2

I am running two websites on Apache 2.4 webserver. It is configured as NameBaseVhost and both have their own wildcard ssl certificate (*.site1.com and *.site2.com) issued by Godaddy. Every thing is working fine. When I access websites through it's subdomain www.site1.com and www.site2.com it works fine. Apache has a Rewrite rule to redirect http to https so both the websites are redirecting perfectly.

Now the Problem is when I redirect root domain to www, for site2.com it gives me error. 

Error code: ssl_error_bad_cert_domain

site2.com uses an invalid security certificate. 
The certificate is only valid for the following names: 
*.site1.com, site1.com

Httpd configuration of site1.com 

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R]
# Redirect root domain to www
RewriteCond %{HTTP_HOST} ^site1\.com$ [NC]
RewriteRule ^(.*)$ https://www.site1.com/$1 [R=301,L]

<VirtualHost *:443>
ServerName www.site1.com
DocumentRoot /var/www/html/site1/public/
SSLEngine On
SSLCertificateFile /etc/pki/tls/certs/site1/site1.crt
SSLCertificateKeyFile /etc/pki/tls/private/site1/site1.key
SSLCertificateChainFile /etc/pki/tls/certs/site1/gd_site1.crt
Header always set Strict-Transport-Security "max-age=31536000;
</VirtualHost>

Httpd Configuration for site2.com 

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R]
# Redirect root domain to www
RewriteCond %{HTTP_HOST} ^site2\.com$ [NC]
RewriteRule ^(.*)$ https://www.site2.com/$1 [R=301,L]

<VirtualHost *:443>
ServerName www.site2.com
DocumentRoot /var/www/html/site2/public/
SSLEngine On
SSLCertificateFile /etc/pki/tls/certs/site2/site2.crt
SSLCertificateKeyFile /etc/pki/tls/private/site2/site2.key
SSLCertificateChainFile /etc/pki/tls/certs/site2/gd_site2.crt
Header always set Strict-Transport-Security "max-age=31536000;
</VirtualHost>

How to resolve this issue?

Improve this question
3
  • What happens if you put a serveralias site2.com in the site2 vhost ?
    – user9517
    Dec 19, 2015 at 9:57
  • I have only a vague feeling which might be completely wrong but I'll still share it: your first rewrite rule which redirects from HTTP to HTTPS is okay but think what happens when the client reconnects using HTTPS -- before the SSL handshake completes, there's simply no HTTP host available because it's communicated via the HTTP headers by the client, and that happens over the already established SSL tunnel. Hence I'd say you should put your final rewriting inside corresponding virtual host blocks, like this suggests.
    – kostix
    Dec 19, 2015 at 13:07
  • Also note that name-based virtual hosting with HTTPS works only if both the server and the client use a special extension to TLS called "SNI", and using it requires at least TLSv1. Supposedly it is your case, but reading the docs could explain where my vague feeling came from.
    – kostix
    Dec 19, 2015 at 13:09

1 Answer 1

Reset to default
-1

The problem is the use of <VirtualHost *:443> in the VHost. Use the specific IP Addresses of the websites, otherwise all SSL traffic will be routed through the first VHost entry.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .