Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two different sites in one server: a.com and b.com.

If I use named virtualhost on ssl port, IE won't work.

So, I decided to use port 444 for SSL for b.com. However, it seems all browsers give error message:

Chrome: Error 107 ssl protocol error
Firefox: Error code: ssl_error_rx_record_too_long
Epiphany: SSL handshake failed

Umm.. I don't know why, but I do have seen some web sites can be accessed like https://example.com:1443.

Or did I miss something?


ports.conf:

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    NameVirtualHost *:443
    NameVirtualHost *:444
    Listen 443
    Listen 444
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
    Listen 444
</IfModule>

b.site:

<VirtualHost *:444>
    ServerName  www.b.com:444
    ServerAdmin admin@b.com

    LogLevel  error
    ErrorLog  /var/log/apache2/b_error.log
    CustomLog /var/log/apache2/b_access.log combined

    DocumentRoot ...

    <Directory ...>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    SSLEngine on
    SSLCertificateFile    /etc/ssl/certs/b.crt
    SSLCertificateKeyFile /etc/ssl/private/b.pem

</VirtualHost>

CA config file to generate the certificate:

[ca]
default_ca              = CA_default

[CA_default]
x509_extensions         = root_ca_extensions

[req]
default_bits            = 4096
default_keyfile         = 
distinguished_name      = req_distinguished_name
attributes              = req_attributes
prompt                  = no
x509_extensions         = v3_ca
req_extensions          = v3_req

[req_distinguished_name]
C     = ...
ST   = ..
O     = ...
OU   = ..
CN   = ...
emailAddress        = ca@b.com

[req_attributes]

[root_ca_extensions]
basicConstraints        = CA:true

[v3_ca]
basicConstraints        = CA:true

[v3_req]
basicConstraints        = CA:false
keyUsage                = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName          = @alt_names

[alt_names]
DNS.1 = b.com
DNS.2 = www.b.com
share|improve this question
    
1  
Update the question with the configuration for port 444's VirtualHost block –  DerfK Jun 7 '12 at 2:06
    
It is likely your apache config is not correct. Perhaps the listening ports are not set right. If you post a config, we can provide better help –  uSlackr Jun 7 '12 at 2:09

2 Answers 2

The answer is yes.

It's my mistake, I have setup 127.0.0.1 www.b.com in the /etc/hosts. Then, however I change the apache config files in the remote server, my browser always resolves www.b.com to my localhost, where there is a broken certificate.

share|improve this answer

Not 100% sure if this is the problem.. but try to remove the :444 from the ServerName line so it looks like

ServerName  www.b.com

The port isn't needed since the browser connects on that port but the host header will still be www.b.com no matter what port is used..

share|improve this answer
    
I've just added the port number to see if it works. So, no luck whether or not there is a port number. –  Xiè Jìléi Jun 7 '12 at 2:34
    
generally when I see this it means the browser is talking https on a http port. Is there anything in the error log for the main server or the vhost on startup or connection? –  Mike Jun 7 '12 at 2:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.