I'm running Apache as an HTTPS reverse proxy, with many real hosts proxied through a single VirtualHost (single public IP, wildcard certificate), using mod_rewrite and mod_proxy.

Basically, something like:

<VirtualHost *:443>
SSLEngine On
RewriteEngine On
RewriteCond %{SERVER_NAME} ^(server1|server2|server3)\.domain\.net$
RewriteRule ^/(.*)$ https://%{SERVER_NAME}/$1 [P]   # Forward requests for listed servers
RewriteRule ^.*$ - [F]                              # Block anything else

Now I need to set Timeout to a larger value than default, but only for requests going to one of these servers (sync server for mobile devices).

Can this be done without requiring a separate VirtualHost (and thus another public IP) ?


Having an extra VirtualHost doesn't demand a new public IP; your wildcard certificate will (I'm assuming?) be valid for the new sync server's listener.

Apache will gladly throw a warning when you set a NameVirtualHost *:443 directive, but using host headers over an SSL connection will work just fine. Give your existing VirtualHost a wildcard ServerAlias and make sure it loads first.

You can then make your second VirtualHost attached to the same IP (with a ServerName that gives it the requests for the mobile sync server).

  • What about doing just the opposite, one VirtualHost for the mobile sync server with a ServerName first, then a second VirtualHost with no ServerAlias/ServerName directive at all, and the config described above? Would that work too? – Nicolas Melay Apr 14 '11 at 22:43
  • @Nico57 No good. If you enable NameVirtualHost on the port, then every VirtualHost on the port must have at least a ServerName directive (and yours should get a ServerAlias directive so that it gets all the requests that don't exactly match a ServerName). The only reason I'm saying that the catch-all one loads first is that the first to load is considered the default for requests that come in on the port with a missing or unmatched Host header. – Shane Madden Apr 14 '11 at 22:49
  • I'm indeed using NameVirtualHost *:443 at the top of the config file, do you mean that I should remove that? – Nicolas Melay Apr 14 '11 at 23:00
  • No matter how hard I try, Apache does not want to branch connections to a second virtualhost. Which is somewhat expected: it's not able to select the right VirtualHost before the mod_ssl gets involved, and since the SSL settings are inside the VirtualHost, it's too late when it gets here, it WON'T hop out of the current virtualhost to the next one. The SSL and VirtualHosts features are layered according to a "one certificate, one server" vision. Do you really think this could/should work otherwise Shane? – Nicolas Melay Apr 14 '11 at 23:20
  • Well, kinda.. It's not able to decide with cert to use unless the server and the client both support TLS server name indication. That aside; even if it can't decide which cert to connect with, that has no bearing on its ability to pick a vhost based on the Host: header. Couple things: 1) The SSL config should be identical in both VirtualHost blocks; you'll want to make sure that's the case. 2) Check out your error.log, anything interesting? Should give some hints on what's going on, and probably some warnings for using SSL'd NameVirtualHost. What version of Apache, too? – Shane Madden Apr 15 '11 at 1:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.