Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Currently, my apache configuration includes one SSL certificate (with all domains listed as Alternative Subject Names). I furthermore have one virtual host configuration per domain that serves both SSL and non-SSL requests. All this happens on one public IP.

I’d like to switch to multiple SSL certificates, one per domain, using Subject Name Indication. I know it is possible if I duplicate all vhost configuration entries, once for port 80 and once for port 443 with SSL (as already discussed on SF).

But I would rather have something that resembles my current setup, with these features:

  • All SSL related configuration in one place. In the best case a statement telling apache „Use all SSL certificates in this directory, and for each HTTP request, pick the right one based on the SNI information“
  • Virtual host configuration non-duplicated and with no special mention of SSL at all.
  • Possibility to server many domain names with one virtual host configuration, while still having separate certificates for each.

Is that possible?

share|improve this question
    
I guess a sledgehammer solution would be having apache server only on port 80, and on port 443 a reverse proxy that handles SSL (including certificate selection) and then proxies the request to port 80. I am hoping for more elegant ways :-) –  Joachim Breitner Jan 7 '13 at 21:54
1  
Are all of your virtual hosts on the same IP, or does each domain have a separate IP address? –  esquireofoz Jan 7 '13 at 22:19
    
All on one IP address. –  Joachim Breitner Jan 8 '13 at 9:38
    
Also filed as a feature request at issues.apache.org/bugzilla/show_bug.cgi?id=54385 –  Joachim Breitner Jan 8 '13 at 9:57
    
And against mod_gnutls at sourceforge.net/apps/mantisbt/modgnutls/view.php?id=15 –  Joachim Breitner Jan 8 '13 at 10:10

1 Answer 1

There's no getting around the structure of virtual hosts that Apache needs to support this configuration; the <VirtualHost> blocks need to exist and need to contain the config directives to set up the listeners.

The best you can do is something like this..

<VirtualHost *:80>
  # Give this file the directives like ServerName and DocumentRoot that
  # are the same between 80 and 443:
  Include /etc/confdir/domain-a.conf
</VirtualHost>
<VirtualHost *:443>
  # Same file as above, so config will be "shared"
  Include /etc/confdir/domain-a.conf
  # SSL directives for this domain (SSLEngine, cert config) in this file:
  Include /etc/confdir/ssl/domain-a-ssl.conf
</VirtualHost>
share|improve this answer
    
If only issues.apache.org/bugzilla/show_bug.cgi?id=47256 were fixed... –  Joachim Breitner Jan 8 '13 at 9:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.