Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Alright, so I have an Apache server set up with the following directives:

NameVirtualHost *:80

<VirtualHost *:80>  
ServerName example1.com  
ServerAlias www.example1.com  
DocumentRoot /var/www/html
</VirtualHost>

<VirtualHost *:80>
ServerName example2.com
ServerAlias *.example2.com
DocumentRoot /var/www/example2
</VirtualHost>

<VirtualHost example1.com:443>
DocumentRoot /var/www/html
ServerName example1.com:443
SSLEngine on
...
</VirtualHosts>

So example1.com has SSL support, and can be accessed either via http:// example1.com or https:// example1.com. However, this has the unintended side effect of showing https:// example1.com when I visit https:// example2.com in my browser. What I want to do is basically disable https:// example2.com somehow or re-direct it to http:// example2.com so I don't get a warning and the wrong site when I visit it.

share|improve this question

4 Answers 4

up vote 2 down vote accepted

You won't be able to avoid getting a warning, unless example1 and example2 are on different IP addresses, or you get an SSL certificate covering both names -- an error page or redirect can't happen until after the SSL connection is established.

That being said, something along these lines should work:

NameVirtualHost *:443
<VirtualHost *:443>
  ServerName example1.com
  SSLEngine on
  #...
</VirtualHost>
<VirtualHost *:443>
  ServerName example2.com
  SSLEngine on
  # same certificate config here as on example1, unless you're wanting to use TLS SNI
  # then, let's redirect the user to non-SSL
  Redirect permanent / http://example2.com/
</VirtualHost>
share|improve this answer
    
Thanks! I think I was missing the NameVirtualHost directive and Apache thought I was trying to make two virtual hosts conflicting each other. Interestingly, Chrome is not throwing a warning over this redirect... But I'm not worried about that, just don't want my SSL site showing up under other domain names. –  nearengine Feb 23 '13 at 10:12

i do not think you should put :443 on ServerName example1.com:443

these should be right configure

<VirtualHost example1.com:443> //change example1.com to ip address is a good habit
DocumentRoot /var/www/html
ServerName example1.com
SSLEngine on
...
</VirtualHosts>
share|improve this answer

Best to use a separate IP for the site that requires SSL.

Alternatively, To add the redirect, you need a vhost on 443 for each domain. To remove the SSL warning, you would need a valid certificate for every site.

There's one catch secure vhosts though. SSL in it's original form doesn't care about the hostname. It opens an SSL session to an IP address, establishes a secure connection, then provides data. The default/first host will always be delivered to these clients.

Newer versions of OpenSSL and clients have added a "Server Name Indication" extension prior to the SSL handshake. This allows SNI based SSL Virtual hosting. So this will only work for new browsers listed on the wiki page. Older browsers will be stuck.

share|improve this answer
    
Yep I agree, although it's for a personal project so I didn't really want to buy another IP. My end goal was just to ensure that the SSL site doesn't show up under any other domain and I think I got it sorted now. Thanks! –  nearengine Feb 23 '13 at 10:13

You need to have Server Name Indication (SNI) to accomplish this. Please refer the link: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI for details.

share|improve this answer
    
Down voted because you didn't provide an answer or example, only a link (which isn't guaranteed to be there permanently) –  Chrisbloom7 Sep 12 at 15:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.