Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a single Apache 2.0 httpd instance that I'd like to host both HTTP and HTTPS. They share the same IP address and HTTP would come on port 80 and HTTPS on port 443 (standard). I have 2 domains www.example.com and secure.example.com that both point to that IP address.

Now the problem: I want only HTTP traffic to www.example.com and only HTTPS traffic to secure.example.com. This means no HTTPS to www.example.com and no HTTP to secure.example.com.

My httpd.conf looks like

ServerName www.example.com
Listen 10.0.0.1:80
Listen 10.0.0.1:443

NameVirtualHost 10.0.0.1:80
NameVirtualHost 10.0.0.1:443

<VirtualHost 10.0.0.1:80>
    ServerName www.example.com
</VirtualHost>

<VirtualHost 10.0.0.1:443>
    ServerName secure.example.com
    SSLEnable # ... and other SSL stuff
</VirtualHost>

What's happening now is that I can get to both domain names using both HTTP and HTTPS. I looked up port-based virtual hosting and name-based virtual hosting and it seems that what I have should work. I'm not trying to host multiple domains in SSL, so no problem there. I just want the user to be denied going to www.example.com using HTTPS and vice versa for secure.example.com.

Is this even possible without a separate IP alias?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

Solving the HTTP to secure.example.com is easy. You just create an additional virtual host to direct to HTTPS:

<VirutalHost 10.0.0.1:80>
    ServerName secure.example.com
    Redirect / https://secure.example.com/
</VirtualHost>

Solving the HTTPS to www.example.com is harder. The problem is that usually you can not do name based virtual hosting with HTTPS. The reason is that the SSL connection is set up before Apache knows which host you are trying to connect to, so doesn't know which SSL certificate to send, so has to send the first one it knows about. The result is that if you try to do name based SSL you'll get sent the wrong certificate on every virtual host except one, and the browser will display an error to the user. You can get around this using a wildcard certificate for *.example.com, or using a certificate with an Subject Alternative Name on it. Unfortunately these certificates cost more money and you may find support patchy on more obscure clients.

You can add a similar virtualhost for HTTPS that you did with HTTP:

<VirtualHost 10.0.0.1:443>
   ServerName www.example.com
   Redirect / http://www.example.com/
</VirtualHost>

If you solved the SSL problem, this will just work without errors. If you did not, then the client should get an error message about the hostname not matching the certificate, but should then redirect to http.

share|improve this answer

I would just add new virtual hosts with redirects

<VirtualHost 10.0.0.1:443>
   ServerName www.example.com
   Redirect / https://secure.example.com/
</VirtualHost>

<VirutalHost 10.0.0.1:80>
   ServerName secure.example.com
   Redirect / http://www.example.com/
</VirtualHost>
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.