Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm a linux newb. I'm setting up my own LAMP server on a VPS for the first time. Everything has gone well so far. I am hosting several domains on my VPS which only has 1 IP address (is this called name based virtual hosting?).

Two of the sites on my VPS, bikestore.com and toystore.com, will eventually become ecommerce websites that accept credit card information. I'm in the process of enabling an https version for both sites, so I purchased 1 new IP address for each.

I'm following this guide to install SSL certificates: http://www.linode.com/wiki/index.php/Apache2%5FSSL%5Fin%5FUbuntu

In creating a /etc/apache2/sites-available/bikestore-ssl and /etc/apache2/sites-available/toystore-ssl, will Apache know that https://bikestore.com should reference IP address 1.1.1.1 with ssl certificate bikestore.crt and that http://toystore.com should reference IP address 2.2.2.2 with ssl certificate toystore.crt?

When inspecting the contents of bikestore-ssl and toystore-ssl, it's not clear to me how apache will know which *-ssl file to assign to which https:// domain. So I hope someone here can explain what's happening and if I'm doing things correctly.

Thanks

share|improve this question
    
Note that the page you referred to says "Note: This manual applies to ubuntu versions prior to Ubuntu Feisty (7.04)". Also, it would benefit you greatly to learn about the correct way to write up VirtualHost directives without relying on the a2* commands. See posts below for the correct Apache configs. SSLCertificateFile directive is your answer. –  Dave Drager Dec 11 '09 at 18:01
add comment

2 Answers 2

up vote 2 down vote accepted

Apache ignores the file names, you have to define the IP addresses in the Virtual Host definitions. For example, for my web site pupeno.com I have:

<IfModule mod_ssl.c>
    <VirtualHost 97.107.141.29:443>
        ServerName pupeno.com
        DocumentRoot /var/www/pupeno.com
        CustomLog /var/log/apache2/access-pupeno.com.log combined
        SSLEngine On
        SSLCertificateFile /etc/ssl/certs/pupeno.com.pem
        SSLCertificateKeyFile /etc/ssl/private/pupeno.com.pem
        #SSLOptions +FakeBasicAuth +ExportCertData +CompatEnvVars +StrictRequire
    </VirtualHost>
</IfModule>

Also, there's no reason to have separate files. I have one file pupeno.com.conf which includes the definition for non-ssl and ssl pupeno.com virtual hosts. Think about what you want to enable and disable in one go with a2ensite and a2dissite. I consider http://pupeno.com and https://pupeno.com the same thing thus it's on pupeno.com.conf.

share|improve this answer
add comment

Essentially, Apache chooses which VirtualHost to serve according to the IP address, ServerName, and ServerAlias entries. For SSL sans-TLS, it is sufficient to simply concern yourself with the IP address, since you're assigning each VirtualHost a unique IP. Each VirtualHost may have a unique "SSLCertificateFile" directive.

The most minimal configuration you would need is:

<VirtualHost IP1:443>
SSLEngine On
SSLCertificateFile IP1.pem
</VirtualHost>

<VirtualHost IP2:443>
SSLEngine On
SSLCertificateFile IP2.pem
</VirtualHost>

Presumably you would want to toss either a DocumentRoot, mod_proxy, or mod_rewrite rule into there. For example:

<VirtualHost IP1:443>
SSLEngine On
SSLCertificateFile IP1.pem

# points to a local directory
DocumentRoot /var/www/
</VirtualHost>

<VirtualHost IP2:443>
SSLEngine On
SSLCertificateFile IP2.pem

# transparently serves the content off another webpage.
RewriteEngine On
RewriteRule ^/?(.*) http://www.non-secure-site.com/$1 [P]
</VirtualHost>
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.