I'm running apache httpd 2.4 on a AWS instance. I have the following httpd configuration:
<VirtualHost *:443>
ServerName jenkins.example.com
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
SSLCertificateFile /var/lib/jenkins/secrets/test-cert.pem
SSLCertificateKeyFile /var/lib/jenkins/secrets/test-key.pem
JkMount /* ajp13
</VirtualHost>
<VirtualHost *:80>
ServerName jenkins.example.com
Redirect / https://jenkins.example.com/
</VirtualHost>
<VirtualHost *:80>
RewriteEngine on
RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
</VirtualHost>
<VirtualHost *:443>
ServerName backoffice.another-example.com
SSLEngine on
SSLProxyEngine On
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
SSLCertificateFile /etc/certificates/backoffice.another-example.com/cert.pem
SSLCertificateChainFile /etc/certificates/backoffice.another-example.com/chain.pem
SSLCertificateKeyFile /etc/certificates/backoffice.another-example.com/privkey.pem
SSLProxyCheckPeerCN Off
SSLProxyCheckPeerName Off
Timeout 600
ProxyTimeout 600
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location />
ProxyPass https://localhost:15678/
ProxyPassReverse https://localhost:15678/
</Location>
</VirtualHost>
<VirtualHost *:443>
ServerName another-example.com
ServerAlias another-example.com
RewriteEngine on
RewriteRule (.*) https://www.another-example.com%{REQUEST_URI} [R,L]
</VirtualHost>
<VirtualHost *:443>
ServerName another-example.com
ServerAlias *.another-example.com
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLHonorCipherOrder on
SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS
SSLCertificateFile /etc/certificates/another-example.com/cert.pem
SSLCertificateChainFile /etc/certificates/another-example.com/chain.pem
SSLCertificateKeyFile /etc/certificates/another-example.com/privkey.pem
ProxyRequests off
ProxyPreserveHost On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
<Location />
ProxyPass http://localhost:20001/ retry=1 acquire=3000 timeout=600 Keepalive=On
ProxyPassReverse http://localhost:20001/
AuthType Basic
AuthName "Test Servers"
AuthBasicProvider file
AuthUserFile /var/www/passwords
Require user example
</Location>
</VirtualHost>
Then, three certificates for:
- another-example.com
- backoffice.another-example.com
- jenkins.example.com (self-signed)
This is the issue: when I go to http://another-example.com or https://another-example.com, I get a warning because of NET::ERR_CERT_AUTHORITY_INVALID, and the browser shows me the self-signed certificate. Then, if I click "Proceed to another-example.com (unsafe)", it does take mt to another-example.com (and asks me for the authentication credentials), and the address bar shows a happy green lock icon and tells me that the certificate is valid and private.
If I remove the two sections for jenkins.example.com
<VirtualHost *:443>
ServerName jenkins.example.com
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
SSLCertificateFile /var/lib/jenkins/secrets/test-cert.pem
SSLCertificateKeyFile /var/lib/jenkins/secrets/test-key.pem
JkMount /* ajp13
</VirtualHost>
<VirtualHost *:80>
ServerName jenkins.example.com
Redirect / https://jenkins.example.com/
</VirtualHost>
I still get another warning, NET::ERR_CERT_COMMON_NAME_INVALID, and the browser shows me the certificate for backoffice.another-example.com. So it's obviously taking the certificate for the first VirtualHost it appears, but then it redirects to the correct domain. This doesn't happen if I type http://www.another-example.com or https://www.another-example.com
What's going on? How can I avoid this first warning for invalid domain certificate being shown?