1

I have a web server with two domains pointing to the same document root. I have separate SSL certs for the two domains. I want (almost) everything that comes to the site(s) to run under SSL. All works, but the config I have seems overlong and repetitive, and I wondered if I could simplify it?

I checked these answers: Setting up SSL virtual hosts in Apache, Apache: Multiple Virtual Hosts w/ SSL Certificates?, https://www.howtoforge.com/hosting-multiple-ssl-web-sites-on-one-ip-address-with-apache-2.2-and-gnutls-debian-lenny but although useful, they didn't seem to quite address this case.

I wondered if there's a way to break out the config into files that one can then include?

my ports.conf:

NameVirtualHost *:80
NameVirtualHost *:443
Listen 80

<IfModule mod_ssl.c>
    # If you add NameVirtualHost *:443 here, you will also have to change
    # the VirtualHost statement in /etc/apache2/sites-available/default-ssl
    # to <VirtualHost *:443>
    # Server Name Indication for SSL named virtual hosts is currently not
    # supported by MSIE on Windows XP.
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

sites-available-default:

<VirtualHost *:80>
ServerAdmin xx@yy.com
ServerName yy.com

DocumentRoot /var/www
<Directory />
    Options FollowSymLinks
    AllowOverride None
</Directory>
<Directory /var/www/>
    # everything to run under ssl
    RewriteEngine on
    RewriteCond %{HTTPS} !=on
    RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
    Options -Indexes FollowSymLinks MultiViews
    AllowOverride None
    Order allow,deny
    allow from all
</Directory>

ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
<Directory "/usr/lib/cgi-bin">
    AllowOverride None
    Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
    Order allow,deny
    Allow from all
</Directory>

ErrorLog ${APACHE_LOG_DIR}/error.log

# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn

CustomLog ${APACHE_LOG_DIR}/access.log combined

ProxyRequests Off

<Proxy *>
    Order deny,allow
    Allow from all
</Proxy>

ProxyPass /geoserver http://localhost:8080/geoserver
ProxyPreserveHost On
ProxyStatus On

default-ssl:

<IfModule mod_ssl.c>
<VirtualHost _default_:443>
    ServerAdmin xx@yy.com
    ServerName yy.com:443
    DocumentRoot /var/www
    <Directory />
        Options FollowSymLinks
        AllowOverride None
    </Directory>
    <Directory /var/www/>
        Options -Indexes FollowSymLinks MultiViews
        AllowOverride None
        Order allow,deny
        allow from all
    </Directory>

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/error.log

    # Possible values include: debug, info, notice, warn, error, crit,
    # alert, emerg.
    LogLevel warn

    CustomLog ${APACHE_LOG_DIR}/ssl_access.log combined

    #   SSL Engine Switch:
    #   Enable/Disable SSL for this virtual host.
    SSLEngine on

    SSLCertificateFile    /etc/apache2/ssl/yy.com.crt
    SSLCertificateKeyFile /etc/apache2/ssl/yy.com.key

    #   Server Certificate Chain:
    SSLCertificateChainFile /etc/apache2/ssl/intermediate.crt

    #   Certificate Authority (CA):

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
        SSLOptions +StdEnvVars
    </Directory>

    #   SSL Protocol Adjustments:
    BrowserMatch "MSIE [2-6]" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
    # MSIE 7 and newer should be able to use keepalive
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

</VirtualHost>
</IfModule>

The second site's ssl.conf:

<IfModule mod_ssl.c>
<VirtualHost *:443>

    ServerAdmin xx@zz.com
    ServerName zz.com
    ServerAlias www.zz.com
    DocumentRoot /var/www

    #   SSL Engine Switch:
    #   Enable/Disable SSL for this virtual host.
    SSLEngine on

    SSLCertificateFile /etc/apache2/ssl/zz.com.crt
    SSLCertificateKeyFile /etc/apache2/ssl/zz.com.key

    #   Server Certificate Chain:
    SSLCertificateChainFile /etc/apache2/ssl/zz.com/intermediate.crt

    ScriptAlias /cgi-bin/ /usr/lib/cgi-bin/
    <Directory "/usr/lib/cgi-bin">
        AllowOverride None
        Options +ExecCGI -MultiViews +SymLinksIfOwnerMatch
        Order allow,deny
        Allow from all
    </Directory>

    <FilesMatch "\.(cgi|shtml|phtml|php)$">
        SSLOptions +StdEnvVars
    </FilesMatch>
    <Directory /usr/lib/cgi-bin>
        SSLOptions +StdEnvVars
    </Directory>

    BrowserMatch "MSIE [2-6]" \
        nokeepalive ssl-unclean-shutdown \
        downgrade-1.0 force-response-1.0
    # MSIE 7 and newer should be able to use keepalive
    BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown

</VirtualHost>

</IfModule>

Any help appreciated.

Mini

0

Just as I posted, I thought there must be an 'include' function :) So I looked it up (https://httpd.apache.org/docs/2.4/mod/core.html#include) and have now created a few separate '.conf' files that I can include as appropriate. So the second site's ssl.conf now looks like this:

<IfModule mod_ssl.c>
<VirtualHost *:443>

  ServerAdmin xx@zz.com
  ServerName zz.com
  ServerAlias www.zz.com
  DocumentRoot /var/www

  Include conf/cgi.conf
  Include conf/proxy.conf
  Include conf/ssl.conf

  #   SSL Engine Switch:
  #   Enable/Disable SSL for this virtual host.
  SSLEngine on

  SSLCertificateFile /etc/apache2/ssl/zz.com.crt
  SSLCertificateKeyFile /etc/apache2/ssl/zz.com.key

  #   Server Certificate Chain:
  SSLCertificateChainFile /etc/apache2/ssl/zz.com/intermediate.crt

</VirtualHost>

</IfModule>

Much nicer and easier now

Mini

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.