I have a personal server and I use many sub-domains on it.
Each sub domain has its own unique SSL cert setup with LetsEncrypt.
Each sub domain has its own vhost file under /etc/apache/sites-available/
Each sub domain has its own A record and NS record that point to my server.

For some reason, if I disable one of my subdomains (e.g. sub1.domain.com) using the a2dissite command, and then try to go to that site in a web browser, I get an error saying:

sub1.domain.com uses an invalid security certificate.
The certificate is only valid for sub2.domain.com

I have verified that the VHOST files do use their appropriate SSL files. And the VHOST files also have the appropriate server name, including the sub domain part.

If I add an exception to the above error, as is an option, I am presented with another one of my subdomains but the URL stays the same as the one that's disabled.

Why does my server point me to a completely different sub-domain when I disable the site? I would think that it would just say it can't be reached, but instead it redirects me to another one of my sub-domains and I'm not sure how to control that.


First configured vhost has the highest priority and can be seen as the default or primary server. That means that if a request is received that does not match one of the specified ServerName directives, it will be served by this first .


In your case sub1.domain.com points to your web server, but web server has no vhost configured that would match the domain. Instead content and SSL cert for default domain are served.

  • Thank you, I was thinking it was probably a "feature". Is there a configuration to disable this and just have it show unavailable instead of serving the next in line?
    – Frantumn
    Jan 20 '18 at 18:34
  • @Frantumn Someone else has asked that question here before. You may be interested to read it. Jan 20 '18 at 18:45
  • I would suggest the HTTP 403 approach over default Apache page: serverfault.com/questions/114931/… Jan 20 '18 at 19:52
  • So, do I make a new vhost file, put this in it <VirtualHost _default_:*> <Location /> Deny from all Options None ErrorDocument 403 Forbidden. </Location> </VirtualHost> and then enable it?
    – Frantumn
    Jan 20 '18 at 19:55
  • 1
    Oh, in that case redirect them to google :) <VirtualHost *:80> ServerName analytics.mydomain.com Redirect / https://google.com </VirtualHost> Jan 21 '18 at 20:02

Name-based virtual hosts for the best-matching set of <virtualhost>s are processed in the order they appear in the configuration. The first matching ServerName or ServerAlias is used, with no different precedence for wildcards (nor for ServerName vs. ServerAlias).

source: Apache HTTP Server Version 2.4 - Using Name-based Virtual Hosts

Afaik it is not possible to change this sorting process without recompiling.

To change the order of your virtual hosts you could rename the *.conf-files in /etc/apache/sites-available/ like this:


For Debian (Ubuntu should have similar syntax) I recommend to change from lets say old-site-three.conf to 300-site-three.conf in this order:

$ sudo a2dissite old-site-three.conf

$ sudo mv /etc/apache/sites-available/old-site-three.conf /etc/apache/sites-available/300-site-three.conf

$ sudo a2ensite 300-site-three.conf

$ sudo apache2ctl configtest

$ sudo systemctl restart apache2.service
  • Thanks. Other than having things in order of conf file names, is there a ways to disable this feature?
    – Frantumn
    Jan 20 '18 at 19:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.