97

Yes, but there are some caveats. This is accomplished through Server Name Indication, an extension to Transport Layer Security. What is Server Name Indication? Server Name Indication (RFC 6066; obsoleted RFC 4366, RFC 3546) is an extension to Transport Layer Security which allows the client to tell the server the name of the host it is trying to reach. ...


70

Change your authorization configuration: <Directory /home/remix/> #... Order allow,deny Allow from all </Directory> ...to the Apache 2.4 version of the same. <Directory /home/remix/> #... Require all granted </Directory> Review the upgrading overview document for information on other changes you might need to ...


48

Solution is on Apache 2.2 documentation on the Virtualhost directive: Syntax: ... (...) Addr can be: The IP address of the virtual host; A fully qualified domain name for the IP address of the virtual host (not recommended); The character *, which is used only in combination with NameVirtualHost * to match all IP addresses; or The ...


44

Define a default_server that returns an HTTP 444 code: server { listen 80 default_server; server_name _; return 444; } (Returning a 4xx error code means requests can be interpreted by a client as an unsuccessful request, rather an HTTP 200 Blank Page But Totally Worked Trust Me.)


38

It happens that it could be a bug in the most recent version of Apache. Solution 1: downgrade to the latest stable Solution 2: edit listen.conf Replace Listen *:443 (or Listen 443 according to your setup) with Listen *:443 http Credit


37

The problem: When a web client and a web server talk to each other over HTTPS, the very first thing that needs to happen is the secure handshake. Here is a simplified example of such a handshake: If this were HTTP and not HTTPS, the first thing the client would have sent would have been something like this: GET /index.html HTTP/1.1 Host: example.com ...


30

There's probably no harm in having those other domains pointing to your host, except of course that it increases the load on your server. If you want to block them, set up new virtual hosts for them: NameVirtualHost *:80 <VirtualHost *:80> ServerName example.com # example.com configuration </VirtualHost> <VirtualHost *:80> ...


26

You cannot have it refuse connections, since the hostname (or IP) that the user is trying to use as their HTTP host is not known to the server until the client actually sends an HTTP request. The TCP listener is always bound to the IP address. Would an HTTP error response be acceptable instead? <VirtualHost *:80> ServerName catchall <...


25

Remove the Alias declaration Alias /phpmyadmin /usr/share/phpmyadmin from the server context and put it in the relevant vhost context <VirtualHost *:80> ServerName onlyphpmyadmin.domain.com . . . Alias /phpmyadmin /usr/share/phpmyadmin </VirtualHost> It may be easier and preferable to just include the whole phpmyadmin ...


25

Look at your access log (not the error log). With the time and date of the error you should be able to identify the offending request and find out the user agent. In my case, it was a bot: "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.2)" My Server answers with HTTP 400: Bad Request. Unless I am mistaken, in TLS negotiations, the ...


24

To me, the terms mean different things. A floating IP address is used to support failover in a high-availability cluster. The cluster is configured such that only the active member of the cluster "owns" or responds to that IP address at any given time. Should the active member fail, then "ownership" of the floating IP address would be transferred to a ...


24

Two https can be served in one IP. You just need to verify that the virtual host configuration works. Are you sure that your virtualhost works? You can use this config in site-available. <VirtualHost *:80> ServerName www.example.com ServerAlias example.com DocumentRoot /var/www/example.com/public_html ErrorLog /var/www/example.com/...


23

The command a2query -s works perfectly for me.


23

The other solutions did not helped me. My solution is to include a negative regex for .well-known. Your code block should look like this then: ## Disable .htaccess and other hidden files location ~ /\.(?!well-known).* { deny all; access_log off; log_not_found off; } It will block every dot file except the ones starting with .well-known P.S.: ...


22

Host names do not correspond to an {ipaddress,port} tuple. A host name is only the name of a server, which should be resolvable to one or more IP addresses. Ports have nothing to do with host names at all.


