0

We have a Apache 2.4 web server with a couple of virtual hosts with different certificates.

I have set up SNI name based virtualhosts : ap.mmm.com and ac.mmm.com, it's working great. All on same IP (172.12.12.1) and same 443 port. The question is : what will happen if client will use IP and not server name to get to the Apache server : I.e will use 172.12.12.1:443 instead of ap.mmm.com ?

Improve this question
1
  • 1
    If you already set it up, why don't you just try it?
    – Gerald Schneider
    Dec 18, 2018 at 13:23

1 Answer 1

Reset to default
2

It will display the first one in the configuration for that IP/port if no hostname is provided (and hence no hostname will match). “If no matching ServerName or ServerAlias is found in the set of virtual hosts containing the most specific matching IP address and port combination, then the first listed virtual host that matches that will be used.”

SNI is the same, unless you use SSLstrictSNIVhostCheck. The first (default) vhost will be used for any request where the provided server name doesn't match another vhost. There is one directive related to using SNI with name-based virtual hosts, SSLStrictSNIVHostCheck, which controls whether to allow non SNI clients to access a name-based virtual host. http://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslstrictsnivhostcheck

If it’s a shared host with sites that may not appreciate seeing someone else’s site if loads by IP, I’d recommend making a blank virtualhost first for each namevirtualhost directive right below the namevirtualhost. One for ssl (with maybe the main server cert) and one for port 80. It will ensure that the blank host is displayed instead of the first of the real sites.

Improve this answer
3
  • Actually Apache2 will use the default one 000-default.conf
    – bortran
    Dec 18, 2018 at 17:49
  • @bortran Not really. As stated it will use the first instance that matches the IP:Port combo. apache2.conf is the only configuration file that is relevant. apache2.conf can include files and folders of files (ie: Include sites-enabled/*.conf) with the Include directive. A sort order for the include puts 000-default.conf near the top of that list. If you define a VirtualHost in apache2.conf, an earlier config, or 000-adefault.conf, it will be ahead. Moreover, if you don't explicitly define something matching an IP:Port combo in 000-default, then the first matching config could be elsewhere.
    – michaelkrieger
    Dec 19, 2018 at 19:00
  • I know, but on any default apche2 install 000-default.conf will be the first one, as you said. I think it's important to know that and make this differentiation. Why? 000-default.conf often leads to confusion because users aren't aware of it's presence. See e.g. askubuntu.com/questions/603451/… and dozens of similar questions. EDIT: I see, I should've used the word "Usually" - instead of "Actually" in my first comment.
    – bortran
    Dec 20, 2018 at 8:58

Not the answer you're looking for? Browse other questions tagged .