1

I am currently following the following guide: https://www.digitalocean.com/community/articles/how-to-set-up-multiple-ssl-certificates-on-one-ip-with-apache-on-ubuntu-12-04

Setup so far has been problem free. I am using two class 1 certificates that I have registered at http://www.startssl.com/?app=21. Each is mapped to its own (correct) domain.

The problem is this: going to either domain under https resolves to the same document root, i.e. if I go to https://backend.domain2.com, I correctly come to the doc root indicated in its VirtualHost configuration. However, if I go to https://email.domain1.com, I get sent to the root of backend.domain2, URL remaining intact, with a warning that the SSL certificate is invalid. An inspection of the "invalid" certificate reveals that it is the one connected to backend.domain2.

What am I doing wrong here? the VirtualHost configs for both domains are below:

<IfModule mod_ssl.c>
        <VirtualHost *:443>
        # The ServerName directive sets the request scheme, hostname and port that
        # the server uses to identify itself. This is used when creating
        # redirection URLs. In the context of virtual hosts, the ServerName
        # specifies what hostname must appear in the request's Host: header to
        # match this virtual host. For the default virtual host (this file) this
        # value is not decisive as it is used as a last resort host regardless.
        # However, you must set it for any further virtual host explicitly.

        ServerName mail.domain1.se
        ServerAdmin christopher.svanefalk@gmail.com
        ServerAlias www.mail.domain1.se

        DocumentRoot /usr/share/apache2/roundcubemail

        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>

    SSLEngine on
    SSLProtocol all -SSLv2
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM

    SSLCertificateFile      /etc/ssl/certs/domain1.crt
        SSLCertificateKeyFile   /etc/ssl/private/domain1.key
    #SSLCertificateChainFile /etc/ssl/certs/sub.class1.server.ca.pem

        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        # For most configuration files from conf-available/, which are
        # enabled or disabled at a global level, it is possible to
        # include a line for only one particular virtual host. For example the
        # following line enables the CGI configuration for this host only
        # after it has been globally disabled with "a2disconf".
        #Include conf-available/serve-cgi-bin.conf

        #Alias /mail "/usr/share/apache2/roundcubemail/"

        ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:9000/usr/share/apache2/roundcubemail/$1

    </VirtualHost>
</IfModule>



<IfModule mod_ssl.c>
<VirtualHost *:443>
    # The ServerName directive sets the request scheme, hostname and port that
    # the server uses to identify itself. This is used when creating
    # redirection URLs. In the context of virtual hosts, the ServerName
    # specifies what hostname must appear in the request's Host: header to
    # match this virtual host. For the default virtual host (this file) this
    # value is not decisive as it is used as a last resort host regardless.
    # However, you must set it for any further virtual host explicitly.

    ServerName backend.domain2.com
    ServerAdmin christopher.svanefalk@gmail.com
    #ServerAlias www.domain2.com

    DocumentRoot /var/www/backend.domain2.com/html

    <Directory />
            Options FollowSymLinks
            AllowOverride None
        </Directory>

    # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
    # error, crit, alert, emerg.
    # It is also possible to configure the loglevel for particular
    # modules, e.g.
    #LogLevel info ssl:warn

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

    # For most configuration files from conf-available/, which are
    # enabled or disabled at a global level, it is possible to
    # include a line for only one particular virtual host. For example the
    # following line enables the CGI configuration for this host only
    # after it has been globally disabled with "a2disconf".
    #Include conf-available/serve-cgi-bin.conf

    #Alias /mail "/usr/share/apache2/roundcubemail/"

    #ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:9000/var/www/pegasusgbg.se/html/$1

    SSLEngine On
    SSLProtocol all -SSLv2
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM

    SSLCertificateFile /etc/ssl/certs/domain2.crt
    SSLCertificateKeyFile /etc/ssl/private/domain2.key
    #SSLCertificateChainFile /etc/ssl/certs/sub.class1.server.ca.pem
    CustomLog /var/log/apache2/ssl_request_log \
        "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>
</IfModule>

My ports.conf config is:

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default

NameVirtualHost *:80
NameVirtualHost *:443

Listen 80

<IfModule ssl_module>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

# vim: syntax=apache ts=4 sw=4 sts=4 sr noet
  • 1
    Did you add NameVirtualHost *:443 to your configuration? – faker May 1 '14 at 20:55
  • Yes, I will append my ports.conf above, just a moment. – csvan May 1 '14 at 20:57
  • I am having the exact same issue on 2.4.7 (Ubuntu LTS). Did you find a solution? – ColinM Jan 7 '16 at 4:49
1

This..

ServerName mail.domain1.se
ServerAdmin christopher.svanefalk@gmail.com
ServerAlias www.mail.domain1.se

..and this..

ServerName backend.domain2.com
#ServerAlias www.domain2.com

..both don't match with the hostname you're saying you're visiting, https://domain1.com. These hostnames will need to match exactly with what's being requested in the browser for the correct certificate to be served to the client.

  • domain1.com etc was supposed to be a generic item, the real domain name is actually backend.domain2.com etc. I will update my code so there is no confusion. – csvan May 2 '14 at 8:27
  • When you update, please use example.com and example.org instead of domain1.com etc. It's rude to use domains owned by someone else. – Jenny D May 2 '14 at 9:38
  • @chrsva Can you add the output of apachectl -S as well? – Shane Madden May 2 '14 at 15:38
  • @JennyD - respectfully, domain1.com and domain2.com are not owned by anyone, or I would not have used them. – csvan May 3 '14 at 5:57
  • s/not owned/not currently owned/ - example.[com|net|org] are specifically set aside for this purpose. Of course, it would have been better still if you hadn't obfuscated your domain name at all; that way the people spending their free time trying to help you would have been able to verify how it looks from the client. – Jenny D May 3 '14 at 6:20
0

Just to make sure, are you using a browser version that supports SNI? According to Wikipedia ,

 As of November 2012, the only major user bases whose browsers do not support 
 SNI appear to be users of Android 2.x (default browser)[2], Internet Explorer 
 on Windows XP[3][4] and versions of Java before 1.7 on any operating system.[5]

or a more detailed list here: http://en.wikipedia.org/wiki/Server_Name_Indication#Client_side

  • I have tried it across 3 separate browsers - the latest Chrome, Firefox and Konqueror. All yield the same issue, and all support SNI. I am rather certain it is a server problem. – csvan May 2 '14 at 8:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.