I have this setup
Server version: Apache/2.2.22 (Ubuntu) OpenSSL 1.0.1c 10 May 2012
One IP with multiple domains connected to it.
example1.com I have a signed SSL certificate, and thus
example1.com is accessible via
This is also true for
example2.com (signed with a valid certificate and accessible via
example3.com does NOT have any SSL certificates tied to it, and should not be accessible via
https (SSL port 443). But, when a user goes to
https://example3.com a warning is shown. In Chrome it looks like this
You attempted to reach example3.com, but instead you actually reached a server identifying itself as secure.example1.com. This may be caused by a misconfiguration on the server or by something more serious. An attacker on your network could be trying to get you to visit a fake (and potentially harmful) version of example3.com
If you disregard the warning, the user will actually be shown the contents of
The VirtualHost setup looks like this
<VirtualHost *:443> ServerName secure.example1.com DocumentRoot /var/www/blahblah SSLEngine on SSLCertificateFile /blahblah.crt SSLCertificateKeyFile /blahblah.key SSLCertificateChainFile /blahblah.pem </VirtualHost> <VirtualHost *:443> ServerName secure.example2.com DocumentRoot /var/www/blahblah SSLEngine on SSLCertificateFile /blahblah.crt SSLCertificateKeyFile /blahblah.key SSLCertificateChainFile /blahblah.pem </VirtualHost> <VirtualHost *:80> ServerName example3.com DocumentRoot /var/www/blahblah </VirtualHost>
How can I prevent this behaviour?