I'm trying to set up SSL, with SNI, in my apache and am getting the often-seen "ssl_error_rx_record_too_long" error in Firefox when accessing the site (https://test.me.dev.xxxx.net), from which I can conclude that the server is listening on port 443, but doesn't know to use SSL on it.

The server is Ubuntu 9.04 with Apache 2.2.11 I enabled SSL in the default way (a2enmod ssl).

Here is my relevant config:

NameVirtualHost *:*
Listen 80

<IfModule mod_ssl.c>
    Listen 443


<VirtualHost *:*>

        DocumentRoot /home
        ServerAlias *.dev.xxxx.net
        UseCanonicalName Off
        # project.user.dev.xxxx.net
        VirtualDocumentRoot /home/%2/dev/%1/web

        SSLEngine On
        SSLCertificateFile /etc/apache2/certs/dev.crt
        SSLCertificateKeyFile /etc/apache2/certs/dev.key


What is wrong?


This is part of my server working config. Hope you will it handy.

<VirtualHost *:80>
    ServerAdmin webmaster@xxx.com
    ServerName  xxx.com
    ServerAlias www.xxx.com

    DocumentRoot /srv/www/htdocs/xxx.com

    ErrorLog  /var/log/apache2/xxx.com-error_log
    CustomLog /var/log/apache2/xxx.com-access_log vhost_common

    <Directory "/srv/www/htdocs/xxx.com">
        AllowOverride All
        Order allow,deny
        Allow from all

<VirtualHost *:80>
    ServerName mail.xxx.com
    Redirect / https://mail.xxx.com/

<IfDefine SSL>
<IfDefine !NOSSL>
<VirtualHost _default_:443>
    ServerAdmin webmaster@xxx.com
    ServerName  mail.xxx.com

    DocumentRoot  /srv/www/htdocs/roundcube

    ErrorLog  /var/log/apache2/roundcube-error_log
    CustomLog /var/log/apache2/roundcube-access_log vhost_common
    CustomLog /var/log/apache2/roundcube-ssl_log ssl_combined

    SSLEngine on
    SSLCertificateFile    /etc/ssl/xxx/apache2.crt
    SSLCertificateKeyFile /etc/ssl/xxx/apache2.key
    SetEnvIf User-Agent ".*MSIE.*" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
  • 1
    So there's no way around duplicating the config for sites that need access via both? – Bart van Heukelom Feb 26 '10 at 12:13
  • 1
    If you want to force either SSL or non-SSL you can configure Apache to redirect to the other (i.e. if you force SSL, then have the non-SSL do automatic redirect to the SSL domain). This shortens your config because it's just a one line redirect. Otherwise you should use Include statements as a way to follow DRY principles and shorten the config. – Van Gale Feb 26 '10 at 17:15
  • 2
    @Bart van Heukelom: To configure similar virtual hosts, put the common directives in a separate file and use the Include directive. Alternatively, use mod_macro cri.ensmp.fr/~coelho/mod_macro . – 200_success Jun 20 '10 at 13:33
<VirtualHost *:443>
  • But I also need sites to be available over normal HTTP – Bart van Heukelom Feb 25 '10 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.