Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an SSL-enabled virtual host for my sites at example.com:10443

Listen 10443
<VirtualHost _default_:10443>
  ServerName example.com:10443
  ServerAdmin admin@example.com
  ErrorLog "/var/log/httpd/error_log"
  TransferLog "/var/log/httpd/access_log"
  SSLEngine on
  SSLProtocol all -SSLv2
  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
  SSLCertificateFile "/etc/ssl/private/example.com.crt"
  SSLCertificateKeyFile "/etc/ssl/private/example.com.key"
  SSLCertificateChainFile "/etc/ssl/private/sub.class1.server.ca.pem"
  SSLCACertificateFile "/etc/ssl/private/StartCom.pem"
</VirtualHost>

Browsing to https://example.com:10443/ works as expected. However, also browsing to https://subdomain.example.com:10443/ (with DNS set) shows me the same pages (after SSL certificate warning). I would have expected the directive ServerName example.com:10443 to reject all connection attempts to other server names.

How can I tell the virtual host not to serve requests for URLs other than the top-level one?

share|improve this question
    
Can you be more specific about what you want to happen? What would it mean to "reject" a connection attempt? What specifically do you want to happen? –  David Schwartz Nov 9 '13 at 3:52

4 Answers 4

up vote 1 down vote accepted

You have not enabled NameVirtualHost so the _default_ would send any connection to your server to the config. Try it like this. I added spacing for readability

NameVirtualHost *:10443
Listen 10443

<VirtualHost *:10443>
  ServerName example.com:10443
  ServerAlias example.com:10443
  ServerAdmin admin@example.com

  ErrorLog "/var/log/httpd/error_log"
  TransferLog "/var/log/httpd/access_log"

  SSLEngine on
  SSLProtocol all -SSLv2
  SSLCipherSuite HIGH:MEDIUM:!aNULL:!MD5
  SSLCertificateFile "/etc/ssl/private/example.com.crt"
  SSLCertificateKeyFile "/etc/ssl/private/example.com.key"
  SSLCertificateChainFile "/etc/ssl/private/sub.class1.server.ca.pem"
  SSLCACertificateFile "/etc/ssl/private/StartCom.pem"

</VirtualHost>
share|improve this answer

You seem not to use the NameVirtualHost option so Apache will not bother to check the hostname of the server in the request sent by the client. The request will be directed to the first VirtualHost section, where the IP:port matches, and that's it. Whatever hostname you use, does not matter, you'll get exactly the same website. This is called IP-based virtual host matching.

Check out http://httpd.apache.org/docs/2.2/vhosts/details.html for the full semantics of virtual host matching, including the results of using NameVirtualHost.

share|improve this answer

You can try this:

NameVirtualHost *:10443

SSLStrictSNIVHostCheck off

<VirtualHost *:10443>
    # default - no ServerName/ServerAlias
    DocumentRoot /var/www/default
    SSLEngine on
    SSLCertificateFile "/etc/ssl/private/example.com.crt"
    SSLCertificateKeyFile "/etc/ssl/private/example.com.key"
    # other relevant configuration
</VirtualHost>

<VirtualHost *:10443>
    ServerName subdomain.example.com
    DocumentRoot /var/www/subdomain.example.com
    SSLEngine on
    SSLCertificateFile "/etc/ssl/private/subdomain.example.com.crt"
    SSLCertificateKeyFile "/etc/ssl/private/subdomain.example.com.key"
    # other relevant configuration
</VirtualHost>
share|improve this answer
    
Don't use SSLStrictSNIVHostCheck off. This is RFC-breaking behavior and can introduce security problems. –  Michael Hampton Nov 10 '13 at 17:51

Apache always find the best ip:port based in the first pass, when only connection level details are available, then looks at hostnames in a 2nd pass from what remains (if in 2.2, a NameVirtualHost directive has to be present to allow the 2nd step)

default is the same as *. If you've only got one virtual host for a port, it will be used regardless of whether there is a name-based vhost match.

If you want a catch-all for * or a specific IP, create it as the first virtual host in a set of matching ip:port combinations. You can reject things from there.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.