0

I need to add an ssl cert to a second domain on my server (AWS Amazon Linux)

I thought I enabled SNI correctly? although probably not...

domain1 already has a functioning SSL cert.
First attempt I was getting stuck in a redirect loop. Second (current) attempt it now gives me a 403/Forbidden on the /users/login/ directory.

httpd -v
Server version: Apache/2.2.29 (Unix)

base httpd.conf: ... LoadModule ssl_module modules/mod_ssl.so

Listen 80
NameVirtualHost *:80
Listen 443
NameVirtualHost *:443
...

domain1.conf:

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

SSLPassPhraseDialog  builtin

SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300

SSLMutex default

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin

SSLCryptoDevice builtin

<VirtualHost *:443>

   ServerAdmin hostmaster@domain1.com
   ServerName domain1.com

   SSLEngine On
   SSLProtocol all -SSLv2

   SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

   SSLCertificateFile /var/www/domain1.com/apache_includes/secure/domain1.com.crt
   SSLCertificateKeyFile /var/www/domain1.com/apache_includes/secure/domain1.com.key
   SSLCertificateChainFile /var/www/domain1.com/apache_includes/secure/gd_bundle.crt

   ProxyPreserveHost On

   RequestHeader set X-Forwarded-Protocol https
   ProxyPass / http://127.0.0.1/

   SetEnvIf User-Agent ".*MSIE.*" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0

</VirtualHost>

domain2.conf:

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

SSLPassPhraseDialog  builtin

SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300

SSLMutex default

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin

SSLCryptoDevice builtin

<VirtualHost *:443>

   ServerAdmin hostmaster@domain1.com

   ServerName domain2.com
   ServerAlias www.domain2.com #prob don't need this....

   SSLEngine On
   SSLStrictSNIVHostCheck on
   SSLProtocol all -SSLv2

   SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

   SSLCertificateFile /var/www/domain2.com/apache_includes/secure/domain2.crt
   SSLCertificateKeyFile /var/www/domain2.com/apache_includes/secure/domain2.key
   SSLCertificateChainFile /var/www/domain2.com/apache_includes/secure/bundle.crt

   ProxyPreserveHost On

   RequestHeader set X-Forwarded-Protocol https
   ProxyPass / http://127.0.0.1/

   SetEnvIf User-Agent ".*MSIE.*" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0

</VirtualHost>
0

In Apache 2.2 The NameVirtualHost directive must match the <VirtualHost> blocks (so use <VirtualHost *:443> for both blocks)

The ServerName and ServerAlias directives inside the <VirtualHost> block are used to select which block to serve based on the incoming request.

1
  • I did change the line <VirtualHost domain2.com:443> to <VirtualHost *:443>, but had no change in result. – Jason Kofoed Apr 29 '16 at 21:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.