Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have two sites that require different domains, but must both use the same server running Apache httpd and also use SSL. Here's the example:

  • legacy application receiving high traffic
  • new site with backward-incompatible changes to url structure

Each domain has a different document root path. SNI is not an option, but I have a wildcard SSL cert for * Assigning a second IP is not an option.

How do I configure Apache to use the wildcard SSL certificate for any traffic on port 443, then continue with name-based virtual hosting after the SSL handshake?

In nginx it could be an if-block based on domain name and have the SSL configuration outside of that. Is there an equivalent that will work with Apache 2.2?

Edit: SNI is not an option by request of my client, due to decreased browser support compared to the alternative. I'm looking for some way to serve the cert using the old standard, then apply the classic VHost definitions on the ssl port just like they are applied on port 80.

share|improve this question
Apache mod_ssl supports SNI; there's nothing you have to do. Do you mean that your clients won't necessarily support it? – Andrew Schulman Aug 11 '14 at 8:13
The browser support is what worries my client. There are fewer browsers that support SNI than the alternative, hence the wildcard SSL certificate. – TheLonelyGhost Aug 11 '14 at 9:20
up vote 3 down vote accepted

If you have a wildcard ssl cert, that means you can use this cert in the config file of your both vhosts.

You can simply give them in the vhost config files:

<VirtualHost *:443>
  SSLCertificateFile /path/to/file.crt
  SSLCertificateKeyFile /path/to/file.key
<VirtualHost *:443>
  SSLCertificateFile /path/to/file.crt
  SSLCertificateKeyFile /path/to/file.key

Don't forget: virtualhost identification will based on the Host: request header, and not in the SNI. SNI will be used only for the vhost identification before the ssl handshake. It is perfectly okay to use different vhost in the SNI part of the SSL handshake and in the HTTP part, although these extraordinary queries will cause some warnings in the apache log.

share|improve this answer
Without SNI enabled, wouldn't this cause Apache to display an error message on restart? Last I tried something similar it mentioned using the first of the two and ignoring the other, or does that error message only apply to which SSL cert Apache serves? – TheLonelyGhost Aug 11 '14 at 9:24
@TheLonelyGhost Apache uses automatically SNI, you don't need to enable that (probably you have to dig into the docs for disable). Using the same cert for multiple vhosts shouldn't cause an error, if you had one, it had probably some other cause. – peterh Aug 11 '14 at 9:31
Used a different cert for different definitions before I knew what I was doing and it threw an error about there being multiple definitions for port 443. Thought this would produce the same result. Are you basing this answer off of apache 2.2 or 2.4+? – TheLonelyGhost Aug 11 '14 at 9:36
@TheLonelyGhost No, the cert settings are handled independtly for the virtualhosts, it is so since around apache 1.3.x . Warning can be resulted if the certs are invalid or are certified for another domains. But your current * certs aren't so. I suggest to simply set this as I say, and if you have an error, ask this in a new question. – peterh Aug 11 '14 at 9:41
Exactly as I needed. Just wanted to confirm the validity since I've already hit a number of dead ends due to using an older version – TheLonelyGhost Aug 11 '14 at 9:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.