1

So, I have a domain with many subdomains. Let's say example.com, a.example.com, b.example.com, c.example.com, etc.

I want to host them from the same server with the same IP address.

I have my wildcard certificate and my base domain certification, star_example_com.crt and example_com.crt.

I'm trying to set up my Apache server to support SSL on the domain and sub-domains, but can't seem to get it working. The domain is fine, but the sub-domains are not.

Here's my config:

NameVirtualHost *:443 # To support SNI, although, apparently, this directive is deprecated

SSLStrictSNIVHostCheck off

<VirtualHost example.com:443>
    SSLEngine On
    SSLCertificateFile  /etc/apache2/ssl/example_com.crt
    SSLCertificateKeyFile   /etc/apache2/ssl/example_com.key
    SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

    DocumentRoot /var/www/html

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined


        <Directory /var/www/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride All
            Order allow,deny
            allow from all
        </Directory>

</VirtualHost>

<VirtualHost *:443>
    ServerAlias *.example.com
        SSLEngine On
        SSLCertificateFile      /etc/apache2/ssl/star_example_com.crt
        SSLCertificateKeyFile   /etc/apache2/ssl/star_example_com.key
        SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown

        DocumentRoot /var/www/html

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined


        <Directory /var/www/>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride All
            Order allow,deny
            allow from all
       </Directory>  
</VirtualHost>

Am I missing something obvious here? All I want is to make sure that the right SSL cert is used for the domain and subdomains... everything is otherwise the same (this is a WordPress multisite, so it's all going to the same place in the end.

To be clear, I get an error when I access subdomains because I'm not getting the wildcard certificate.

To be further clear, I have over 80 subdomains. I'd like to avoid creating a VirtualHost for each one, if that's possible.

Any pointers?

  • What is the problem you are having? – Michael Hampton Jan 18 '15 at 0:31
  • 1
    Accessing the subdomains results in an SSL error in the browser, since it's not getting the wildcard certificate – Dancrumb Jan 18 '15 at 0:34
1

I don't have sufficient reputation to comment. So I'll post answer. First thing first you should have sub domain and after domain. It depends on order, so first should be configured subdomains and at last whole root domain. I show you my configuration which works perfectly:

/etc/apache2/sites-available/example.conf:

# ====================SSL========================
    <IfModule mod_ssl.c>

    ##      a.example.com
            <VirtualHost *:443>
                    ServerAdmin postmaster@a.example.com
                    ServerName a.example.com
                    ServerAlias *.a.example.com
                    DocumentRoot /home/a.example.com/www/public_html

                    ErrorLog /home/a.example.com/www/logs/ssl_error.log
                    CustomLog /home/a.example.com/www/logs/ssl_access.log combined

                    SSLEngine on
                    SSLCertificateFile /home/a.example.com/www/ssl/a.example.com.crt
                    SSLCertificateKeyFile /home/a.example.com/www/ssl/a.example.com.key
                    SSLCertificateChainFile /home/a.example.com/www/ssl/a.example.com.ca-bundle.crt

                    <Directory /home/a.example.com/www/public_html>
                            Options FollowSymLinks -MultiViews
                            AllowOverride All
                            Order allow,deny
                            Allow from all
                            Satisfy Any
                    </Directory>
            </VirtualHost>
    ##      /a.example.com

    ##      example.com
            <VirtualHost *:443>
                    ServerAdmin postmaster@example.com
                    ServerName example.com
                    ServerAlias *.example.com
                    DocumentRoot /home/example.com/www/public_html/

                    <Directory /home/example.com/www/public_html/>
                            Options FollowSymLinks MultiViews
                            AllowOverride None
                            Order allow,deny
                            allow from all
                    </Directory>

                    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
                    <Directory "/usr/lib/cgi-bin">
                            AllowOverride None
                            Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
                            Order allow,deny
                            Allow from all
                    </Directory>

                    ErrorLog /home/example.com/www/logs/ssl_error.log

                    # Possible values include: debug, info, notice, warn, error, crit,
                    # alert, emerg.
                    LogLevel warn

                    CustomLog /home/example.com/www/logs/ssl_access.log combined

                    #   SSL Engine Switch:
                    #   Enable/Disable SSL for this virtual host.
                    SSLEngine on
                    SSLCertificateFile /home/example.com/www/ssl/example.com.crt
                    SSLCertificateKeyFile /home/example.com/www/ssl/example.com.key
                    SSLCertificateChainFile /home/example.com/www/ssl/example.com.ca-bundle.crt

                            #   SSL Engine Options:
                            <FilesMatch "\.(cgi|shtml|phtml|php)$">
                                    SSLOptions +StdEnvVars
                            </FilesMatch>
                            <Directory /usr/lib/cgi-bin>
                                    SSLOptions +StdEnvVars
                            </Directory>

                            #   SSL Protocol Adjustments:
                            BrowserMatch "MSIE [2-6]" \
                                    nokeepalive ssl-unclean-shutdown \
                                    downgrade-1.0 force-response-1.0
                            # MSIE 7 and newer should be able to use keepalive
                            BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
            </VirtualHost>
    ##      /example.com

    </IfModule>
    # ====================/SSL========================

Keep in mind you should compare config to your environment, so add more domains like a.example.com before example.com. I hope my answer helped you in some way.

  • My main problem is that I'd need to maintain a new virtual host for every domain – Dancrumb Jan 18 '15 at 2:00
1

My answer is too long for comment, so this is why I post new answer. You can just add ServerAlias, not whole VirtualHost you can have specified more ServerAliases. But I understand what you want, so if you don't want to touch apache configuration ServerAlias file every time you add new wp-site, then you could try VirtualDocumentRoot. I don't know much how wordpress multi-sites structure looks like. For example you have structure like this:

/var/www/html/ = main WP site example.com
/var/www/html/site1/ = site1.example.com
/var/www/html/a/ = a.example.com

and so on. I assume you want translate requests like this:

site1.example.com > example.com/site1/
a.example.com > example.com/a/

If it's your scenario like this, you should try replace DocumentRoot with VirtualDocumentRoot:

ServerName example.com
ServerAlias *.example.com
VirtualDocumentRoot /var/www/html/%0

You need to enable vhost_alias:

a2enmod vhost_alias

%0 makes whole name of folder as "ServerAlias", if wordpress makes /var/www/html/site1.example.com/ then you must replace %0 with %1, here is rule table (you can also combine them):

0   the whole name
1   the first part
2   the second part
-1  the last part
-2  the penultimate part
2+  the second and all subsequent parts
-2+ the penultimate and all preceding parts
1+ and -1+  the same as 0

If you try VirtualDocumentRoot remember to comment out DocumentRoot otherwise Apache can fail to start. Here is documentation of vhost_alias.

1

I ended up solving this by create a certificate with a SubjectAltName (SAN) Certificate.

Creating the CSR is a little more involved. You have to create a configuration file like this:

[req]
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
C = US
ST = <your state>
L = <your city>
O = <your company>
CN = <your IP address>
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = example.com
DNS.2 = *.example.com

This is then passed in with your CSR request, eg:

openssl req -new -out san_example_com.csr -key san_example_com.key -config san_req.cnf 

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.