Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have two sites that require different domains, but must both use the same server running Apache httpd and also use SSL. Here's the example:

  • www.example.com legacy application receiving high traffic
  • beta.example.com new site with backward-incompatible changes to url structure

Each domain has a different document root path. SNI is not an option, but I have a wildcard SSL cert for *.example.com. Assigning a second IP is not an option.

How do I configure Apache to use the wildcard SSL certificate for any traffic on port 443, then continue with name-based virtual hosting after the SSL handshake?

In nginx it could be an if-block based on domain name and have the SSL configuration outside of that. Is there an equivalent that will work with Apache 2.2?

Edit: SNI is not an option by request of my client, due to decreased browser support compared to the alternative. I'm looking for some way to serve the cert using the old standard, then apply the classic VHost definitions on the ssl port just like they are applied on port 80.

share|improve this question
    
Apache mod_ssl supports SNI; there's nothing you have to do. Do you mean that your clients won't necessarily support it? –  Andrew Schulman Aug 11 at 8:13
    
The browser support is what worries my client. There are fewer browsers that support SNI than the alternative, hence the wildcard SSL certificate. –  TheLonelyGhost Aug 11 at 9:20

1 Answer 1

up vote 3 down vote accepted

If you have a wildcard ssl cert, that means you can use this cert in the config file of your both vhosts.

You can simply give them in the vhost config files:

<VirtualHost *:443>
  ServerName www.example.com
  SSLCertificateFile /path/to/file.crt
  SSLCertificateKeyFile /path/to/file.key
  ...
</VirtualHost>
<VirtualHost *:443>
  ServerName beta.example.com
  SSLCertificateFile /path/to/file.crt
  SSLCertificateKeyFile /path/to/file.key
  ...
</VirtualHost>

Don't forget: virtualhost identification will based on the Host: request header, and not in the SNI. SNI will be used only for the vhost identification before the ssl handshake. It is perfectly okay to use different vhost in the SNI part of the SSL handshake and in the HTTP part, although these extraordinary queries will cause some warnings in the apache log.

share|improve this answer
    
Without SNI enabled, wouldn't this cause Apache to display an error message on restart? Last I tried something similar it mentioned using the first of the two and ignoring the other, or does that error message only apply to which SSL cert Apache serves? –  TheLonelyGhost Aug 11 at 9:24
    
@TheLonelyGhost Apache uses automatically SNI, you don't need to enable that (probably you have to dig into the docs for disable). Using the same cert for multiple vhosts shouldn't cause an error, if you had one, it had probably some other cause. –  Peter Horvath Aug 11 at 9:31
    
Used a different cert for different definitions before I knew what I was doing and it threw an error about there being multiple definitions for port 443. Thought this would produce the same result. Are you basing this answer off of apache 2.2 or 2.4+? –  TheLonelyGhost Aug 11 at 9:36
    
@TheLonelyGhost No, the cert settings are handled independtly for the virtualhosts, it is so since around apache 1.3.x . Warning can be resulted if the certs are invalid or are certified for another domains. But your current *.example.com certs aren't so. I suggest to simply set this as I say, and if you have an error, ask this in a new question. –  Peter Horvath Aug 11 at 9:41
    
Exactly as I needed. Just wanted to confirm the validity since I've already hit a number of dead ends due to using an older version –  TheLonelyGhost Aug 11 at 9:52

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.