Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an SSL certificate installed and working for my website, however, 5 different domains all point at the same host, and if a user is directed to https://(the other four) they get a big angry red screen.

If I only have one VirtualHost that seems to be the catch-all, which is what I don't want. I attempted to make another VirtualHost to catch the uncertified domains:

NameVirtualHost *:443

<VirtualHost *:443>
    ServerName example2.com
    ServerAlias example3.com
    DocumentRoot /srv/deadwww/  # contains nothing of consequence
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    SSLEngine on
    SSLCertificateFile /path/to/certs/example.com.crt
    ...

but Apache won't even start then, barking:

[error] Server should be SSL-aware but has no certificate configured

So, If I only have one VirtualHost entry, that catches all the names and fails auth on most, and if I try to catch the bad names before getting there...I can't because Apache won't let me. How do I solve this problem?

share|improve this question

5 Answers 5

You cannot do anything to fix this without one of three things:

  • More IP addresses - moving the domain with SSL to a different address than the non-SSL ones.
  • More certificates (and the use of SNI) - a certificate configured for each domain which Apache will serve up based on the hostname sent by the client in the TLS handshake. Note that IE and Chrome on XP will still get the certificate warnings!
  • Different certificates - a wildcard or alternative name cert covering all of the domain names in question.

Nothing that you can do in the Apache configuration without one of those three changes will fix this, as any kind of redirect or blocking of the request will occur after the SSL handshake has completed (the user has to click through the certificate warning before they'll be redirected).

share|improve this answer

You can't host multiple SSL sites this way; they each need their own ip address OR you need a wildcard secure certificate: http://wiki.apache.org/httpd/NameBasedSSLVHosts

share|improve this answer
    
I'm only hosting 1 site; is there no way to just reject the connection if the host name doesn't match what I expect? –  Nick T Nov 16 '13 at 0:39
    
in your config, you are hosting at least two diff sites (example.com and example2.com)... or trying to, as this is not possible without wildcard/multihost ssl cert –  nandoP Nov 16 '13 at 0:41
    
I don't think so, SSL is based on the ip address and because the hostname is encrypted in transit, I don't think it can be hostname-aware –  user16081-JoeT Nov 16 '13 at 0:42
    
yes, it can, with a multi-host ssl cert. it is the one exception (other than wildcard, but thats different). DETAILS => digicert.com/ssl-support/… –  nandoP Nov 16 '13 at 0:44
    
supposedly, it can be up to 100 fqdns on same cert, but ive only seen vendors sell 5: kb.wisc.edu/page.php?id=18922 –  nandoP Nov 16 '13 at 0:49

if you have 5 top level domains names or less, you can get a "multi-host" cert, which would be cheaper than 5 IP's plus 5 individual certs. with multi-host, you wont need new ips, or have to make dns changes (ie. 5 different fqdn's on same IP).

share|improve this answer
    
No, you can use SNI for this, but it's not supported on very old browsers. –  devicenull Nov 16 '13 at 1:55
    
@devicenull, here is an example of how to csr a multi-host cert with openssl apetec.com/support/GenerateSAN-CSR.htm –  nandoP Nov 16 '13 at 1:59

What if you put a deny rule for any domain except for the ones you explicitly added ServerName parameter. To stop apache from complaining you can add dummy SSL certs there. I haven't tried it but you might want to give it a shot. Make sure you put the virtualhost section for the main domain/site you are hosting above the line below -

<VirtualHost *:443>
  ServerName example2.com
  ServerAlias *.example.com
  DocumentRoot /var/www/example2
  ##put the SSL lines here
  <Directory /var/www/example2>
   Order allow,deny
   Order Deny,Allow
   Deny from all
   Allow from 127.0.0.1
   </Directory>
</VirtualHost>
share|improve this answer
    
Unfortunately, this won't help with the users getting an SSL hostname mismatch when connecting. –  Shane Madden Nov 16 '13 at 1:29

Not clear on the goal of your setup, but it seems like only one (1) of your five (5) domains should have HTTPS via port 443, correct? Then would it be possible for you to force requests the the other four (4) to the main HTTPS enabled site?

Create a VirtualHost config for the other four (4) like this:

<VirtualHost *:443>
  ServerName example1.com
  ServerAlias example2.com
  ServerAlias example3.com
  ServerAlias example4.com

  RewriteEngine on
  RewriteRule ^(.*)$ http://example.com/$1 [L,R=301]

  ### NOTE: Might have to put dummy SSL info here.

</VirtualHost>

The ServerName and ServerAlias should catch all of the incorrect requests on port 443 for example1.com, example2.com, example3.com and example4.com redirecting them all to example.com. Note that you might have to include dummy SSL info there, but the redirect should work.

share|improve this answer
    
Unfortunately, this won't help with the users getting an SSL hostname mismatch when connecting. –  Shane Madden Nov 16 '13 at 1:29
    
Ahhh. Okay. Makes sense. But what about installing self-signed certificates for the other domains? –  JakeGould Nov 16 '13 at 1:32
1  
That'll work in that SNI will be used to serve up the configured certs for the other domains, but the self-signed certs will probably be untrusted by the client browsers; we probably wouldn't achieve the apparent goal of not popping a connection warning for clients trying to load those domains. –  Shane Madden Nov 16 '13 at 1:36

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.