I want to host three HTTPS sites each with its own certificate and server name on the same IP. I have done it many times with HTTP and it seems that it should not be much different with HTTPS configuration. I have the latest CentOS7 + Apache. The server is behind a firewall, which performs NAT, but I think this should not be a problem. Each virtualhost configuration is in a separate file.
The problem I have is that whatever I do, I get the content of the first server, no matter which address I type in browser.
The first HTTPS server is an ordinary HTTPS and was there already before. Now I have added two like this one:
<VirtualHost *:443> ServerAdmin email@example.com ServerName www.domain1.com CustomLog logs/ssl_www.domain1.com-combined_log combined SSLEngine on SSLCertificateKeyFile conf/ssl.key/www.domain1.com.key SSLCertificateFile conf/ssl.crt/www.domain1.com.crt SSLProxyEngine on SSLProxyCheckPeerCN off SSLProxyCheckPeerExpire off SSLProxyCheckPeerName off ProxyRequests off ProxyPreserveHost on ProxyPass / https://10.10.10.10:443/ ProxyPassReverse / https://10.10.10.10:443/ </VirtualHost>
They are not yet in DNS so I added /etc/hosts entries for their public IP in my client and tried to see if they work. Apache reports on restart the following line:
[Wed Jan 10 08:40:56.048248 2018] [ssl:warn] [pid 20391] AH02292: Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
That means that Apache supports SNI. Logs of other virtualhosts are empty, while the first which handles all requests reports the correct hostname in the logs:
x.x.x.x - - [10/Jan/2018:08:49:37 +0000] "GET / HTTP/1.1" 200 3294 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36" x.x.x.x - - [10/Jan/2018:08:49:37 +0000] "GET /styles.css HTTP/1.1" 200 4335 "https://www.domain1.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
The hostname in the second line of log show that referrer (www.domain1.com) is actually the site that is not shown. So obviously the correct hostname is requested from browser. The certificate is in this case also wrong, because apache always uses just the first virtualhosts.
I also tried to setup an ordinary second HTTPS site (without reverse proxy) and the result was the same. I have no more ideas, what to try. I would not like to install additional software like HAProxy or sniproxy. I believe Apache should be able to handle it.
As requested I am adding the other virtualhosts here. First server:
<VirtualHost 10.163.3.1:443> ServerAdmin firstname.lastname@example.org DocumentRoot /home/domain0/ftp/www ScriptAlias /cgi-bin/ /home/domain0/cgi-bin/ ServerName www.domain0.com CustomLog logs/ssl_www.domain0.com-combined_log combined CookieTracking on AddType application/x-httpd-php .php DirectoryIndex index.php index.html index.htm SSLEngine on SSLCertificateKeyFile /etc/letsencrypt/live/www.domain0.com/privkey.pem SSLCertificateFile /etc/letsencrypt/live/www.domain0.com/cert.pem <Directory /home/domain0/ftp/www> AllowOverride None Require all granted Options None </Directory> <DirectoryMatch "\.svn"> Require all denied </DirectoryMatch> # Mercurial (Hg) version control system, using WSGI WSGIScriptAlias /hg "/srv/hg/cgi-bin/hgweb.wsgi" <Location /hg> AuthType Basic AuthName "mercurial" AuthUserFile /srv/hg/repos/.htpasswd Require valid-user </Location> </VirtualHost>
The second and the third are identical except for the addresses and names:
<VirtualHost *:443> ServerAdmin email@example.com ServerName www.domain3.com CustomLog logs/ssl_www.domain3.com-combined_log combined SSLEngine on SSLCertificateKeyFile conf/ssl.key/www.domain3.com.key SSLCertificateFile conf/ssl.crt/www.domani3.com.crt SSLProxyEngine on SSLProxyCheckPeerCN off SSLProxyCheckPeerExpire off SSLProxyCheckPeerName off ProxyRequests off ProxyPreserveHost on ProxyPass / https://220.127.116.11:443/ ProxyPassReverse / https://18.104.22.168:443/ </VirtualHost>
I changed the real names and IP addresses, because I do not want to publish the real ones.
apachectl -S displays nothing. I also tried
apachectl configtest and it says
Syntax OK. I would also like to mention that log files for the second and third virtualhost are empty.
I have each virtualhost in a separate file. That should not play any role?