Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently upgraded my CentOS 5.8 servers to Apache 2.2.22 and I seem to be having some problems with SSL afterwards.

Our client gives a CNAME to blah.mydomain.com. blah.mydomain.com is a web server with multiple hosts (IP Virtual Hosts) using SSL (and HTTP, but those work fine). So what is happening is that anytime someone visits the site over HTTPS it works fine on iOS, and any desktop browser.

With WebOS (non-factor, really) Android's stock browser (Chrome and Firefox for Android works fine) it gives a certificate warning saying it is coming from our wildcard cert *.blah.myserver.com. If you look at the certificate on the desktop, it looks fine. Issued for blah.client1.com, etc.

Here is our httpd.conf setup

<VirtualHost 1.1.1.2:443>
DocumentRoot "/place/stuff/things"
ServerName blah.client1.com
ServerAlias blah.myserver.com blah.blah.myserver.com *.client1.com
SSLEngine on
SSLCertificateFIle /etc/pki/tls/client1.crt
SSLCertificateKeyFile /etc/pki/tls/private/client1.key.nopass
SSLCACertificateFile /etc/pki/tls/certs/verisign.crt
RewriteRules and RewriteBase stuff is here
</VirtualHost>

<VirtualHost 1.1.1.1:443>
DocumentRoot "/place/stuff/things"
ServerName blah.myserver.com
ServerAlias *.myserver.com *.blah.myserver.com
SSLEngine on
SSLCertificateFIle /etc/pki/tls/myserver1.crt
SSLCertificateKeyFile /etc/pki/tls/private/myserver1.key.nopass
SSLCACertificateFile /etc/pki/tls/certs/versignmyserver.crt
RewriteRules and RewriteBase stuff is here
</VirtualHost>

I have tried using 1.1.1.1:443 (for all of the virtual servers, none of them are * or default). I have tried reordering the entries, but no matter how I change it, Android still tries to pull the cert from my *.blah.myserver.com but the desktop version says that it is using the blah.client1.com cert just fine.

share|improve this question
2  
Are you sure android is requesting certificate from other host i.e. IP? Check dest IP with sniffer etc. maybe it's a bug related to cname O_o –  GioMac Aug 1 '12 at 10:15
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.