2

I'm trying to setup Apache(2.2.3) to run two websites with SSL using both different domains and IP addresses. Both websites run fine on port 80 but when I tried to enable SSL for website2 I get a ssl_error_bad_cert_domain error; website2 picks up the SSL cert for website1.

Here is my setup in httpd.conf:

# Website1
NameVirtualHost 192.168.10.1:80

<VirtualHost 192.168.10.1:80>
DocumentRoot /var/www/html
ServerName www.website1.org
</VirtualHost>

NameVirtualHost 192.168.10.1:443

<VirtualHost 192.168.10.1:443>
SSLEngine On
SSLCertificateFile conf/ssl/website1.cer
SSLCertificateKeyFile conf/ssl/website1.key
</VirtualHost>

# Website2
NameVirtualHost 192.168.10.2:80

<VirtualHost 192.168.10.2:80>
DocumentRoot /var/www/html/chart
ServerName www.website2.org
</VirtualHost>

NameVirtualHost 192.168.10.2:443

<VirtualHost 192.168.10.2:443>
SSLEngine On
SSLCertificateFile conf/ssl/website2.cer
SSLCertificateKeyFile conf/ssl/website2.key
</VirtualHost>

Update: In answer to Shane (this wouldn't fit in comment box) here is the output from apachectl -S:

VirtualHost configuration:
192.168.10.2:80       is a NameVirtualHost
         default server www.website2.org (/etc/httpd/conf/httpd.conf:1033)
         port 80 namevhost www.website2.org (/etc/httpd/conf/httpd.conf:1033)

192.168.10.2:443      is a NameVirtualHost
         default server bogus_host_without_reverse_dns (/etc/httpd/conf/httpd.conf:1040)
         port 443 namevhost bogus_host_without_reverse_dns (/etc/httpd/conf/httpd.conf:1040)

192.168.10.1:80       is a NameVirtualHost
         default server www.website1.org (/etc/httpd/conf/httpd.conf:1017)
         port 80 namevhost www.website1.org (/etc/httpd/conf/httpd.conf:1017)

192.168.10.1:443      is a NameVirtualHost
         default server bogus_host_without_reverse_dns (/etc/httpd/conf/httpd.conf:1024)
         port 443 namevhost bogus_host_without_reverse_dns (/etc/httpd/conf/httpd.conf:1024)

wildcard NameVirtualHosts and _default_ servers:
_default_:443          192.168.10.1 (/etc/httpd/conf.d/ssl.conf:81)
Syntax OK
2
  • What output do you get from apache2ctl -S? Apr 12, 2012 at 14:55
  • Can you confirm your .website2.org is resolved to 192.168.10.2?
    – Dennis C
    Oct 28, 2013 at 3:07

8 Answers 8

1

SSL vhosts are not NameVirtualHosts - they're IP-based vhosts.

Remove the NameVirtualHost *:443 from your config.

3
  • I don't have NameVirtualHost *:443 in my httpd.conf file.
    – Tom
    Apr 12, 2012 at 15:45
  • You have two. Remove them.
    – adaptr
    Apr 12, 2012 at 15:45
  • I removed both and restarted apache but the website2 is still inheriting the SSL cert from website1.
    – Tom
    Apr 12, 2012 at 16:04
1

Please remove

NameVirtualHost 192.168.10.1:443

and

NameVirtualHost 192.168.10.2:443

It doesn't make sense to activate the name based virtual hosting stuff of Apache for SSL/TLS connections or you'd like to use the SNI extension.

2
  • I removed those lines, it didn't solve the problem.
    – Tom
    Apr 12, 2012 at 19:25
  • Please remove the default section in your ssl.conf file as well (see Shane Madden's comment) Apr 13, 2012 at 6:42
1

Here is how I got it working. I had to move the ssl configuration out of httpd.conf and setup two virtualhosts in ssl.conf.

httpd.conf

# Website1
<VirtualHost 192.168.10.1:80>
DocumentRoot /var/www/html
ServerName www.website1.org
</VirtualHost>

# Website2
<VirtualHost 192.168.10.2:80>
DocumentRoot /var/www/html/chart
ServerName www.website2.org
</VirtualHost>

ssl.conf

<VirtualHost 192.168.10.1:443>
DocumentRoot "/var/www/html/"
ServerAdmin [email protected]
ServerName www.website1.org
SSLEngine On
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:
+EXP:+eNULL
SSLCertificateFile /etc/httpd/conf/ssl.crt/website1.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/website1.key
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
</VirtualHost>

<VirtualHost 192.168.10.2:443>
DocumentRoot "/var/www/html/chart/"
ServerAdmin [email protected]
ServerName www.website2.org
SSLEngine On
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:
+EXP:+eNULL
SSLCertificateFile /etc/httpd/conf/ssl.crt/website2.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/website2.key
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
</VirtualHost>
1
  • This is more or less what everyone here tried to recommend ;-) . Apache includes different files for configuration purposes. So its required to check all of them or to get a output of "apache2ctl -S". Anyway I like the way most administrators are going to split the configuration into different files. So you keep the overview about all the different settings (usually). Apr 15, 2012 at 8:15
1

Now that Apache2 handles named based virtualhosts for both HTTP AND HTTPS I would recommend setting your domains up in their own config file. Just as Apache does now with it's "sites-available/sites-enabled" config directories. Place both your http and https declarations in one file and either save that file to the "sites-enabled" directory or save wherever you want and sym-link it.