21

Nginx applies locations with regular expressions in the order of their appearance in the configuration file. Therefore, adding an entry like this just before your current location it will help you. location ~ /\.well-known { allow all; }


20

Here is an alternate way that does not involve rewrite rules: <VirtualHost _default_:*> <Location /> Deny from all Options None ErrorDocument 403 Forbidden. </Location> </VirtualHost>


19

There's another serverfault question regarding this. If you're using a debian based server you can use apache2ctl to determine which config file is being used: apache2ctl -V More on this: How to find out which httpd.conf apache is using at runtime


18

This may be obvious, but don't forget to restart the apache service after enabling additional virtual host. After executing a2ensite for the second virtual host, the output of apache2ctl -S reflects that both sites are configured (and one of them is the default), but it won't be live until you reload apache. Let's say you have two virtual hosts - site1 and ...


18

I have found the solution! All files in /etc/apache2/sites-available/ must have the .conf extension now. Example: symfony2-tries rename it in symfony2-tries.conf Type sudo a2ensite symfony2-tries.conf and restart apache.


18

You need to split vhosts from ssl listening/configuration part: Listening part: server { listen 127.0.0.1:443 default_server ssl; server_name _; ssl_certificate /etc/ssl/wildcard.cer; ssl_certificate_key /etc/ssl/wildcard.key; } And now vhosts: server { listen 127.0.0.1:443; server_name a.example.com; root ...


17

No it isn't possible. The mod_wsgi binary has to be compiled against one Python version only and only one instance of a compiled mod_wsgi module can be loaded into Apache at a time. What you would need to do is setup Apache to proxy to a separate WSGI server listening on its own ports. To use Apache/mod_wsgi as that backend server as well, you would want ...


16

DocumentRoot "/Library/WebServer/Documents/dev3” ^----- no proper quotation mark :9 If you have php installed: <?php echo "\xe2\x80\x9d"; // or echo utf8_decode("\xe2\x80\x9d"); // should give you ”


16

You can set the SSLProtocol only for the first VirtualHost in the configuration file. All subsequent VirtualHost entries will inherit that setting from the first entry and silently ignore their own setting due to an OpenSSL bug. There is a corresponding bug report for mod_ssl, but as described in the bug report, the problem needs to be resolved in OpenSSL (...


15

I had a similar problem where my additional vhosts on port 443 (SSL/HTTPS) were all being directed to the directory of the first vhost listed. Apache was essentially ignoring the servername property and matching on the ip:port only. Turns out that I was missing the command 'NameVirtualHost *:443' to enable Named virtual hosting for port 443. '...


15

The answer by cjc already correctly pointed out the problem with trying to match host names when SSL is enabled. However, it is possible to do it, like this: server { ... if ($host !~* ^validname\.domain\.com$ ) { return 444; } ... } Note: yes it is true that generally if is evil, but it is safe to use if in this case. (Read the ...


15

Many examples work on specific configurations. This one always works, no matter which configuration your Apache server uses: RewriteEngine On RewriteCond %{SERVER_PORT} !443 RewriteRule ^(/(.*))?$ https://%{HTTP_HOST}/$1 [R=301,L]


15

Your configuration is following nginx configuration pitfalls You should read it before configuring nginx. To answer your question, you should not define root in location, define it once and the location tag will automatically let you assign access to specific directories. Also instead of defining custom root for images directory, use try_files. The $uri ...


14

When proxying http or https to https you need to configure apache as an ssl client. When apache talks to your Tomcat server it functions as a web client after all. However Apache will usually not function as an SSL client out of the box. Firstly I would suggest that you first consider if you really need this, why you are doing this. The common practice ...


14

Encrypted Server Name Indication (ESNI) is still an Internet Draft, you will not find it in any major server implementation as it is subject to change. In fact, the draft version implemented by Firefox supports draft-ietf-tls-esni-01 which is incompatible with newer draft versions. I posted a status of the ecosystem as observed in April 2019 here: ...


Only top voted, non community-wiki answers of a minimum length are eligible