0

I want to host three HTTPS sites each with its own certificate and server name on the same IP. I have done it many times with HTTP and it seems that it should not be much different with HTTPS configuration. I have the latest CentOS7 + Apache. The server is behind a firewall, which performs NAT, but I think this should not be a problem. Each virtualhost configuration is in a separate file.

The problem I have is that whatever I do, I get the content of the first server, no matter which address I type in browser.

The first HTTPS server is an ordinary HTTPS and was there already before. Now I have added two like this one:

<VirtualHost *:443>
    ServerAdmin email@domain1.com
    ServerName www.domain1.com

    CustomLog logs/ssl_www.domain1.com-combined_log combined

    SSLEngine on
    SSLCertificateKeyFile conf/ssl.key/www.domain1.com.key
    SSLCertificateFile conf/ssl.crt/www.domain1.com.crt

    SSLProxyEngine on
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerExpire off
    SSLProxyCheckPeerName off

    ProxyRequests off
    ProxyPreserveHost on
    ProxyPass / https://10.10.10.10:443/
    ProxyPassReverse / https://10.10.10.10:443/
</VirtualHost>

They are not yet in DNS so I added /etc/hosts entries for their public IP in my client and tried to see if they work. Apache reports on restart the following line:

[Wed Jan 10 08:40:56.048248 2018] [ssl:warn] [pid 20391] AH02292: Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)

That means that Apache supports SNI. Logs of other virtualhosts are empty, while the first which handles all requests reports the correct hostname in the logs:

x.x.x.x - - [10/Jan/2018:08:49:37 +0000] "GET / HTTP/1.1" 200 3294 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
x.x.x.x - - [10/Jan/2018:08:49:37 +0000] "GET /styles.css HTTP/1.1" 200 4335 "https://www.domain1.com/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"

The hostname in the second line of log show that referrer (www.domain1.com) is actually the site that is not shown. So obviously the correct hostname is requested from browser. The certificate is in this case also wrong, because apache always uses just the first virtualhosts.

I also tried to setup an ordinary second HTTPS site (without reverse proxy) and the result was the same. I have no more ideas, what to try. I would not like to install additional software like HAProxy or sniproxy. I believe Apache should be able to handle it.

As requested I am adding the other virtualhosts here. First server:

<VirtualHost 10.163.3.1:443>
    ServerAdmin email@domain0.com
    DocumentRoot /home/domain0/ftp/www
    ScriptAlias  /cgi-bin/ /home/domain0/cgi-bin/

    ServerName www.domain0.com
    CustomLog logs/ssl_www.domain0.com-combined_log combined

    CookieTracking on
    AddType application/x-httpd-php .php
    DirectoryIndex index.php index.html index.htm

    SSLEngine on
    SSLCertificateKeyFile /etc/letsencrypt/live/www.domain0.com/privkey.pem
    SSLCertificateFile /etc/letsencrypt/live/www.domain0.com/cert.pem

    <Directory /home/domain0/ftp/www>
      AllowOverride None
      Require all granted
      Options None
    </Directory>

    <DirectoryMatch "\.svn">
      Require all denied
    </DirectoryMatch>

    # Mercurial (Hg) version control system, using WSGI
    WSGIScriptAlias /hg "/srv/hg/cgi-bin/hgweb.wsgi"
    <Location /hg>
        AuthType Basic
        AuthName "mercurial"
        AuthUserFile  /srv/hg/repos/.htpasswd
        Require valid-user
    </Location>
</VirtualHost>

The second and the third are identical except for the addresses and names:

<VirtualHost *:443>
    ServerAdmin email@domain3.com
    ServerName www.domain3.com

    CustomLog logs/ssl_www.domain3.com-combined_log combined

    SSLEngine on
    SSLCertificateKeyFile conf/ssl.key/www.domain3.com.key
    SSLCertificateFile conf/ssl.crt/www.domani3.com.crt

    SSLProxyEngine on
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerExpire off
    SSLProxyCheckPeerName off

    ProxyRequests off
    ProxyPreserveHost on
    ProxyPass / https://11.11.11.11:443/
    ProxyPassReverse / https://11.11.11.11:443/
</VirtualHost>

I changed the real names and IP addresses, because I do not want to publish the real ones. apachectl -S displays nothing. I also tried apachectl configtest and it says Syntax OK. I would also like to mention that log files for the second and third virtualhost are empty.

I have each virtualhost in a separate file. That should not play any role?

  • Apache can handle that. Is only the wrong certificate shown, or the wrong site contents, too? The config for the other 2 vhosts is identical to the first except for cert and ServerName? The CN of the certs is correct for each domain, I presume? NameVirtualHost *:443 is active somewhere in your config? – Lenniey Jan 10 '18 at 10:24
  • The wrong site contents are shown (always the first site). Therefore also certificates are wrong for other two. Two vhosts are identical (except servername, certificate, etc.), the first one does not do ReverseProxy to other server, but is an actual site on that server. Yes, CNs are correct. I had NameVirtualHost *:443, but apache reported a warning, that this is not needed any more, as it works like that as default. So I removed it and there was no change in behaviour. – nobody Jan 10 '18 at 11:00
  • @Lenniey NameVirtualhost is not necessary in 2.4. – ezra-s Jan 10 '18 at 17:17
  • @nobody do show the other virtualhosts and the output of running the "apachectl -S" command – ezra-s Jan 10 '18 at 17:17
  • It seems that it started to work. There are two important changes from yesterday. One is that all domains are now in DNS. Before they were in /etc/hosts, so this should not affect anything. Another change I made was to change <VirtualHost 10.163.3.1:443> in the first host to <VirtualHost *:443>. I overlooked that. When I was adding conf to the question I noticed it. – nobody Jan 11 '18 at 7:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.