Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We've got multiple subdomains, each with it's own virtualhost entry in httpd.conf and (for those supporting https) in ssl.conf as well. Our main www subdomain has a GoDaddy cert associated with it. The subdomain I'm configuring right now in our dev environment ("api.bulbstorm.com") has an ssl.conf virtualhost entry that looks like this:

<VirtualHost 172.16.247.153:443>
  DocumentRoot "/var/www/api"
  ServerName api.bulbstorm.com:443
  ErrorLog logs/api-error_log
  CustomLog logs/api-access_log common
  LogLevel warn
  SSLEngine on
  SSLProtocol all -SSLv2
  SSLCertificateFile /var/www/certs/api/server.crt
  SSLCertificateKeyFile /var/www/certs/api/server.key
  <Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
  </Files>
  <Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
  </Directory>
  <Directory "/var/www/api">
    Options +FollowSymLinks
    RewriteEngine On
    AllowOverride All
    Order allow,deny
    Allow from all
  </Directory>
  php_value include_path "/var/www/inc"
  SetEnvIf User-Agent ".*MSIE.*" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
  CustomLog logs/ssl_request_log \
    "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

... the crt & key files in /var/www/certs/api/ were generated using openssl per instructions found here.

The api subdomain originally pointed to the godaddy cert for the www subdomain. But even though I've changed the virtualhost entry associated with the api subdomain to point to the self-signed certificate/key pair (and have restarted httpd, completely cleared browser settings related to the previous exception for the godaddy cert, etc.) browsers are still throwing warnings saying that the cert is for the www domain. When I look at the cert the browsers are pulling it looks like they're still getting the godaddy cert.

Higher up in the ssl.conf file there are these lines:

SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key

This cert/key pair is different than the godaddy cert/key pair referenced in the virtualhost entry for the www subdomain, which looks like this:

SSLCertificateFile /etc/www.bulbstorm.com_ssl/www.bulbstorm.com.crt
SSLCertificateKeyFile /etc/www.bulbstorm.com_ssl/www.bulbstorm.com.key
SSLCertificateChainFile /etc/www.bulbstorm.com_ssl/gd_intermediate_bundle.crt

Any light that anyone can shed on the issue I'm having will be appreciated.

share|improve this question
1  
TL;DR. What's the actual problem you're having, in amongst all those config files? –  womble Jul 25 '09 at 0:31
add comment

3 Answers 3

up vote 2 down vote accepted

Make sure that the api.bulbstorm.com and www.bulbstorm.com vhosts are on DIFFERENT IP addresses. Here are my vhost configs for 2 different subdomains with unique SSL certs:

/usr/local/etc/apache22/Includes/login.domain.com.ssl.conf

Listen 10.0.0.152:443

<VirtualHost 10.0.0.152:443>
ServerAdmin admin@domain.com
DocumentRoot /web0/cloud/login.domain.com/current
ServerName login.domain.com

ServerAlias www.login.domain.com login.domain.com


LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
TransferLog /var/log/www/login.domain.com-access_log
ErrorLog /var/log/www/login.domain.com-error_log

<DIRECTORY /web0/cloud/login.domain.com/current>
Allow from All
OPTIONS Indexes Includes ExecCGI FollowSymLinks
AllowOverride ALL
</DIRECTORY>

IndexOptions FancyIndexing

AddType application/x-httpd-php .html

SSLEngine on

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "/usr/local/etc/apache22/ssl.crt/login.domain.com.crt"
SSLCertificateKeyFile "/usr/local/etc/apache22/ssl.key/login.domain.com.key"
SSLCertificateChainFile "/usr/local/etc/apache22/ssl.crt/comodo.ca-bundle"

BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0


</VirtualHost>

/usr/local/etc/apache22/Includes/admin.domain.com.ssl.conf

Listen 10.0.0.151:443

<VirtualHost 10.0.0.151:443>
ServerAdmin admin@domain.com
DocumentRoot /web0/cloud/admin.domain.com/current
ServerName admin.domain.com

ServerAlias www.admin.domain.com admin.domain.com

LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-agent}i\""
TransferLog /var/log/www/admin.domain.com-access_log
ErrorLog /var/log/www/admin.domain.com-error_log

<DIRECTORY /web0/cloud/admin.domain.com/current>
Allow from All
OPTIONS Indexes Includes ExecCGI FollowSymLinks
AllowOverride ALL
</DIRECTORY>

IndexOptions FancyIndexing

SSLEngine on

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "/usr/local/etc/apache22/ssl.crt/admin.domain.com.crt"
SSLCertificateKeyFile "/usr/local/etc/apache22/ssl.key/admin.domain.com.key"
SSLCertificateChainFile "/usr/local/etc/apache22/ssl.crt/comodo.ca-bundle"

BrowserMatch ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0


</VirtualHost>
share|improve this answer
    
@amishgeek - excellent. thank you. we actually already have multiple ip addresses resolving to this machine. i should be able to adjust the dns record to run the api subdomain through one of the other ip's. –  codemonkey Jul 27 '09 at 16:21
add comment

To answer your question at the very end, this is how to generate a self signed SSL certificate.