Like: /etc/apache2/sites-enabled/Website_ONE.com.conf:

<VirtualHost *:80>
  ServerName Website_ONE.com
  #if you want to redirect to https: 
  Redirect permanent / https://Website_ONE.com/
  DocumentRoot /WWW/Website_ONE.com/ 
</VirtualHost>

<VirtualHost *:443>
  ServerName Website_ONE.com
  DocumentRoot /WWW/Website_ONE.com/ 

  ### SSL Setup ###
  SSLEngine on
  SSLCertificateFile /etc/SSL_conf/Website_ONE.com/cert.pem
  SSLCertificateKeyFile /etc/SSL_conf/Website_ONE.com/privkey.pem
  SSLCertificateChainFile /etc/SSL_conf/Website_ONE.com/chain.pem
</VirtualHost>

Then: /etc/apache2/sites-enabled/Website_TWO.com.conf:

<VirtualHost *:80>
  ServerName Website_TWO.com
  #if you want to redirect to https: 
  Redirect permanent / https://Website_TWO.com/
  DocumentRoot /WWW/Website_TWO.com/ 
</VirtualHost>

<VirtualHost *:443>
  ServerName Website_TWO.com
  DocumentRoot /WWW/Website_TWO.com/ 

  ### SSL Setup ###
  SSLEngine on
  SSLCertificateFile /etc/SSL_conf/Website_TWO.com/cert.pem
  SSLCertificateKeyFile /etc/SSL_conf/Website_TWO.com/privkey.pem
  SSLCertificateChainFile /etc/SSL_conf/Website_TWO.com/chain.pem
</VirtualHost>

These files can, as I said, be kept anywhere - providing they are safe (i.e. readable by only the people that need access) - and linked into the sites-enabled folder. Same with the key files and all that. It makes it easier IMHO to keep track of your virtualhosts if all the config is in a file named after the domain. BTW, I would use absolute paths in the your config vs relative - as you did in your answer.

0

Try removing or commenting out the <VirtualHost _default_:443> block in /etc/httpd/conf.d/ssl.conf.

6
  • I tried this too, then stopped and started apache but the problem still exists.
    – Tom
    Apr 12, 2012 at 19:34
  • Has Apache ever presented the correct certificate? Say, when you access the site with a SNI-capable browser? Apr 12, 2012 at 19:40
  • No, I've been hitting the site w/ Firefox 11, latest Chrome, IE 9 and never get correct cert. If I modify my httpd.conf to list website2 before website1 then the issue is reversed website2 has the correct cert but website1 now inherits website2 cert.
    – Tom
    Apr 12, 2012 at 19:53
  • Oh.. old Apache! What do your Listen directives look like? Apr 12, 2012 at 19:55
  • Seriously, this is a whole lot easier in IIS.Within httpd.conf: Listen 80, within ssl.conf: Listen 443.
    – Tom
    Apr 12, 2012 at 20:02
0

You need ServerName www.server[1|2}.com in section

0

If you really run apache 2.2.3 the problem is that you cannot do name-based Virtual Hosting on SSL, because your mod_ssl doesn't support it.

You need apache version 2.2.12 or later for that.

You can however use ip-based virtual hosting. The solution you posted is actually doing that (two sites on two different ip adresses)

-1

You can not use vhosts with SSL unless you use a fairly recent development called SNI. You could also use a wildcard cert (e.g. *.myhostname.com) if all your TLDs are the same.

For more detail, see:

7
  • 1
    I thought it was possible as long as you have different IPs?
    – Tom
    Apr 12, 2012 at 16:06
  • Yes, of course, but then you are not using name based virtual hosts :) With name based vhosts, you are attaching several names to a single ip and telling the server how to sort them out. I've been through the same process you are now going through... although there are ways around it, they are not yet reliable or common. Apr 12, 2012 at 19:27
  • Do other solutions exist? I'd rather not run two instances of apache.
    – Tom
    Apr 12, 2012 at 19:34
  • @BrillPappin There aren't several names on any of those IP/port combinations? Apr 12, 2012 at 19:39
  • Those two links I posted above should give you all the info an options you need. I think pretty much the only way your going to get what you want is if all the domains have the same TLD so you can use a while-card cert. However, you should not take my word as the last word, go check those links for other options. Apr 13, 2012 at 13:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .