Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Please excuse if this is a beginner-level question, but I need some advice urgently.

I want to run two websites, say foo.org and bar.info, on the same server. Both should be reachable by http and https. My directory /etc/apache2/sites-enabled contains the files foo and bar.

The two files look like this (omitting some entries for logging):

foo

<VirtualHost *:80>
    ServerAdmin admin@foo.org

    ServerName www.foo.org
    DocumentRoot /var/www/dir
    ServerAlias foo.org foo.de www.foo.de
        RewriteEngine On
        RewriteOptions inherit

</VirtualHost>
<VirtualHost *:443>
    ServerAdmin admin@foo.org

    ServerName www.foo.org

    DocumentRoot /var/www/dir
    ServerAlias www.foo.de
    RewriteEngine On
    RewriteOptions inherit
#         # SSL Specific options
        SSLEngine on
        SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
        SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
    SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
</VirtualHost>

bar

<VirtualHost *:80>
        ServerAdmin cls@bar.info

        ServerName blog.bar.info
        DocumentRoot /var/www/bar/blog
        ServerAlias www.blog.bar.info
        RewriteEngine On
        RewriteOptions inherit

</VirtualHost>
<VirtualHost *:80>
        ServerAdmin cls@bar.info

        ServerName analytics.bar.info
        DocumentRoot /var/www/bar/analytics
#        ServerAlias 
        RewriteEngine On
        RewriteOptions inherit
</VirtualHost>
<VirtualHost *:443>
        ServerAdmin cls@bar.info

        ServerName blog.bar.info

        DocumentRoot /var/www/bar/blog
        RewriteEngine On
        RewriteOptions inherit
#         # SSL Specific options
        SSLEngine on
        SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
        SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
        SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
</VirtualHost>

The main problem is that when accessing https://foo.org, it is now redirected to https://blog.bar.info.

With http, it seems to work fine.

What is my error? Also: How can I ensure that one site is never ever redirected to the other?

EDIT: The ports.conf file contains:

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default
# This is also true if you have upgraded from before 2.2.9-3 (i.e. from
# Debian etch). See /usr/share/doc/apache2.2-common/NEWS.Debian.gz and
# README.Debian.gz

NameVirtualHost *:80
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>
share|improve this question

2 Answers 2

up vote 3 down vote accepted

When you say "redirecting", you mean it's just serving the wrong content without the URL in the client browser changing, correct? My guess is that you don't have a NameVirtualHost *:443 directive in your config - in the Debian config structure that you have, this should be in ports.conf.

Be careful with this setup, though. Running with just the self-signed SSL cert is just fine for testing, but will cause you issues if you don't account for it when this is opened to the internet.

You'll need one of these three things for this to function without errors when exposed to the public:

  • A single SSL certificate that covers both domains. This is called a SAN or UCC cert, and costs more than two regular certs would to cover the two different domains.
  • A different IP address for each SSL site, each with its own certificate.
  • Assurances that all of the client browsers accessing your site are capable of TLS SNI, which would allow for you to configure each site with a different certificate all on the same IP address. Until Windows XP starts to fade away in 2014, don't bet on this for most public sites.

Edit:

To cause the client to get an error when they attempt to access a site for with there's no SSL <VirtualHost> configured, you'll need to modify the default virtual host on 443.

The first <VirtualHost *:443> block to load takes on the role of "default", serving all the requests for names not matching the ServerName or ServerAlias in another <VirtualHost *:443> block. So, let's create a "default" that serves up nothing but errors, while requests for the other configured sites still get the correct handling.

  • Create a file in /etc/apache2/sites-available named 0-ssl-default or something similarly early in the alphabet, with content like this:

    <VirtualHost *:443>
        ServerName default-ssl-catch-all
        <Location />
           Order allow,deny
           Deny from all
        </Location
    </VirtualHost>
    
  • Enable that with a2ensite 0-ssl-default, then restart Apache.

share|improve this answer
    
"redirecting": Yes, I guess redirection is not the correct term. It serves the wrong content, the URL stays. I am now trying to add the NameVirtualHost*:443 directive. –  cls Jul 25 '12 at 7:22
    
I've added the NameVirtualHost *:443 as described in the ports.conf file, and this solves the issue that the wrong content is served. Thank you. What still bugs me, though, is that I cannot remove the <VirtualHost: *443> entry for the bar.info site without https://blog.bar.info serving the content of https://foo.org. I'd rather have an error message in this case. I'll try to consider your advice on the SSL setup in the future. –  cls Jul 25 '12 at 7:44
    
@cls See my edit for information on how to get those requests to error. –  Shane Madden Jul 25 '12 at 15:59

In your www.foo.org port 443 configuration you need to configure the ServerAlias to contain an entry for foo.org

ServerAlias foo.org foo.de www.foo.de
share|improve this answer
    
I changed the ServerAlias as you wrote, but this did not solve the problem (foo.org serves blog.bar.info) –  cls Jul 25 '12 at 7:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.