Domains and subdomains virtualhosts with different SSL certificates

Question

I have a domain: www.example.com and I need this domain to be reachable both via https and http.
I have a certificate (GeoTrust) that protects www.example.com and example.com.

I need to protect app.example.com, as well.
app.example.com is somthing that needs to be reachable ONLY via https, but it doesn't need a proper certificate: a self signed one is enough.

I tried many different configurations (even using the same certificate for both the main domain and the subdomain), but nothing worked!
The following configuration is the latter I tried but the result is that if I connect to app.example.com, it tells me the connection is untrusted and then, once accepted, it redirects me to www.example.com!

Any help? thank you.

    <VirtualHost *:80>
        DocumentRoot "/var/websiteexample/public/www"
        ServerName www.example.com
        ServerAlias example.com
        <Directory "/var/websiteexample/public/www">
            allow from all
            Options +Indexes
        </Directory>
    </VirtualHost>

    <VirtualHost *:443>
        DocumentRoot "/var/websiteexample/public/www"
        ServerName www.example.com
        ServerAlias example.com
        SSLEngine on
        SSLCertificateFile /root/www.example.com.crt
        SSLCertificateKeyFile /root/www.example.com.key
        <Directory "/var/websiteexample/public/www">
            allow from all
            Options +Indexes
        </Directory>
    </VirtualHost>

    <VirtualHost *:443>
        DocumentRoot "/path/to/another/app"
        ServerName app.example.com
        SSLEngine on
        SSLCertificateFile /root/app.example.com.pem
        <Directory "/path/to/another/app">
            allow from all
            Options +Indexes
        </Directory>
    </VirtualHost>

Answer 1

• added SSLEngine on to serverconfig
• added SSLStrictSNIVHostCheck on to serverconfig - SNI for multiple certificates, exclude non SNI capable clients
• added SSLCertificateKeyFile /root/app.example.com.key - you need a private key for both vhosts

Here is the new configuration:

SSLEngine on
SSLStrictSNIVHostCheck on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:-MEDIUM

<VirtualHost *:80>
    DocumentRoot "/var/websiteexample/public/www"
    ServerName www.example.com
    ServerAlias example.com
    <Directory "/var/websiteexample/public/www">
        allow from all
        Options +Indexes
    </Directory>
</VirtualHost>

<VirtualHost *:443>
    DocumentRoot "/var/websiteexample/public/www"
    ServerName www.example.com
    ServerAlias example.com
    #You might also need: SSLCertificateChainFile 
    SSLCertificateFile /root/www.example.com.crt
    SSLCertificateKeyFile /root/www.example.com.key
    <Directory "/var/websiteexample/public/www">
        allow from all
        Options +Indexes
    </Directory>
</VirtualHost>

<VirtualHost *:443>
    DocumentRoot "/path/to/another/app"
    ServerName app.example.com
    SSLCertificateFile /root/app.example.com.pem
    SSLCertificateKeyFile /root/app.example.com.key
    <Directory "/path/to/another/app">
        allow from all
        Options +Indexes
    </Directory>
</VirtualHost>

Answer 2

You can't do name-based vhosting with SSL because the name comes from the "Host:" header, which is part of what's encrypted. You would need to choose the key before knowing which key to choose.

Generally, one uses an additional IP address for each unique keypair. You can find some great examples and explanation at http://wiki.apache.org/httpd/NameBasedSSLVHosts