Restrict direct IP access to site - SSL

Question

I have a CentOS 6 VPS with 5 sites and Let's Encrypt installed and working on all sites. When I access https://vps-ip, it always points to the first site configured in vhosts-ssl-letsencrypt.conf (I've changed the config and put another site at the top of the config to test it). I've tried to add:

<VirtualHost ip:443>
    ServerName ip
    Redirect 403 /
    ErrorDocument 403 "No"
    DocumentRoot /usr/local/apache/htdocs
    UseCanonicalName Off
    UserDir disabled
</VirtualHost>

but sites are not accessible via ssl

or <VirtualHost *:443>... 

gives me this error: [error] Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile] ((null):0)

<VirtualHost *>...

no change

http://vps-ip is pointing to the right vps welcome page. Any ideas?

Answer 1

The simple answer is you have not enabled SSL for your *:443 vhost in the question above. Apache doesn't suddenly start talking SSL for a vhost just because you put it on port 443, it needs configuring.

Also this directive is not one that will do anything sensible:

 Redirect 403 /

And you should not use

<VirtualHost *>

That will cause all sorts of problems. Use IP:port or *:port and nothing else. Also do not mix these two types of arguments unless you know exactly what you are doing.

EDIT: In response to the first comment: Add a default SSL virtual host. It must be the first one listed for port 443 in the output of apachectl -S and add the IP address as the ServerName or a ServerAlias

EDIT2: In response to further comments. It would seem you have not enabled SSL. There are an absolute minimum of three SSL directives you need in your virtual host to enable SSL, they are detailed here: http://httpd.apache.org/docs/current/ssl/ssl_howto.html