Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have foo.es site with a SSL wildcard certificate running since 2 years ago. Now I want to install another certificate for "*.foo.com" in the same server. I've copied the new foo_com.crt and foo_com.key files to the new server and have added a new entry to ssl.conf:

<VirtualHost foo.com:443>
ServerAdmin info@bar.com
DocumentRoot /var/www/foo.com/
Servername foo.com
ServerAlias www.foo.com

ErrorLog /usr/local/apache/logs/error_log
TransferLog /usr/local/apache/logs/access_log

SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile /etc/httpd/ssl.crt/foo_com.crt
SSLCertificateKeyFile /etc/httpd/ssl.key/foo_com.key
SSLCertificateChainFile /etc/httpd/ca/sub.class2.server.ca.pem
SSLCACertificateFile /etc/httpd/ca/ca.pem

SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
CustomLog /usr/local/apache/logs/ssl_request_log \
      "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

With this, I expected to access to https://foo.com without any problem. Instead, the browser warns with a ssl_error_bad_cert_domain error code. When I've seen the certificate I found that the certificate common name is *.foo.es, it is, the first certificate (note that I still have this certificate installed, I need both).

Apache error log says only this:

[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate wildcard CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate CommonName (CN) `*.foo.com' does NOT match server name!?
[Wed Jan 23 22:53:56 2013] [warn] RSA server certificate wildcard CommonName (CN) `*.foo.com' does NOT match server name!?

What's happening? Why the browser gets the foo.es certificate but the Apache log reports a problem with the foo.com cert?

Running: Apache/2.0.59 (Unix) mod_ssl/2.0.59 OpenSSL/0.9.8g on a Gentoo distro

share|improve this question
1  
Do the two hosts resolve to different IP addresses? –  David Schwartz Jan 23 '13 at 22:40
    
@DavidSchwartz No, the same IP address –  Ivan Jan 23 '13 at 22:52
1  
Well there's your problem. How is it supposed to know which certificate to send to the client? (SNI is still unsupported by about 50% of browsers used on the Internet.) You need to either use different IPs, different ports, or get one certificate that covers both names. –  David Schwartz Jan 23 '13 at 22:53
add comment

1 Answer

up vote 3 down vote accepted

Apache doesn't support SNI until version 2.2.12. Before this, Apache simply served the first certificate. After decrypting the request, it will still match the correct vhost.

If you only have one IP address, you will have to upgrade Apache. (Even if you do have more than one IP address, Apache has come a long way since 2.0.59. You really should upgrade unless you need the older version.)

Some browsers and operating systems don't support SNI either. If your website has visitors using one of the browsers that don't support SNI, you will have to look at getting a second IP address.

share|improve this answer
    
SNI is still unsupported by a significant fraction of Internet browsers. Options are: 1) Use different ports. 2) Use different IP addresses. 3) Get one certificate that covers both names. –  David Schwartz Jan 23 '13 at 22:54
    
Option 3 is the most interesting for me. Thank you very much, I was going crazy with this. (I still upgrade Apache, thanks) –  Ivan Jan 23 '13 at 22:57
1  
It depends on your traffic. My personal website gets practically no browsers that don't support SNI. The websites I run at work get about 10% - 15% browsers with no support. Getting a certificate that supports both names is a good idea that I totally forgot about. They are called SAN (Subject Alternative Name) certificates or UC (Unified Communication) certificates. –  Ladadadada Jan 23 '13 at 22:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.