Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to make sure there aren't any mysterious odd behaviors when redirecting a SSL VirtualHost with mod_alias Redirect as outlined by Apache here.

My code seems to work, but since SSL virtual hosts are restricted to just one IP address, I want to make sure there aren't any problems eluding me. Explicitly not using TLS. I'm stuck with Apache 2.2 for now.

<VirtualHost *:443>
    ServerName example.com
    SSLEngine On
    SSLCertificateFile /path/to/example.com-crt.crt
    SSLCertificateKeyFile /path/to/example.com-key.key
    SSLCACertificateFile /path/to/example.com-ca.txt
    Redirect 301 / https://www.example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine On
    SSLCertificateFile /path/to/example.com-crt.crt
    SSLCertificateKeyFile /path/to/example.com-key.key
    SSLCACertificateFile /path/to/example.com-ca.txt
    # Do stuff
</VirtualHost>

So my question is, should SSL VirtualHost redirection with mod_alias Redirect work the same as non-SSL redirection?

UPDATE: To be clear, I want to make sure the Redirect circumvents the need for SNI/TLS, especially related to IE6 on WinXP. Seems to work fine in my tests with IE6 on WinXP-SP3 (see comments below the answer marked correct).

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Yes, it works the same.

x509v3 includes Subject Alternative Name. Most (all?) issuing CA's will list both www.example.com and example.com as equivalent alternate names in a cert requested for either. Because of this browsers won't choke on the name when using the same cert in both VirtualHost instances.


On a different note, you have:

Redirect 301 / http://www.example.com/

I would instead recomend:

Redirect 301 / https://www.example.com/

Because this is SSL after all.

share|improve this answer
    
Oops, fixed! So there are no issues with turning the SSL Engine on the same IP address in two VirtualHosts as long as one is a redirect? Sort of goes against everything I've read, but it seems to work fine. Guess I'm just looking for some confidence before putting this into production. –  Jeff Oct 19 '12 at 1:29
    
It should work on any relevant browser and OS. I believe Internet Explorer on Windows XP doesn't support Server Name Indication, so in that case I think it will throw you on the first virtualhost in your configuration (which is what you probably read everywhere). –  gparent Oct 19 '12 at 17:14
    
I just tested with IE6 on WinXP-SP3 and it works fine. I'm a little surprised myself. I don't think SNI/TLS comes into play because of the redirect -- that was the core of my question. Would love it if someone else can confirm my findings. –  Jeff Oct 19 '12 at 20:46
    
SNI/TLS doesn't come into play. See my updated answer. –  bahamat Oct 19 '12 at 21:49
    
Thanks for clearing that up. For any future visitors to this question who might be curious, I can confirm that my cert does indeed include both www. and no-www. listings. –  Jeff Oct 19 '12 at 22:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.