Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Suppose that in a simplified scenario, I have a server hosting a single virtual host under Apache 2, and I would like any other attempt to access the server via IP or any other host to be denied. Further, I'd like an attempt to access the virtual host by HTTP to redirect to HTTPS.

Suppose the host is, so the scenario is:

This seems like it shouldn't be too difficult to do (should it?) but thus far the only way I've been able to make it work is by defining the host and the redirect, and then sending all other traffic to some dummy directory on the server that has been manually forbidden.

I'd like to be able to do it in the Apache configuration though, if possible. Is it? In all of my other attempts, with "Deny" etc. it still allows other IP/host accesses through.


share|improve this question
up vote 1 down vote accepted

You should be able to set the _default_ vhost to return whatever error code you consider to count as "denied" for all requests; that'll do the trick nicely.

share|improve this answer
Try as I might, I can't get this to work. With a default:443 virtual host set to deny requests, and my other *:443 virtual host set with the appropriate ServerName to, any request to still displays rather than being denied. Any idea what I might be doing wrong? It feels like I've tried everything, but as is usually the case, probably not. – futureal Jul 31 '12 at 5:12
Actually, it just dawned on me that the hostname is probably unreadable by Apache prior to routing it, since the request headers are part of the encrypted content -- so the server probably has no idea what hostname is being requested, and is just pulling the first SSL host that it finds in the configuration chain. Does this sound correct? If so, it means that what I was hoping to do is actually not possible, but does make sense. The _default_:80 solution does work for non-HTTPS requests. – futureal Jul 31 '12 at 5:18
You can't do a default setup for HTTPS requests without a certificate that matches any valid FQDN. I believe Diginotar could hook you up with one of those. – womble Jul 31 '12 at 10:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.