Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to setup Apache(2.2.3) to run two websites with SSL using both different domains and IP addresses. Both websites run fine on port 80 but when I tried to enable SSL for website2 I get a ssl_error_bad_cert_domain error; website2 picks up the SSL cert for website1.

Here is my setup in httpd.conf:

# Website1
NameVirtualHost 192.168.10.1:80

<VirtualHost 192.168.10.1:80>
DocumentRoot /var/www/html
ServerName www.website1.org
</VirtualHost>

NameVirtualHost 192.168.10.1:443

<VirtualHost 192.168.10.1:443>
SSLEngine On
SSLCertificateFile conf/ssl/website1.cer
SSLCertificateKeyFile conf/ssl/website1.key
</VirtualHost>

# Website2
NameVirtualHost 192.168.10.2:80

<VirtualHost 192.168.10.2:80>
DocumentRoot /var/www/html/chart
ServerName www.website2.org
</VirtualHost>

NameVirtualHost 192.168.10.2:443

<VirtualHost 192.168.10.2:443>
SSLEngine On
SSLCertificateFile conf/ssl/website2.cer
SSLCertificateKeyFile conf/ssl/website2.key
</VirtualHost>

Update: In answer to Shane (this wouldn't fit in comment box) here is the output from apachectl -S:

VirtualHost configuration:
192.168.10.2:80       is a NameVirtualHost
         default server www.website2.org (/etc/httpd/conf/httpd.conf:1033)
         port 80 namevhost www.website2.org (/etc/httpd/conf/httpd.conf:1033)

192.168.10.2:443      is a NameVirtualHost
         default server bogus_host_without_reverse_dns (/etc/httpd/conf/httpd.conf:1040)
         port 443 namevhost bogus_host_without_reverse_dns (/etc/httpd/conf/httpd.conf:1040)

192.168.10.1:80       is a NameVirtualHost
         default server www.website1.org (/etc/httpd/conf/httpd.conf:1017)
         port 80 namevhost www.website1.org (/etc/httpd/conf/httpd.conf:1017)

192.168.10.1:443      is a NameVirtualHost
         default server bogus_host_without_reverse_dns (/etc/httpd/conf/httpd.conf:1024)
         port 443 namevhost bogus_host_without_reverse_dns (/etc/httpd/conf/httpd.conf:1024)

wildcard NameVirtualHosts and _default_ servers:
_default_:443          192.168.10.1 (/etc/httpd/conf.d/ssl.conf:81)
Syntax OK
share|improve this question

migrated from stackoverflow.com Apr 12 '12 at 14:53

This question came from our site for professional and enthusiast programmers.

    
What output do you get from apache2ctl -S? –  Shane Madden Apr 12 '12 at 14:55
    
Can you confirm your .website2.org is resolved to 192.168.10.2? –  Dennis Cheung Oct 28 '13 at 3:07

6 Answers 6

SSL vhosts are not NameVirtualHosts - they're IP-based vhosts.

Remove the NameVirtualHost *:443 from your config.

share|improve this answer
    
I don't have NameVirtualHost *:443 in my httpd.conf file. –  Tom Apr 12 '12 at 15:45
    
You have two. Remove them. –  adaptr Apr 12 '12 at 15:45
    
I removed both and restarted apache but the website2 is still inheriting the SSL cert from website1. –  Tom Apr 12 '12 at 16:04

Please remove

NameVirtualHost 192.168.10.1:443

and

NameVirtualHost 192.168.10.2:443

It doesn't make sense to activate the name based virtual hosting stuff of Apache for SSL/TLS connections or you'd like to use the SNI extension.

share|improve this answer
    
I removed those lines, it didn't solve the problem. –  Tom Apr 12 '12 at 19:25
    
Please remove the default section in your ssl.conf file as well (see Shane Madden's comment) –  Jens Bradler Apr 13 '12 at 6:42

Here is how I got it working. I had to move the ssl configuration out of httpd.conf and setup two virtualhosts in ssl.conf.

httpd.conf

# Website1
<VirtualHost 192.168.10.1:80>
DocumentRoot /var/www/html
ServerName www.website1.org
</VirtualHost>

# Website2
<VirtualHost 192.168.10.2:80>
DocumentRoot /var/www/html/chart
ServerName www.website2.org
</VirtualHost>

ssl.conf

<VirtualHost 192.168.10.1:443>
DocumentRoot "/var/www/html/"
ServerAdmin you@your-site.com
ServerName www.website1.org
SSLEngine On
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:
+EXP:+eNULL
SSLCertificateFile /etc/httpd/conf/ssl.crt/website1.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/website1.key
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
</VirtualHost>

<VirtualHost 192.168.10.2:443>
DocumentRoot "/var/www/html/chart/"
ServerAdmin you@your-site.com
ServerName www.website2.org
SSLEngine On
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:
+EXP:+eNULL
SSLCertificateFile /etc/httpd/conf/ssl.crt/website2.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/website2.key
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
</VirtualHost>
share|improve this answer
    
This is more or less what everyone here tried to recommend ;-) . Apache includes different files for configuration purposes. So its required to check all of them or to get a output of "apache2ctl -S". Anyway I like the way most administrators are going to split the configuration into different files. So you keep the overview about all the different settings (usually). –  Jens Bradler Apr 15 '12 at 8:15

Try removing or commenting out the <VirtualHost _default_:443> block in /etc/httpd/conf.d/ssl.conf.

share|improve this answer
    
I tried this too, then stopped and started apache but the problem still exists. –  Tom Apr 12 '12 at 19:34
    
Has Apache ever presented the correct certificate? Say, when you access the site with a SNI-capable browser? –  Shane Madden Apr 12 '12 at 19:40
    
No, I've been hitting the site w/ Firefox 11, latest Chrome, IE 9 and never get correct cert. If I modify my httpd.conf to list website2 before website1 then the issue is reversed website2 has the correct cert but website1 now inherits website2 cert. –  Tom Apr 12 '12 at 19:53
    
Oh.. old Apache! What do your Listen directives look like? –  Shane Madden Apr 12 '12 at 19:55
    
Seriously, this is a whole lot easier in IIS.Within httpd.conf: Listen 80, within ssl.conf: Listen 443. –  Tom Apr 12 '12 at 20:02

You need ServerName www.server[1|2}.com in section

share|improve this answer

You can not use vhosts with SSL unless you use a fairly recent development called SNI. You could also use a wildcard cert (e.g. *.myhostname.com) if all your TLDs are the same.

For more detail, see:

share|improve this answer
1  
I thought it was possible as long as you have different IPs? –  Tom Apr 12 '12 at 16:06
    
Yes, of course, but then you are not using name based virtual hosts :) With name based vhosts, you are attaching several names to a single ip and telling the server how to sort them out. I've been through the same process you are now going through... although there are ways around it, they are not yet reliable or common. –  Brill Pappin Apr 12 '12 at 19:27
    
Do other solutions exist? I'd rather not run two instances of apache. –  Tom Apr 12 '12 at 19:34
    
@BrillPappin There aren't several names on any of those IP/port combinations? –  Shane Madden Apr 12 '12 at 19:39
    
Those two links I posted above should give you all the info an options you need. I think pretty much the only way your going to get what you want is if all the domains have the same TLD so you can use a while-card cert. However, you should not take my word as the last word, go check those links for other options. –  Brill Pappin Apr 13 '12 at 13:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.