How to Enable multiple SSL vhosts and certificates on a single IP with Apache

Question

I want to enable support in Apache for multiple SSL vhosts and certificates on a single IP address.

My configuration file is as follows. Please help me:

NameVirtualHost 196.196.1.117:443
NameVirtualHost 196.196.1.117:80

#Site Configuration on Port 80
<VirtualHost  196.196.1.117:80> 
    DocumentRoot "/usr/local/tomcat/webapps/ROOT" 
    ServerName   sample_Site
    ServerAlias  w3.sample.com
    ServerAdmin  www.w3.sample.com
    ErrorLog    /var/log/apache2/site-error_log  
    CustomLog   /var/log/apache2/site-access_log combined 

      <Directory "/usr/local/tomcat/webapps/ROOT">
      AllowOverride All
      Options +ExecCGI -Includes
      Order allow,deny
      Allow from all
      </Directory>

      JkMount /* worker1    
      DirectoryIndex home.xhtml 
      Redirect /mb  https://196.196.1.117/mb


    ErrorDocument 400 /error.xhtml
    ErrorDocument 401 /error.xhtml
    ErrorDocument 403 /error.xhtml
    ErrorDocument 404 /error.xhtml
    ErrorDocument 405 /error.xhtml
    ErrorDocument 408 /error.xhtml
    ErrorDocument 410 /error.xhtml
    ErrorDocument 411 /error.xhtml
    ErrorDocument 412 /error.xhtml
    ErrorDocument 413 /error.xhtml
    ErrorDocument 414 /error.xhtml
    ErrorDocument 415 /error.xhtml
    ErrorDocument 500 /error.xhtml
    ErrorDocument 501 /error.xhtml
    ErrorDocument 502 /error.xhtml
    ErrorDocument 503 /error.xhtml
    ErrorDocument 506 /error.xhtml

</VirtualHost>

#Site Configuration on Port 443

<VirtualHost 196.196.1.117:443>
    DocumentRoot "/usr/local/tomcat/webapps/ROOT"
    ServerName sample_Site
    ErrorLog /var/log/apache2/HttpsSite_error_log
    CustomLog /var/log/apache2/Https-accessSite_log combined 

       <Directory "/usr/local/tomcat/webapps/ROOT">
     SSLRequireSSL
        Order Deny,Allow
        Allow from All
       </Directory>

       JkMount /* worker1 
       DirectoryIndex home.xhtml 

    ErrorDocument 400 /error.xhtml
    ErrorDocument 401 /error.xhtml
    ErrorDocument 403 /error.xhtml
    ErrorDocument 404 /error.xhtml
    ErrorDocument 405 /error.xhtml
    ErrorDocument 408 /error.xhtml
    ErrorDocument 410 /error.xhtml
    ErrorDocument 411 /error.xhtml
    ErrorDocument 412 /error.xhtml
    ErrorDocument 413 /error.xhtml
    ErrorDocument 414 /error.xhtml
    ErrorDocument 415 /error.xhtml
    ErrorDocument 500 /error.xhtml
    ErrorDocument 501 /error.xhtml
    ErrorDocument 502 /error.xhtml
    ErrorDocument 503 /error.xhtml
    ErrorDocument 506 /error.xhtml

    SSLEngine on
    #SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCipherSuite ALL:!ADH:!EXPORT56:+SSLv3:TLSv1
    SSLCertificateFile /etc/apache2/ssl.crt/sb24.crt
    SSLCertificateKeyFile /etc/apache2/ssl.key/sb24.key
    <Files ~ "\.(cgi|shtml|phtml|php3?)$">
        SSLOptions +StdEnvVars
    </Files>
    <Directory "/srv/www/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>

    SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0

    CustomLog /var/log/apache2/ssl_request_log   ssl_combined
    SetEnv HTTPS on 
    SetEnv SERVER_PORT 443

</VirtualHost>


#Admin Configuration on Port 443

<VirtualHost 196.196.1.117:443>

    DocumentRoot "/usr/local/tomcat1/webapps/SB24_Admin"
    ServerName SB24Admin
    ErrorLog /var/log/apache2/admin_error_log
    CustomLog /var/log/apache2/admin-access_log combined 

       <Directory "/usr/local/tomcat1/webapps/SB24_Admin">
     SSLRequireSSL
        Order Deny,Allow
        Allow from All
       </Directory>

    JkMount /* worker2 
       DirectoryIndex home.xhtml 

        ErrorDocument 400 /error.xhtml
       ErrorDocument 401 /error.xhtml
        ErrorDocument 403 /error.xhtml
        ErrorDocument 404 /error.xhtml
        ErrorDocument 405 /error.xhtml
        ErrorDocument 408 /error.xhtml
        ErrorDocument 410 /error.xhtml
        ErrorDocument 411 /error.xhtml
        ErrorDocument 412 /error.xhtml
        ErrorDocument 413 /error.xhtml
        ErrorDocument 414 /error.xhtml
        ErrorDocument 415 /error.xhtml
        ErrorDocument 500 /error.xhtml
        ErrorDocument 501 /error.xhtml
        ErrorDocument 502 /error.xhtml
        ErrorDocument 503 /error.xhtml
        ErrorDocument 506 /error.xhtml

       SSLEngine on
    #SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
    SSLCipherSuite ALL:!ADH:!EXPORT56:+SSLv3:TLSv1
    SSLCertificateFile /etc/apache2/ssl.crt/sb24.crt
    SSLCertificateKeyFile /etc/apache2/ssl.key/sb24.key
    <Files ~ "\.(cgi|shtml|phtml|php3?)$">
        SSLOptions +StdEnvVars
    </Files>
    <Directory "/srv/www/cgi-bin">
        SSLOptions +StdEnvVars
    </Directory>

    SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0
    CustomLog /var/log/apache2/ssl_request_log   ssl_combined

    SetEnv HTTPS on 
    SetEnv SERVER_PORT 443

</VirtualHost>

Answer 1

This can only be done if both your server and the web browser supports Server Name Indication (SNI). See this Apache page for details.

http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts2

If you are not running the latest Apache (greater than 2.2.12) then you can't run multiple SSL sites with different SSL certs on the same IP & port (443).

Answer 2

there is also a wildcard SSL option, however that is only useful for hosting virtual hosts like so;

subdomain1.mybadger.com
subdomain2.mybadger.com
subdomain3.mybadger.com

Answer 3

Use gnutls, not SSL See this page for details

http://www.howtoforge.com/hosting-multiple-ssl-web-sites-on-one-ip-address-with-apache-2.2-and-gnutls-debian-lenny

Also, some Reverse Proxies let you accomplish the same things.