Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have encountered an issue when I want to restrict the on domain/subdomain combinations to particular ports.

For example when I just want the following domain/subdomain port combinations to work

https://domain.com:99001
https://subdomain.domain.com:99003

I find that not only do they work but the combination below also works yet am trying to prevent it from happening

https://domain.com:99003
https://subdomain.domain.com:99001

The script below is what am using to try achieve that objective

<VirtualHost *:99001>
    #RequestHeader set X-Forwarded-Proto "https"
    ProxyPreserveHost On
    ServerName www.domain.com
    ServerAlias MYSERVER

    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl/server.crt
    SSLCertificateKeyFile /etc/apache2/ssl/server.key


    <Location />
        SSLRequireSSL
    </Location>

    ProxyPass / http://11.11.11.20:99011/
    ProxyPassReverse / http://11.11.11.20:99011/
</VirtualHost>

<VirtualHost *:99003>
    #RequestHeader set X-Forwarded-Proto "https"
    ProxyPreserveHost On
    ServerName subdomain.domain.com
    ServerAlias MYSERVER

    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl/server.crt
    SSLCertificateKeyFile /etc/apache2/ssl/server.key

    <Location />
        SSLRequireSSL
    </Location>

    ProxyPass / http://11.11.11.20:99013/
    ProxyPassReverse / http://11.11.11.20:99013/
</VirtualHost>

What am I missing?

share|improve this question
add comment

1 Answer

For name-based virtual hosts, Apache uses the ServerName directives and any ServerAlias directives together with the port number to identify which virtual host should receive a particular incoming request. In your case, requests for the alternative port must not match any virtual host, or in other words, the ServerName directive and any ServerAlias directives must be unique across all virtual hosts.

In addition, the use of a ServerAlias directive suggests that you are using a security certificate capable of securing multiple domains. If the domains on the certificate(s) are shared between the virtual hosts, the issue described above is compounded because the request continues without sending a security certificate error to the client.

share|improve this answer
    
Does that means I cannot achieve my objective? –  davykiash Sep 27 '13 at 7:52
    
Isolating traffic to each virtual host is possible. However, in your configuration, it appears that your ServerAlias directives are shared between the two name-based virtual hosts, so Apache (correctly) sends traffic to both virtual hosts. (Although it is possible there is a subtle bug in Apache.) In order to separate the traffic using name-based virtual hosting, these names must be unique. How else could Apache distinguish between them? An alternative to making the names unique would be to use IP-based virtual hosts, using two IP addresses, one for each of the two virtual hosts. –  Daniel Kauffman Sep 27 '13 at 16:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.