Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.


I have a domain: www.example.com and I need this domain to be reachable both via https and http.
I have a certificate (GeoTrust) that protects www.example.com and example.com.

I need to protect app.example.com, as well.
app.example.com is somthing that needs to be reachable ONLY via https, but it doesn't need a proper certificate: a self signed one is enough.

I tried many different configurations (even using the same certificate for both the main domain and the subdomain), but nothing worked!
The following configuration is the latter I tried but the result is that if I connect to app.example.com, it tells me the connection is untrusted and then, once accepted, it redirects me to www.example.com!

Any help? thank you.

<VirtualHost *:80>
DocumentRoot "/var/websiteexample/public/www"
ServerName www.example.com
ServerAlias example.com
<Directory "/var/websiteexample/public/www">
allow from all
Options +Indexes
</Directory>
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/var/websiteexample/public/www"
ServerName www.example.com
ServerAlias example.com
SSLEngine on
SSLCertificateFile /root/www.example.com.crt
SSLCertificateKeyFile /root/www.example.com.key
<Directory "/var/websiteexample/public/www">
allow from all
Options +Indexes
</Directory>
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/path/to/another/app"
ServerName app.example.com
SSLEngine on
SSLCertificateFile /root/app.example.com.pem
<Directory "/path/to/another/app">
allow from all
Options +Indexes
</Directory>
</VirtualHost>
share|improve this question
add comment

2 Answers

up vote 3 down vote accepted
  • added SSLEngine on to serverconfig
  • added SSLStrictSNIVHostCheck on to serverconfig - SNI for multiple certificates, exclude non SNI capable clients
  • added SSLCertificateKeyFile /root/app.example.com.key - you need a private key for both vhosts

Here is the new configuration:

SSLEngine on
SSLStrictSNIVHostCheck on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:-MEDIUM

<VirtualHost *:80>
    DocumentRoot "/var/websiteexample/public/www"
    ServerName www.example.com
    ServerAlias example.com
    <Directory "/var/websiteexample/public/www">
        allow from all
        Options +Indexes
    </Directory>
</VirtualHost>

<VirtualHost *:443>
    DocumentRoot "/var/websiteexample/public/www"
    ServerName www.example.com
    ServerAlias example.com
    #You might also need: SSLCertificateChainFile 
    SSLCertificateFile /root/www.example.com.crt
    SSLCertificateKeyFile /root/www.example.com.key
    <Directory "/var/websiteexample/public/www">
        allow from all
        Options +Indexes
    </Directory>
</VirtualHost>

<VirtualHost *:443>
    DocumentRoot "/path/to/another/app"
    ServerName app.example.com
    SSLCertificateFile /root/app.example.com.pem
    SSLCertificateKeyFile /root/app.example.com.key
    <Directory "/path/to/another/app">
        allow from all
        Options +Indexes
    </Directory>
</VirtualHost>
share|improve this answer
    
Thank for your help, but unfortunately Apache fails to reboot with an error on this directive: SSLStrictSNIVHostCheck on. I tried to Google for an explanation but I couldn't find out which directive I have to enable in order to make it work... –  tobia.zanarella May 24 '12 at 14:25
    
what apache version do you use? did you enable modssl? could you post the errror message? –  JMW May 24 '12 at 14:40
add comment

You can't do name-based vhosting with SSL because the name comes from the "Host:" header, which is part of what's encrypted. You would need to choose the key before knowing which key to choose.

Generally, one uses an additional IP address for each unique keypair. You can find some great examples and explanation at http://wiki.apache.org/httpd/NameBasedSSLVHosts

share|improve this answer
3  
You might want to read about SNI. –  Oliver May 24 '12 at 7:31
    
I believe this to be currently untrue in some setups. I have a VPS setup with a single IP address and name-based hosts (although using Nginx rather than Apache), and each one has its own SSL setup. Note that you can't use any advanced features (such as Extended Validation) with this setup, but assuming you're not too worried about verifying my identity it's trivial for me to encrypt communications to my website so that passwords and suchlike aren't sent in plain text. –  gac May 24 '12 at 7:32
1  
People really need to stop replying with myths about SSL. SNI has been around for a bit now, it just happens to not work on a particularly shitty OS. –  gparent May 24 '12 at 14:46
    
@gparent: SNI has been around for a bit now, but not working in IE in Windows XP is still a pretty big support gap. –  rjewell Jun 25 '12 at 22:06
    
Never said it wasn't. –  gparent Jun 26 '12 at 6:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.