0

I have my web server with a WordPress installed on it, it's a public web server, an Apache 2.2 Running under CentOS 6.5, and I'm using name-based virtual hosts.

The worpdress is the default site, and is running under plain HTTP, but for security compliance, I need to access the administration via HTTPS.

The problem is that I have already one certificate for one virtualhost example.com (obv., fake URL) this is what I want to configure WordPress administration into a subdomain (wpadmin.example.com), that I can use the SSL certificate.

Anyone knows if possible? And if it is, how to do that? PS: I have full root access to the server :)

3
  • You can use any certificate you like; however, if the certificate's CN doesn't match the host name you enter in your browser, you will get a warning. As for "how" - read the instructions at your certificate vendor's site and/or the ones at httpd.apache.org/docs – Jenny D Apr 8 '14 at 13:24
  • Why do you want to use a subdomain? And I don't think you can anyway. – Michael Hampton Apr 8 '14 at 13:31
  • Hi, it's simple, I have blog.com (wordpress blog), and another name based virtual hosts (one with a GoDaddy wildcard SSL certificate for mydomain.com). And I want to securely access to my blog administration. If I run the complete blog under SSL, people will receive an SSL error (does not march CN), and if is not possible to use more than one SSL cert in a name based virtual host apache web server. So, I wan to make the WordPress administration accesible only via blogadmin.mydomain.com. So I can securely admin my wordpress and the CN matches. – mvillar Apr 8 '14 at 14:08
2

I do think that having all the secure pages under one subdomain is a good idea to code in principle since it's easier to enforce at the request level and conceptually too.

The problem is that a /wp-admin to subdomain redirect won't work and you'll need to change the WP admin code to work with subdomain since for example (admin session) cookies for one domain won't be sent to another ( same origin policy ) .

The easiest way is to probably just use the "Administration Over SSL" setting in WP and/or the WordPress HTTPS plug-in, so you are forcing yourself/admins to go over SSL and since it's only for admins and not the public you don't need to use/buy a SSL certificate but you can generate one yourself.

2
  • Agreed - I administer a WordPress blog at work, and we have done the same. The server (in our case an Amazon ELB) is configured to serve both HTTP and HTTPS, WordPress manages the split between HTTP and HTTPS and forces all logins to HTTPS. Also worth a look is codex.wordpress.org/Hardening_WordPress – Craig Watson Apr 8 '14 at 15:49
  • @LinuxDevOps So, it it's technically possible, but it's fairly complex, I understand. Thanks for your response – mvillar Apr 8 '14 at 21:26

Not the answer you're looking for? Browse other questions tagged or ask your own question.