2

I am running two websites on Apache 2.4 webserver. It is configured as NameBaseVhost and both have their own wildcard ssl certificate (*.site1.com and *.site2.com) issued by Godaddy. Every thing is working fine. When I access websites through it's subdomain www.site1.com and www.site2.com it works fine. Apache has a Rewrite rule to redirect http to https so both the websites are redirecting perfectly.

Now the Problem is when I redirect root domain to www, for site2.com it gives me error.

Error code: ssl_error_bad_cert_domain

site2.com uses an invalid security certificate. 
The certificate is only valid for the following names: 
*.site1.com, site1.com 

Httpd configuration of site1.com

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R]
# Redirect root domain to www
RewriteCond %{HTTP_HOST} ^site1\.com$ [NC]
RewriteRule ^(.*)$ https://www.site1.com/$1 [R=301,L]

<VirtualHost *:443>
ServerName www.site1.com
DocumentRoot /var/www/html/site1/public/
SSLEngine On
SSLCertificateFile /etc/pki/tls/certs/site1/site1.crt
SSLCertificateKeyFile /etc/pki/tls/private/site1/site1.key
SSLCertificateChainFile /etc/pki/tls/certs/site1/gd_site1.crt
Header always set Strict-Transport-Security "max-age=31536000;
</VirtualHost>

Httpd Configuration for site2.com

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R]
# Redirect root domain to www
RewriteCond %{HTTP_HOST} ^site2\.com$ [NC]
RewriteRule ^(.*)$ https://www.site2.com/$1 [R=301,L]

<VirtualHost *:443>
ServerName www.site2.com
DocumentRoot /var/www/html/site2/public/
SSLEngine On
SSLCertificateFile /etc/pki/tls/certs/site2/site2.crt
SSLCertificateKeyFile /etc/pki/tls/private/site2/site2.key
SSLCertificateChainFile /etc/pki/tls/certs/site2/gd_site2.crt
Header always set Strict-Transport-Security "max-age=31536000;
</VirtualHost>

How to resolve this issue?

  • What happens if you put a serveralias site2.com in the site2 vhost ? – Iain Dec 19 '15 at 9:57
  • I have only a vague feeling which might be completely wrong but I'll still share it: your first rewrite rule which redirects from HTTP to HTTPS is okay but think what happens when the client reconnects using HTTPS -- before the SSL handshake completes, there's simply no HTTP host available because it's communicated via the HTTP headers by the client, and that happens over the already established SSL tunnel. Hence I'd say you should put your final rewriting inside corresponding virtual host blocks, like this suggests. – kostix Dec 19 '15 at 13:07
  • Also note that name-based virtual hosting with HTTPS works only if both the server and the client use a special extension to TLS called "SNI", and using it requires at least TLSv1. Supposedly it is your case, but reading the docs could explain where my vague feeling came from. – kostix Dec 19 '15 at 13:09
-1

The problem is the use of <VirtualHost *:443> in the VHost. Use the specific IP Addresses of the websites, otherwise all SSL traffic will be routed through the first VHost entry.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.