHost *:80
<VirtualHost *:80>
    ServerAdmin [email protected]
    DocumentRoot "/home/example/public_html/example.com/httpdocs"
    ServerName example.com
    ServerAlias www.example.com
</VirtualHost>

vhost for https://www.example.com

NameVirtualHost *:443
<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/example_com.crt
    SSLCertificateKeyFile /etc/ssl/certs/server.key
    <Directory /home/example/public_html/example.com/httpdocs>
    AllowOverride All
    </Directory>
    DocumentRoot /home/example/public_html/example.com/httpdocs
    ServerName example.com
</VirtualHost>

The problem is, when I go to https://www.example.com I get a 404

I'm not sure if the vhost(s) is correct or why I get a 404. Has anyone ever seen this before?

I have enabled mod_ssl and restarted apache

Many Thanks

Improve this question

3 Answers 3

Reset to default
1

Without special tricks, HTTPS does not support NameVirtualHosts; remove NameVirtualhost *:443 from the config.

That said, the ServerName does not match the certificate CN - change it to www.example.com.

Restart apache.

Improve this answer
4
  • the www.example.com is this in the SSL vhost? I'm pretty sure the SSL was generated by Comodo for example.com rather than www.example.com
    – terrid25
    Mar 1, 2012 at 12:37
  • You haven't shown us what the certificate is for. I am going off the statement that the SSL vhost was for www.example.com - which is incorrect, the ServerName states example.com.
    – adaptr
    Mar 1, 2012 at 12:44
  • I have a site on example.com I have an ecommerce stroe running on www.example.com/shop I'd like the SSL cert to cover the shpop in terms of login (example.com/shop/account/login). This currently works with http:// but gives a 404 on the https:// version
    – terrid25
    Mar 1, 2012 at 14:43
  • Either the certificate must cover both hostnames, using a wildcard or SAN, or the resulting visits will pop up the browser warning about mixing secure and insecure data.
    – adaptr
    Mar 1, 2012 at 14:53
1

The default SSL vhost in ssl.conf is doing two things:

  1. It gets to choose which certificate is presented to clients that don't support SNI.
  2. It gets all requests that don't match the ServerName or ServerAlias on another name-based vhost.

Simply removing the NameVirtualHost command won't help, as the vhost in ssl.conf will then get every request to port 443. Instead, disable that vhost completely; you don't want or need it.

And you'll still have a certificate mismatch to deal with; your cert needs to cover the hostname that your clients are using.

Improve this answer
4
  • Ok so my understanding is this: 1)Remove the NameVirtualHost from the sslvhost 2)Comment out the <VirtualHost> in ssl.conf 3)Add the www.example.com ServerAlias to the sslvhost. Is this correct?
    – terrid25
    Mar 2, 2012 at 9:04
  • 1
    Only step 2 is actually needed to get it working - but do the other two as well, to make your config easier to understand and maintain. Also, verify that no other vhosts are trying to take port 443; apache2ctl -S.
    – Shane Madden
    Mar 2, 2012 at 15:58
  • Ok. Step 1) done. Step 2) Do I comment out the whole VirtualHost and it's content?. Step 3) Done
    – terrid25
    Mar 4, 2012 at 13:44
  • 1
    Yes - either comment every line or just remove it completely.
    – Shane Madden
    Mar 4, 2012 at 18:58
-1

Add ServerAlias www.example.com to the SSL enabled vhost.

Improve this answer
5
  • 1
    That won't make a bit of difference, as SSL cannot not choose a vhost before making a secure connection. Classic chicken-and-egg. Your solution only works if he has no other 443 vhosts, or this vhost is always the first one listed. Just Say No.
    – adaptr
    Mar 1, 2012 at 11:31
  • There is only one 443 vhost on the server.
    – terrid25
    Mar 1, 2012 at 12:29
  • 1
    You're partly right but the question was how to solve the 404. Even if there are multiple SSL vhosts (which we don't know for sure in this case) this would only throw an SSL warning to the browser about mismatching certificate/domain, it wouldn't throw a 404.
    – fim
    Mar 1, 2012 at 12:32
  • There is a default vhost in the ssl.conf file. I haven't touched that. I'll remove the NameVirtualHost and restart
    – terrid25
    Mar 1, 2012 at 12:41
  • @fim pedantically, he hasn't asked for anything ;) The SSL mismatch is going to cause more issues going forward if he doesn't understand how it interacts.
    – adaptr
    Mar 1, 2012 at 12:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .