0

I'm running apache httpd 2.4 on a AWS instance. I have the following httpd configuration:

<VirtualHost *:443>
    ServerName jenkins.example.com
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

    SSLCertificateFile      /var/lib/jenkins/secrets/test-cert.pem
    SSLCertificateKeyFile   /var/lib/jenkins/secrets/test-key.pem
    JkMount /* ajp13
</VirtualHost>

<VirtualHost *:80>
    ServerName jenkins.example.com
    Redirect / https://jenkins.example.com/
</VirtualHost>

<VirtualHost *:80>
    RewriteEngine on
    RewriteCond %{HTTPS} off
    RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName backoffice.another-example.com
    SSLEngine on
    SSLProxyEngine On
    SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

    SSLCertificateFile      /etc/certificates/backoffice.another-example.com/cert.pem
    SSLCertificateChainFile /etc/certificates/backoffice.another-example.com/chain.pem
    SSLCertificateKeyFile   /etc/certificates/backoffice.another-example.com/privkey.pem

    SSLProxyCheckPeerCN Off
    SSLProxyCheckPeerName Off

    Timeout 600
    ProxyTimeout 600
    ProxyRequests off
    ProxyPreserveHost On
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>

    <Location />
        ProxyPass https://localhost:15678/
        ProxyPassReverse https://localhost:15678/
    </Location>
</VirtualHost>

<VirtualHost *:443>
        ServerName another-example.com
        ServerAlias another-example.com

        RewriteEngine on
        RewriteRule (.*) https://www.another-example.com%{REQUEST_URI} [R,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName another-example.com
    ServerAlias *.another-example.com
    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLHonorCipherOrder on
    SSLCipherSuite ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS

    SSLCertificateFile      /etc/certificates/another-example.com/cert.pem
    SSLCertificateChainFile /etc/certificates/another-example.com/chain.pem
    SSLCertificateKeyFile   /etc/certificates/another-example.com/privkey.pem

    ProxyRequests off
    ProxyPreserveHost On
    <Proxy *>
        Order deny,allow
        Allow from all
    </Proxy>

    <Location />
        ProxyPass http://localhost:20001/ retry=1 acquire=3000 timeout=600 Keepalive=On
        ProxyPassReverse http://localhost:20001/
        AuthType Basic
        AuthName "Test Servers"
        AuthBasicProvider file
        AuthUserFile /var/www/passwords
        Require user example
    </Location>    
</VirtualHost>

Then, three certificates for:

  • another-example.com
  • backoffice.another-example.com
  • jenkins.example.com (self-signed)

This is the issue: when I go to http://another-example.com or https://another-example.com, I get a warning because of NET::ERR_CERT_AUTHORITY_INVALID, and the browser shows me the self-signed certificate. Then, if I click "Proceed to another-example.com (unsafe)", it does take mt to another-example.com (and asks me for the authentication credentials), and the address bar shows a happy green lock icon and tells me that the certificate is valid and private.

If I remove the two sections for jenkins.example.com

<VirtualHost *:443>
    ServerName jenkins.example.com
    SSLEngine on
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP

    SSLCertificateFile      /var/lib/jenkins/secrets/test-cert.pem
    SSLCertificateKeyFile   /var/lib/jenkins/secrets/test-key.pem
    JkMount /* ajp13
</VirtualHost>

<VirtualHost *:80>
    ServerName jenkins.example.com
    Redirect / https://jenkins.example.com/
</VirtualHost>

I still get another warning, NET::ERR_CERT_COMMON_NAME_INVALID, and the browser shows me the certificate for backoffice.another-example.com. So it's obviously taking the certificate for the first VirtualHost it appears, but then it redirects to the correct domain. This doesn't happen if I type http://www.another-example.com or https://www.another-example.com

What's going on? How can I avoid this first warning for invalid domain certificate being shown?

  • Are you using a browser that is old or for some other reason doesn't send SNI (Server Name Indication) which is needed for HTTPS virtual hosting? – dave_thompson_085 Aug 18 '16 at 16:05
1

Stare at this until you see the problem.

<VirtualHost *:443>
        ServerName another-example.com
        ServerAlias another-example.com

        <!-- conspicuous hole -->

        RewriteEngine on
        RewriteRule (.*) https://www.another-example.com%{REQUEST_URI} [R,L]
</VirtualHost>

<VirtualHost *:443>
    ServerName another-example.com
    ServerAlias *.another-example.com
...

Where's the SSL certificate configuration for the <VirtualHost *:443> with ServerAlias another-example.com?

I'm a little rusty on Apache but it certainly looks like this is a case where missing configuration directives are being implicitly filled with irrelevant data from higher up in the file. It certainly wouldn't be the first time that happened, and would perfectly explain why removing the self-signed cert changes the error -- different irrelevant configuration data is getting substituted.

All of the SSL* config from the last section needs to be duplicated in the section above it. At least, that is what it looks like, to me.

When the SNI is set to another-example.com the wrong SSL cert is offered because you've essentially not told it which cert to offer in that case.

| improve this answer | |
  • 1
    Thanks. The hole gets more conspicuous when you name it so. – user3748908 Aug 19 '16 at 11:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.