0

I have a web server that can be accessed via

(1) internal private IP address 192.168.0.1 ;

(2) public domain (its public IP is NAT-mapped to internal private IP 192.168.0.1).

I have my default-ssl.conf like this

<VirtualHost _default_:443>
        ServerAdmin nms@xxx.com
        ServerName xxx.yyy.com:443
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine on
        SSLCertificateFile      /opt/xxx/cert_xxx.yyy.com.pem
        SSLCertificateKeyFile   /opt/xxx/key_xxx.yyy.com.pem
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
            SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
            SSLOptions +StdEnvVars
        </Directory>
        BrowserMatch "MSIE [2-6]" \
            nokeepalive ssl-unclean-shutdown \
            downgrade-1.0 force-response-1.0
        # MSIE 7 and newer should be able to use keepalive
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>

<VirtualHost 192.168.0.1:443>
        ServerAdmin nms@xxx.com
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        SSLEngine on
        SSLCertificateFile      /opt/xxx/cert_192.168.0.1.pem
        SSLCertificateKeyFile   /opt/xxx/key_192.168.0.1.pem
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
            SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
            SSLOptions +StdEnvVars
        </Directory>
        BrowserMatch "MSIE [2-6]" \
            nokeepalive ssl-unclean-shutdown \
            downgrade-1.0 force-response-1.0
        # MSIE 7 and newer should be able to use keepalive
        BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
</VirtualHost>

The certificate is self-signed, and I've imported my CA cert to the browser.

However, only the public domain can be accessed WITHOUT being asked about the certificate. When accessed via the internal private IP, I still got asked about the cert (Apache uses the public domain's cert).

How should I configue Apache to fix this problem?

  • I can't see any ServerName directive for the second virtual host. – ALex_hha Mar 30 '16 at 10:38
  • What is your browser actually complaining about? Because not every warning/request for confirmation is the same... – HBruijn Mar 30 '16 at 10:39
  • we don't have internal DNS, so we use IP to access it. – user538565 Mar 30 '16 at 10:53
  • the browser's complain is like this: alssl.askleomedia.com/wp-content/uploads/2012/04/… – user538565 Mar 30 '16 at 10:55
0

Both your VirtualHosts are listening are probably listening for the same.

Try using NameVirtualhost: (change ip/domain to fit your setup)

NameVirtualHost 10.11.12.13:443

<VirtualHost 10.11.12.13:443>
  # Are we trying to reach my.domain.tld?
  ServerName my.domain.tld
</VirtualHost>

<VirtualHost 10.11.12.13:443>
  # Are we trying to reach the ip
  ServerName 10.11.12.13
</VirtualHost>
0

jusr reorder those <VirtualHost> so that the internal private <VirtualHost> is listed first

(Ref: https://httpd.apache.org/docs/current/vhosts/name-based.html)

0

NameVirtualHost does not work for SSL connections. Apache negotiates the SSL first, then looks at what domain (and therefore which VirtualHost) you asked for.

So since it cannot differentiate between both VirtualHost (both are valid for the IP), it will always use the first one it finds. Hence you always see the certificate for the public.

Fix1: assign one IP per certificate. One IP -> One VirtualHost -> One certificate.

Fix2: if your browser and Apache version support it, you could use SNI (Server Name Identification).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.