14

I've got quite a big VirtualHost definition which I don't want to duplicate just so the site will also run over HTTPS.

Here's what I want to do:

<VirtualHost *>
    ServerName example.com

    <If port=443>
        SSLEngine on
        SSLCertificateFile ...
        SSLCertificateKeyFile ...
        SSLCertificateChainFile ...
    </If>

    (other config)

</VirtualHost>

Is there some way to do this?
Am I missing some other method of not duplicating the config?

12

The current stable version of the Apache(2.2) doesn't have that feature, but the 2.4 does have the IF directive.

You have to create two VirtualHosts for now, but you can set some stuff through environment or apache global variables and use that in your virtualhost config (setting the documentroot for example). This way if you want to change that you can do it with just one line of modification.

Of course, you can use include to do something like this:

<VirtualHost *:80>
        include /etc/apache2/vhost.conf.d/site1
</VirtualHost>

<VirtualHost *:443>
        include /etc/apache2/vhost.conf.d/site1
        include /etc/apache2/vhost.conf.d/site1-ssl
</VirtualHost>

ps: SNI will be mainstream years before the IPv6 adaptation. All of the mainstream browser support it already assuming you are on a supported OS.

edit: as fooquency spotted you can't put SSLEngine On to an If block so my answer is wrong.

1
  • 10
    Attempting to put SSLEngine On in an <If> will give SSLEngine not allowed here, so the suggested use-case at the start of this answer sadly doesn't appear to be possible. This seems to be because the requirement that "Only directives that support the directory context can be used within this configuration section." (ref) and SSLEngine is server config, virtual host (ref), not directory.
    – fooquency
    Aug 28 '14 at 18:24
3

No. You can move most things to the Global config and inherit it in the VirtualHost.

2
  • 1
    Unfortunately I have a few VirtualHosts, each with different config and most needing to work over HTTP and HTTPS.
    – Jake
    Dec 16 '10 at 1:25
  • 1
    As unhelpful as this answer is, it's the only correct one. Please move to a web server that doesn't suck. :)
    – intgr
    Nov 10 '15 at 9:19
3

This was answered in another question. Use an Include statement. Worked like a charm for me:

Serve http (port 80) and https (port 443) on same VirtualHost

# Acme Co
<VirtualHost 192.168.56.101:80>
        Include /usr/local/apache2/conf/main-acme.conf
</VirtualHost>

###* SSL
<VirtualHost 192.168.56.101:443>
        Include /usr/local/apache2/conf/main-acme.conf
        SSLEngine On
</VirtualHost>
2

For SSL virtual hosts, you either have to use a second port ala

<VirtualHost *:443>
    ServerName abc.com
</VirtualHost>
<VirtualHost *:4443>
    Servername def.com
</VirtualHost>

or you have to use separate IPs

<VirtualHost 192.168.0.1:443>
    ServerName abc.com
</VirtualHost>
<VirtualHost 192.168.0.2:443>
    Servername def.com
</VirtualHost>

There's actaully a very good explanation in the Apache SSL docs http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html

Search down for "Why can't I use SSL with name-based/non-IP-based virtual hosts?"

5
  • 2
    Be aware of this for the future, though: en.wikipedia.org/wiki/Server_Name_Indication
    – mattdm
    Dec 16 '10 at 1:39
  • Ironically, by the time SNI is widely-accepted enough to be safely used for the majority of virtual hosting sites, IPv6 will probably be commonplace enough to make it irrelevant. Dec 16 '10 at 3:23
  • 4
    @jgoldschrafe Hi 2010, it's future speaking here! Recent caniuse shows non-SNI browsers are <2% worldwide. From the first world it's probably much much less. IPv4 still alive and well :)
    – kubanczyk
    Dec 4 '15 at 22:43
  • 2
    @kubanczyk Got me! :) Dec 8 '15 at 1:02
  • @jgoldschrafe Even with IPv6 I would still prever SNI over assigning blocks of addresses to a single machine, as IPs are mainly for routing and it is easier to manage that way.
    – Bachsau
    Feb 29 '20 at 11:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.