0

I am performing a wget and recieve the response :

ERROR: certificate common name ‘mydomain’ doesn't match requested host name

Which I understand and can rectify. However is the above message logged server side anywhere ?

I am using apache httpd server but there is no logging (of that specific message) in the ssl_access_log,ssl_error_log, or ssl_request_log as I'd expect ?

Non secure requests are being served as expected and logged in the access_log.

1

Assuming the 'standard' config, ssl_access_log and ssl_request_log are written (in slightly different formats) for each HTTP request received on the TLS vhost. If the certificate is rejected, there is no TLS connection and it is not possible to send any HTTP request, so there is nothing to log.

Depending on the client program and TLS library it uses, it may detect the cert error during the handshake and send an alert, or it may detect it at the end of the handshake and just close the connection. If client does send an alert, that is logged in ssl_error_log IF you change LogLevel to info or lower, which is not the default. The client can't send the error message only an alert code, and there is no code specifically for 'wrong hostname', so client must choose among several that come close. However, the versions of wget I have -- on CentOS and Ubuntu -- use OpenSSL and do not send any alert, they just close, so nothing distinctive is logged.

| improve this answer | |
1

No, it is not logged on the server. This check is made on the client, there is no way to know for the server if this problem occured or not.

You can (and should) configure a default VirtualHost that catches all requests to domains not matching your "real" VirtualHosts. That way you can find out if requests to your server are made with other hostnames. For that however you would need to configure a custom LogFormat, and I'm not quite sure if it is possible to log the server name of the request at all. The variable %{VARNAME}i looks promising though.

Edit: As Dave pointed out in the comments this will only work if an actual request is made to the server. Since the TLS handhake happens befor that, a user will have to manually override the security warning before any request actually takes place. As long as this doesn't happen, there is nothing Apache could log.

| improve this answer | |
  • There must be some form of request logging performed ? – NimChimpsky Oct 22 at 7:22
  • How can a server log something that it is not aware of because it happened on another machine? – Gerald Schneider Oct 22 at 7:27
  • 1
    CustomLog or TransferLog logs requests and if the TLS connection fails there is no request. – dave_thompson_085 Oct 22 at 12:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.