Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an SSL certificate installed and working for my website, however, 5 different domains all point at the same host, and if a user is directed to https://(the other four) they get a big angry red screen.

If I only have one VirtualHost that seems to be the catch-all, which is what I don't want. I attempted to make another VirtualHost to catch the uncertified domains:

NameVirtualHost *:443

<VirtualHost *:443>
    DocumentRoot /srv/deadwww/  # contains nothing of consequence

<VirtualHost *:443>
    SSLEngine on
    SSLCertificateFile /path/to/certs/

but Apache won't even start then, barking:

[error] Server should be SSL-aware but has no certificate configured

So, If I only have one VirtualHost entry, that catches all the names and fails auth on most, and if I try to catch the bad names before getting there...I can't because Apache won't let me. How do I solve this problem?

share|improve this question

You cannot do anything to fix this without one of three things:

  • More IP addresses - moving the domain with SSL to a different address than the non-SSL ones.
  • More certificates (and the use of SNI) - a certificate configured for each domain which Apache will serve up based on the hostname sent by the client in the TLS handshake. Note that IE and Chrome on XP will still get the certificate warnings!
  • Different certificates - a wildcard or alternative name cert covering all of the domain names in question.

Nothing that you can do in the Apache configuration without one of those three changes will fix this, as any kind of redirect or blocking of the request will occur after the SSL handshake has completed (the user has to click through the certificate warning before they'll be redirected).

share|improve this answer

You can't host multiple SSL sites this way; they each need their own ip address OR you need a wildcard secure certificate:

share|improve this answer
I'm only hosting 1 site; is there no way to just reject the connection if the host name doesn't match what I expect? – Nick T Nov 16 '13 at 0:39
in your config, you are hosting at least two diff sites ( and or trying to, as this is not possible without wildcard/multihost ssl cert – nandoP Nov 16 '13 at 0:41
I don't think so, SSL is based on the ip address and because the hostname is encrypted in transit, I don't think it can be hostname-aware – user16081-JoeT Nov 16 '13 at 0:42
yes, it can, with a multi-host ssl cert. it is the one exception (other than wildcard, but thats different). DETAILS =>… – nandoP Nov 16 '13 at 0:44
supposedly, it can be up to 100 fqdns on same cert, but ive only seen vendors sell 5: – nandoP Nov 16 '13 at 0:49

if you have 5 top level domains names or less, you can get a "multi-host" cert, which would be cheaper than 5 IP's plus 5 individual certs. with multi-host, you wont need new ips, or have to make dns changes (ie. 5 different fqdn's on same IP).

share|improve this answer
No, you can use SNI for this, but it's not supported on very old browsers. – devicenull Nov 16 '13 at 1:55
@devicenull, here is an example of how to csr a multi-host cert with openssl – nandoP Nov 16 '13 at 1:59

What if you put a deny rule for any domain except for the ones you explicitly added ServerName parameter. To stop apache from complaining you can add dummy SSL certs there. I haven't tried it but you might want to give it a shot. Make sure you put the virtualhost section for the main domain/site you are hosting above the line below -

<VirtualHost *:443>
  ServerAlias *
  DocumentRoot /var/www/example2
  ##put the SSL lines here
  <Directory /var/www/example2>
   Order allow,deny
   Order Deny,Allow
   Deny from all
   Allow from
share|improve this answer
Unfortunately, this won't help with the users getting an SSL hostname mismatch when connecting. – Shane Madden Nov 16 '13 at 1:29

Not clear on the goal of your setup, but it seems like only one (1) of your five (5) domains should have HTTPS via port 443, correct? Then would it be possible for you to force requests the the other four (4) to the main HTTPS enabled site?

Create a VirtualHost config for the other four (4) like this:

<VirtualHost *:443>

  RewriteEngine on
  RewriteRule ^(.*)$$1 [L,R=301]

  ### NOTE: Might have to put dummy SSL info here.


The ServerName and ServerAlias should catch all of the incorrect requests on port 443 for,, and redirecting them all to Note that you might have to include dummy SSL info there, but the redirect should work.

share|improve this answer
Unfortunately, this won't help with the users getting an SSL hostname mismatch when connecting. – Shane Madden Nov 16 '13 at 1:29
Ahhh. Okay. Makes sense. But what about installing self-signed certificates for the other domains? – JakeGould Nov 16 '13 at 1:32
That'll work in that SNI will be used to serve up the configured certs for the other domains, but the self-signed certs will probably be untrusted by the client browsers; we probably wouldn't achieve the apparent goal of not popping a connection warning for clients trying to load those domains. – Shane Madden Nov 16 '13 at 1:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.