Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My intent here is avoid a lot of repetitive code.

Essentially what I'm trying to do is use the same block of SSL config for several VirtualHost entries...

<IfModule mod_ssl.c>

<Directory />
    Options FollowSymLinks
    AllowOverride None
</Directory>
<Directory /var/www/>
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Order allow,deny
    allow from all
</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
    AllowOverride None
    Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
    Order allow,deny
    Allow from all
</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

LogLevel warn

CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
    Options Indexes MultiViews FollowSymLinks
    AllowOverride None
    Order deny,allow
    Deny from all
    Allow from 127.0.0.0/255.0.0.0 ::1/128
</Directory>

SSLCertificateFile    /usr/share/ssl/certs/example/host.pem
SSLCertificateKeyFile /usr/share/ssl/certs/example/host.key
SSLCertificateChainFile /usr/share/ssl/certs/example/host.cert

<FilesMatch "\.(cgi|shtml|phtml|php)$">
    SSLOptions +StdEnvVars
</FilesMatch>

<Directory /usr/lib/cgi-bin>
    SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-6]" \
   nokeepalive ssl-unclean-shutdown \
   downgrade-1.0 force-response-1.0

# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

<VirtualHost 999.99.9.999:443>
    ServerName subdomain1.example.com
    DocumentRoot /var/www/subdomain1
</VirtualHost>

<VirtualHost 999.99.9.999:443>
    ServerName subdomain2.bonfirehub.com
    DocumentRoot /var/www/subdomain2
</VirtualHost>

</IfModule>

Now this config doesn't work for me, but I think it illustrates what I'm trying to achieve. The ideal next step would be to abstract this common config for each VirtualHost into a separate file and just load it via an Include directive.

If not perhaps someone can suggest another config method.

The goal for me is to have a shared common config, as I intend on adding several VirtualHost entries an a given IP that only vary by DocumentRoot and ServerName. Specifically that the ServerName subdomain is the only thing that changes (note that I'm using a wildcard cert) which is why I want to setup a shared config.

I've figured this out but I'll leave it up in the event that someone else find this useful.

# VirtualHost
<IfModule mod_ssl.c>

<VirtualHost 999.99.9.999:443>
    ServerName subdomain1.example.com
    DocumentRoot /var/www/subdomain1
    Include example.com-ssl.conf
</VirtualHost>

<VirtualHost 999.99.9.999:443>
    ServerName subdomain2.example.com
    DocumentRoot /var/www/subdomain2
    Include example.com-ssl.conf
</VirtualHost>

</IfModule>

# Shared Config File
ServerAdmin webmaster@localhost

<Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

LogLevel warn

CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

Alias /doc/ "/usr/share/doc/"
<Directory "/usr/share/doc/">
        Options Indexes MultiViews FollowSymLinks
        AllowOverride None
        Order deny,allow
        Deny from all
</Directory>

#   SSL Engine Switch:
#   Enable/Disable SSL for this virtual host.
SSLEngine on

#   A self-signed (snakeoil) certificate can be created by installing
#   the ssl-cert package. See
#   /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
#   If both key and certificate are stored in the same file, only the
#   SSLCertificateFile directive is needed.
SSLCertificateFile /usr/share/ssl/certs/*.example.com/host.pem
SSLCertificateKeyFile /usr/share/ssl/certs/*.example.com/host.key

#   Server Certificate Chain:
#   Point SSLCertificateChainFile at a file containing the
#   concatenation of PEM encoded CA certificates which form the
#   certificate chain for the server certificate. Alternatively
#   the referenced file can be the same as SSLCertificateFile
#   when the CA certificates are directly appended to the server
#   certificate for convinience.
SSLCertificateChainFile /usr/share/ssl/certs/*.example.com/host.cert

<FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
</FilesMatch>

<Directory /usr/lib/cgi-bin>
        SSLOptions +StdEnvVars
</Directory>

BrowserMatch "MSIE [2-6]" \
       nokeepalive ssl-unclean-shutdown \
       downgrade-1.0 force-response-1.0

# MSIE 7 and newer should be able to use keepalive
BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

I realized that my original config block at the top was missing some code. My only other follow up question would be, rather than having to write

Include example.com-ssl.conf

In each VirtualHost is there not a way to have them all include that file?

share|improve this question
    
What's wrong with an Include in each one? –  Shane Madden Dec 13 '12 at 3:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.