4

I have been facing a weird problem since last 3 days; I have done what was all required for me to do before posting my question here.

My httpd.conf looks like below:

NameVirtualHost *:443
Listen *:443
<VirtualHost server1.example.com:443>
ServerName server1
#ServerName server1.example.com
SSSLEngine on
</VirtualHost>

SSL applied on server1.example.com, however after everything when we go to the website it only works on ServerName server1, not on ServerName server1.example.com. We dont have server1 in any of the configuration and network file.

So when we do this https://server1.example.com/xyz/ --- it works with ServerName server1 but does not work with ServerName server1.example.com.

Where is the problem here; I am not getting it. /etc/hosts, /etc/sysconfig/network, nowhere we have server1; even in the DNS too.

Please suggest.

This is what we get in Error Log:

[Thu Nov 24 11:40:14 2016] [warn] RSA server certificate CommonName (CN) `server1.example.com' does NOT match server name!?
[Thu Nov 24 11:40:14 2016] [notice] Digest: generating secret for digest authentication ...
[Thu Nov 24 11:40:14 2016] [notice] Digest: done
[Thu Nov 24 11:40:14 2016] [notice] SSL FIPS mode disabled
[Thu Nov 24 11:40:14 2016] [warn] RSA server certificate CommonName (CN) `server1.example.com' does NOT match server name!?
[Thu Nov 24 11:40:14 2016] [notice] Apache/2.2.3 (Red Hat) configured -- resuming normal operations
[Thu Nov 24 11:49:47 2016] [notice] caught SIGTERM, shutting down
[Thu Nov 24 11:49:47 2016] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Nov 24 11:49:47 2016] [notice] SSL FIPS mode disabled
[Thu Nov 24 11:49:47 2016] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Nov 24 11:49:47 2016] [warn] RSA server certificate CommonName (CN) `server1' does NOT match server name!?
[Thu Nov 24 11:49:47 2016] [notice] Digest: generating secret for digest authentication ...
[Thu Nov 24 11:49:47 2016] [notice] Digest: done
[Thu Nov 24 11:49:47 2016] [notice] SSL FIPS mode disabled
[Thu Nov 24 11:49:47 2016] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Thu Nov 24 11:49:47 2016] [warn] RSA server certificate CommonName (CN) `server1' does NOT match server name!?
[Thu Nov 24 11:49:47 2016] [notice] Apache/2.2.3 (Red Hat) configured -- resuming normal operations
[Thu Nov 24 11:55:19 2016] [notice] caught SIGTERM, shutting down
[Thu Nov 24 11:55:20 2016] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Thu Nov 24 11:55:20 2016] [notice] SSL FIPS mode disabled
[Thu Nov 24 11:55:20 2016] [warn] RSA server certificate CommonName (CN) `server1.example.com' does NOT match server name!?
[Thu Nov 24 11:55:20 2016] [notice] Digest: generating secret for digest authentication ...
[Thu Nov 24 11:55:20 2016] [notice] Digest: done
[Thu Nov 24 11:55:20 2016] [notice] SSL FIPS mode disabled
[Thu Nov 24 11:55:20 2016] [warn] RSA server certificate CommonName (CN) `server1.example.com' does NOT match server name!?
[Thu Nov 24 11:55:20 2016] [notice] Apache/2.2.3 (Red Hat) configured -- resuming normal operations

3 Answers 3

5

Try

<VirtualHost *:443>
ServerName server1.example.com
ServerAlias server1
SSLEngine on
</VirtualHost>

You want the wildcard in the VirtualHost statement to turn off IP based vhost mapping. http://httpd.apache.org/docs/2.4/vhosts/name-based.html


Note the fixed line (SSLEngine instead of SSSLEngine).

7
  • 1
    Isn't it SSLEngine instead of SSSLEngine?
    – Yamakaja
    Nov 22, 2016 at 16:07
  • Nice catch @Yamakaja. How come never got an error while starting httpd services? Or I might have made a mistake while putting a question here. Nov 22, 2016 at 19:02
  • Not working as you mentioned. Nov 23, 2016 at 7:55
  • @GunnyKC: Please add log file entries and other useful info to your question (with the edit button).
    – Sven
    Nov 23, 2016 at 13:13
  • Done @Sven, added the error logs, its not working somehow. Nov 24, 2016 at 9:12
1
ServerName server1.example.com
ServerAlias server1
1
1

Try changing your configuration to this:

NameVirtualHost *:443
Listen *:443
<VirtualHost *:443>
ServerName server1.example.com
ServerAlias server1
SSSLEngine on
</VirtualHost>

I tend to avoid using hostnames in the VirtualHost directive. If DNS or any aspect of the hostname lookup process breaks, either on your server, or on DNS servers your server is pointing to/using, and Apache is unable to determine what server1.example.com resolves to at initial start up, it will not load the virtual host configuration.

Secondly, ServerName is the string presented in error pages (404 not found, 500 internal error etc) and the "primary name" for your website, so I tend to use the fully qualified hostname for ServerName. If I then need the site to be accessed by further names, I add these (one or more) using the ServerAlias directive (you can either have multiple lines of ServerAlias or give more than one name per ServerAlias line).

But since this is SSL, I highly suspect you will find there is a certificate mismatch occurring when accessing via just server1, though this should still work if you ignore browser security warnings.

5
  • Sure. Thanks. I will check it tomorrow and update you. Nov 22, 2016 at 15:49
  • Its not working this way. Nov 23, 2016 at 7:55
  • This one only works: Listen server1.example.com:443 <VirtualHost server1.example.com:443> ServerName server1 SSLEngine on </VirtualHost> Nov 23, 2016 at 7:57
  • If you replace server1.example.com with the IP address instead, it should still work, both on the Listen directive and the VirtualHost one. Then try using ServerName as server1.example.com
    – parkamark
    Nov 23, 2016 at 10:08
  • it works but page does not look good, and bar does not become green @parkamark. Nov 24, 2016 at 9:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.