Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a virtualhost directive that serves up a custom 404 error if invalid subdomain is entered:

<VirtualHost *:80> # the first virtual host
  ServerName site_not_found
  RedirectMatch 404 ^/(?!custom_error)
</VirtualHost>

<VirtualHost *:80>
  ServerName example.com
  ServerAlias ??.example.com
</VirtualHost>

I want to set up a virtualhost to show the same custom error via a HTTPS connection. I have tried the following:

<VirtualHost *:443> # the first virtual host
  ServerName site_not_found
  RedirectMatch 404 ^/(?!custom_error)
</VirtualHost>

<VirtualHost *:443>
  ServerName example.com
  ServerAlias ??.example.com
# SSL options, other options, and stuff defined here.
</VirtualHost>

But the server would not start and an error is emitted:

Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile] ((null):0)

It seems that an SSL certificate is required even if the SSLEngine is not turned on for this virtual host. Is there a way to get around the problem besides providing a cert? Turning off the module is not an option since I need SSL for the virtual server example.com.

share|improve this question
    
See: Can Https work without a certificate? –  Bruno Sep 29 '12 at 12:58
add comment

2 Answers

up vote 4 down vote accepted

It seems that an SSL certificate is required even if the SSLEngine is not turned on for this virtual host. Is there a way to get around the problem besides providing a cert?

No - when your browser has https in the URL, it expects to talk SSL. it doesn't, it'll fail. Apache is being nice by telling you this, otherwise you'd have some obscure browser errors to comprehend with. Therefore, you'll need to configure SSL in Apache before you can use port 443.

If you don't want browser warnings about it being a bad SSL certificate, you'll need to buy one from a Certificate Authority. You can get a free one from https://cert.startcom.org/ which are becoming accepted in more and more places but probably don't have the same level of recognition as paid ones (especially in older machines). I use this for my development sites and have yet to see a warning about them being untrusted, but then again I only use relatively new OSs/browsers.

share|improve this answer
    
The server failed to start. It has nothing to do with the browser. –  Question Overflow Sep 29 '12 at 10:08
    
I made my answer clearer: you need to setup SSL certs to use the SSL port. –  Jay Sep 29 '12 at 10:09
    
Ok, I get what you mean -- there is no way to avoid not having a cert. Thanks for the freebee :) –  Question Overflow Sep 29 '12 at 10:27
add comment

Ignoring the Apache error due to not having any SSL certs, what you're attempting to do is not possible unless you create or buy a wildcard certificate to cover the "invalid" subdomains.

If all your clients are internal you could create a mini signing authority and install all the CA cert on all of your boxes.

If your clients are external then you will have to buy a wildcard certificate which costs around 600 USD

share|improve this answer
    
wildcard certificate which costs around 600 USD. No they don't. –  Jay Sep 29 '12 at 11:00
    
@jay - ok, I should have been clearer. They can cost 600 USD depending on your requirements for a wildcard cert. I buy mine from Digicert as I require unlimited CSR signing for multiple private keys and unlimited SANs. –  Alastair McCormack Sep 30 '12 at 12:16
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.