Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

My goal is to have multiple SSL sites on multiple IP address, but I'm struggling with the Apache setup:

// I want this:
http + https example.com
http + https example.net

// On these IPs:
http example.com 1.1.1.1:80
http example.net 1.1.1.1:80
https example.com 2.2.2.2:443
https example.net 3.3.3.3:443

Note that the DocumentRoot is different for all 4 sites.

In my current Apache setup, when a client visits https://example.com, Apache serves up 1.1.1.1 (connection refused, assume :443) instead of 2.2.2.2:443. The same is true with https://example.net (instead of 3.3.3.3:443). I assume this is because of my DNS a records for @ and www pointing to 1.1.1.1. The non-SSL 1.1.1.1 name-based-vhosts work fine.

I'm not sure if this is intended Apache behavior or not. So the core of my question is, "is this intended Apache behavior? If so, could someone give me an example of how the IPs should look in this situation? Should BOTH http and https example.com be on ONE IP instead of me splitting them up like this?"

My httpd.conf is like this right now:

# http example.com and http example.net:
Listen 1.1.1.1:80
# https example.com:
Listen 2.2.2.2:443
# https example.net:
Listen 3.3.3.3:443

NameVirtualHost *:80

<VirtualHost *:80>
    ServerName example.com
    DocumentRoot /var/www/example.com
</VirtualHost>

<VirtualHost *:80>
    ServerName example.net
    DocumentRoot /var/www/example.net
</VirtualHost>

<VirtualHost 2.2.2.2:443>
    SSLEngine on
    ServerName example.com
    DocumentRoot /var/www/example.com-ssl
</VirtualHost>

<VirtualHost 3.3.3.3:443>
    SSLEngine on
    ServerName example.net
    DocumentRoot /var/www/example.net-ssl
</VirtualHost>

Edit: Every google search I do returns tons of SNI guides (multiple SSL vhosts on one IP, which is not what I'm looking for.

share|improve this question
1  
The setup seems reasonable. What exactly is your question? –  Michael Hampton Jul 18 '13 at 20:12
    
Heh, I knew this wasn't asked right. I guess I'm looking for the proper top-level Apache directives for setting up multiple SSL sites with multiple IPs. My httpd.conf setup above requires a new A-record because https'ing to example.net serves up 1.1.1.1 instead of 3.3.3.3 per my httpd.conf. Hope that clears up my question a bit. –  Jeff Jul 18 '13 at 20:17
    
Hm. Perhaps you should start over from the beginning. Add as much detail as you can about every part of your process, and we'll see if we can figure out what's going wrong where. –  Michael Hampton Jul 18 '13 at 20:23
    
Understood. I basically rewrote the thing. Just think, "How To: multiple SSL sites on multiple IPs..." and we'll be on the same page. –  Jeff Jul 18 '13 at 20:42

2 Answers 2

up vote 2 down vote accepted

You seem to have misunderstood how DNS works.

DNS in this case resolves names such as example.com to IP addresses such as 203.0.113.1. You can't have a different IP address for a different port or service.

Thus, you need to use the same IP address for HTTP, HTTPS and every other service that might be served with that domain name.

share|improve this answer
    
And that is exactly what I wanted to know. Apache can't just internally forward the client to the correct vhost, right? If not, then the proper way to set this up is to put http example.com and https example.com on the SAME IP ADDRESS, right? I can't even find a sample config online to compare notes with because all the search results are about SNI. –  Jeff Jul 18 '13 at 20:48
    
Right. The IP addresses in your Apache config should match your A records. –  Michael Hampton Jul 18 '13 at 20:54
    
Actually I think he wants name-based hosts on 1.1.1.1:80 only, IP-based on the others. –  xofer Jul 18 '13 at 20:54
    
@xofer, exactly. I thought that's what I was doing already. Name-based on :80 and IP-based on the SSL's. It doesn't work. –  Jeff Jul 18 '13 at 20:55

I think the problem is the NameVirtualHost directive. You want to use IP-based virtual hosting, not name-based.

share|improve this answer
    
Oh yes, I missed your edit -- @Michael Hampton is correct, you cannot have the same domain point to different IP addresses. However you can configure Apache to use a different virtual host based on the port/service, so leaving my answer as it is what you want to do (I think). –  xofer Jul 18 '13 at 20:52
    
I would pay money to see an example of what you have in mind. :) –  Jeff Jul 18 '13 at 20:56
    
The Apache config you have will actually work, but you cannot setup the DNS like you want as @M.H. said. You'll need to point exmaple.com to 2.2.2.2 and example.net to 3.3.3.3 and it should work -- the name-based config will pick up the http requests while the IP-based config will pick up the https requests. –  xofer Jul 18 '13 at 21:00
    
Thank you for the info. Since that's not what I want, I guess it's SNI for me! –  Jeff Jul 18 '13 at 21:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.