First, this line will generate a private key that is used to generate a certificate signing request (CSR).

openssl genrsa -des3 -out server.key 1024

You will be prompted to enter a passphrase. This passphrase will encrypt the private key. This next line will generate the CSR using your private key.

openssl req -new -key server.key -out server.csr

You will then be prompted for the following questions (and your passphrase if you chose to use one above in the generation of your private key.)

Country Name (2 letter code) [GB]:
State or Province Name (full name) [Berkshire]:
Locality Name (eg, city) [Newbury]:
Organization Name (eg, company) [My Company Ltd]:
Organizational Unit Name (eg, section) []:
Common Name (eg, your name or your server's hostname) []:
Email Address []:
Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:

Edit: if you do generate a self-signed certificate for testing, the Common Name field above is where you want to put your domain (exactly as you want it, ie. with the www if you want that to be the address you use). After you've generated your CSR, you can self-sign it doing the following.

openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

Then you will have your private key (server.key) and your SSL certificate (server.crt) which you can install in Apache using the directives you've used above for the other certificates.

I'm not sure if this answers any of the questions regarding the apparent incorrect certificate being sent to the browser, but I would suggest perhaps removing all references to certificate files outside that VirtualHost directive to see if it still happens, since you're only really able to have one SSL host per IP address, and having multiple SSLCertificateFile directives could have an unusual effect.

share|improve this answer
    
Not the issue at hand. –  mpbloch Jul 25 '09 at 2:12
    
I understand, however he asked at the end how to generate a self-signed certificate, so I have explained just that. –  James Jul 25 '09 at 2:16
    
However, he's already "generated using openssl per instructions found here": tc.umn.edu/~brams006/selfsign.html. And needs to know "how to ... make the ssl.conf file adjustments necessary to get them to actually work" –  mpbloch Jul 25 '09 at 2:19
    
But you take what he's saying out of context. Maybe you should read the first half of the sentence you actually quoted and omitted part of: "I'd really like to be able to know how to create self-signed certs and make the ssl.conf file adjustments necessary to get them to actually work." –  James Jul 25 '09 at 5:54
    
So I explained how. I'm pretty sure it's a valid response, and I'm not sure why I've been modded down for it. –  James Jul 25 '09 at 5:54
show 1 more comment

As amishgeek points out, and ping confirms:

    Microsoft Windows [Version 6.0.6002]
    Copyright (c) 2006 Microsoft Corporation.  All rights reserved.

    C:\Users\Owner>ping bulbstorm.com

    Pinging bulbstorm.com [216.139.247.153] with 32 bytes of data:
    Control-C
    ^C
    C:\Users\Owner>ping www.bulbstorm.com

    Pinging www.bulbstorm.com [216.139.247.153] with 32 bytes of data:
    Control-C
    ^C
    C:\Users\Owner>ping api.bulbstorm.com

    Pinging api.bulbstorm.com [216.139.247.153] with 32 bytes of data:
    Control-C
    ^C
    C:\Users\Owner>

You have the same IP address for both hosts. SSL happens before host names are sent. Host names are sent to Apache through the Host: header in HTTP requests. In OpenSSL 1.0, there will be support for TLS certificates, which may help with sharing an IP, but that's another ballgame, and more Googling.

LINKS:

WORKAROUNDS:

Per the Wikipedia entry on TLS: you should adjust your certificate to support multiple subject alternative names (GoDaddy has "UCC Certs"), or get a wildcard certificate.

Depending on your user base, you could ask users to support the CACert root certficate and get a subjectAltName certificate from them. (in fact, it looks like your current certificate has a subjectAltName for bulbstorm.com, AND www.bulbstorm.com). This saves you $70.00 per year. Put a link on your non-SSL page or on your SSL page which says something like

"Are you getting SSL browser errors? We use CACert SSL Certificates. Please follow this link to download their root certificates into your browser."

share|improve this answer
    
@mpbloch - this was what i was looking for, thank you! –  codemonkey Jul 27 '09 at 16:16
    
Sure thing ;-) Apache's config files can be beastly, and it's really amazing to switch between Apache, and then Abyss Web Server. Spending some time with your own box, and setting up config files for virtual hosts, SSL, and directory permissions, etc, can be an invaluable way to spend a few hours. I often restructure my config files later, so that they make sense to ME. Removing the comments from sample config files can improve readability. Also, I use Mercurial (hg) to keep directory snapshots and revision histories of my config files for when stuff changes, I can easily roll back. –  mpbloch Jul 27 '09 at 18:25
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.