0

I have 3 sites defined in apache, site1, site2, site3 For 1 and 2 I requested ssl certs from Let's encrypt and work OK, but NOT for site 3. Problem is that whenever I access https://site3 I always get a certificate from one of the other sites, I think from the first one defined.

Is this how apache should work or my config is wrong ? Not sure what I should see when I have no cert defined, maybe some "no cert" error ?!

/etc/httpd/conf/httpd.conf

# http site 1
<VirtualHost site1.com:80>
        DocumentRoot /var/www/html/site1.com
        ServerName site1.com
        <Directory "/var/www/html/site1.com">
                Require all granted
                DirectoryIndex index.html index.php
        </Directory>
</VirtualHost>


# http site 2
<VirtualHost site2.com:80>
        DocumentRoot /var/www/html/site2.com
        ServerName site2.com
        <Directory "/var/www/html/site2.com">
                Require all granted
                DirectoryIndex index.html index.php
        </Directory>
</VirtualHost>

# http site 3 (only one WITHOUT ANY SSL)
<VirtualHost site3.com:80>
        DocumentRoot /var/www/html/site3.com
        ServerName site3.com
        <Directory "/var/www/html/site3.com">
                Require all granted
                DirectoryIndex index.html index.php
        </Directory>
</VirtualHost>

Include /etc/httpd/conf/httpd-le-ssl.conf >>>>>>>

/etc/httpd/conf/httpd-le-ssl.conf

# SSL site 1
<IfModule mod_ssl.c>
<VirtualHost site1.com:443>
        DocumentRoot /var/www/html/site1.com
        ServerName site1.com
        <Directory "/var/www/html/site1.com">
                Require all granted
                DirectoryIndex index.html index.php
        </Directory>

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/www.site1.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.site1.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/www.site1.com/chain.pem
</VirtualHost>
</IfModule>

# SSL site 2
<IfModule mod_ssl.c>
<VirtualHost site2.com:443>
        DocumentRoot /var/www/html/site2.com
        ServerName site2.com
        <Directory "/var/www/html/site2.com">
                Require all granted
                DirectoryIndex index.html index.php
        </Directory>

Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/www.site2.com/cert.pem
SSLCertificateKeyFile /etc/letsencrypt/live/www.site2.com/privkey.pem
SSLCertificateChainFile /etc/letsencrypt/live/www.site2.com/chain.pem
</VirtualHost>
</IfModule>
0

1 Answer 1

2

Yes, it is correct. Your browser opens a connection with a server and asks for a TLS negotiation. Via SNI, gives a hints on what is the wanted site. Apache doesn't have a configured certificated for that, and "randomly" chooses (actually, pick the first configured) a certificate for the connection.

Only after the connection is established the browser can ask for a site.

Note that the browser should inform the user that the certificate is invalid for the site.

This hackish way is actually an hack: when SSL was born, you had to dedicate a single IP for every SSL site. SNI was introduced to allow more SSL (TLS, actually) sites to share a single IP. You can force apache to refuse connection from a non SNI client, but you can't force it to refuse connection for a different site.

The best startegy in these cases is to create a "fallback" certificate for the hosting server, with a fallback site, and configure it as the first one (000-default if you use debian). In this way visitors asking for a non-existant tls site will see a warning sign and not a different site.

Not the answer you're looking for? Browse other questions tagged .