reg at seowebsales
May 11, 2012, 1:10 PM
Post #1 of 1
(170 views)
Permalink
|
|
Problem with Multiple VirtualHosts with SSL using Named Virtual Hosts (SNI)
|
|
I've setup Apache to handle named Virtual Hosts with SSL however there is something I am missing because it doesn't work. This is my first time trying multiple SSL hosting however I have had one SSL domain working for years on this server.
The certificates check out because if I comment out the section for domain1.com then domain2.com works perfectly in the browser, i.e.: no warning message and straight into https://www.domain2.com seamlessly. Of course domain1.com gives the "untrusted certificate" warning since it's the wrong certificate the browser is getting.
When I uncomment the lines for domain1.com then domain1.com will work seamlessly as domain2.com did but now domain2.com will give the "untrusted certificate" warning in the browser so Apache is defaulting the first certificate it finds to serve up the browser.
I can't find anymore to do to make this work so I'm hoping someone who has made this work could look at my Apache configuration and tell me what I am doing wrong.
I also checked the Apache log and I get this message:
[warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
which from what I read means that Apache is properly setup for Named-based Virtual domains with SSL.
The software is:
openSUSE 11.4
Apache 2.2.17
openSSL 1.0.0c
FireFox 12.0 Linux & Windows, IE7 Vista
I've checked all of the above software versions and as far as I can see it is all new enough to work with SNI.
Any help really appreciated!
Reg
Relevant Apache configuration:
Listen 443
NameVirtualHost *:443
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!aNULL:!eNULL:!SSLv2:!LOW:!EXP:!MD5:@STRENGTH
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache shmcb:/var/lib/apache2/ssl_scache(512000)
SSLSessionCacheTimeout 600
SSLMutex default
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
<Directory "/srv/www/vhosts/live/m/multi-001/www">
Options none
AllowOverride all
Order allow,deny
Allow from all
</Directory>
# Old stuff we'll probably never use
<Files ~ "\.(cgi|shtml|phtml|php3?)$">
SSLOptions +StdEnvVars
</Files>
<Directory "/srv/www/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
#
# www.domain1.com
#
# Live: live/www.domain1.com
<VirtualHost *:443>
DocumentRoot "/srv/www/vhosts/live/m/multi-7/www/"
ServerName domain1.com:443
ServerAlias www.domain1.com:443
ServerAdmin webmaster [at] domain1
<Directory "/srv/www/vhosts/live/m/multi-7/www">
Options none
AllowOverride all
Order allow,deny
Allow from all
</Directory>
SSLEngine on
SSLCertificateFile /etc/ssl/private/crt/domain1.com.crt
SSLCertificateKeyFile /etc/ssl/private/key/domain1.com.key
SSLCertificateChainFile /etc/ssl/private/bundle/domain1.com.crt.bundle
CustomLog '/var/log/apache2/d/domain1.com_reqst' ssl_combined
ErrorLog '/var/log/apache2/d/domain1.com_error'
RewriteLog '/var/log/apache2/d/domain1.com_rewri'
</VirtualHost>
#
# www.domain2.com
#
# Live: live/www.domain2.com
<VirtualHost *:443>
DocumentRoot "/srv/www/vhosts/live/m/multi-7/www/"
ServerName domain2.com:443
ServerAlias www.domain2.com:443
ServerAdmin webmaster [at] domain2
<Directory "/srv/www/vhosts/live/m/multi-7/www">
Options none
AllowOverride All
Order allow,deny
Allow from all
</Directory>
SSLEngine on
SSLCertificateFile /etc/ssl/private/crt/domain2.com.crt
SSLCertificateKeyFile /etc/ssl/private/key/domain2.com.key
SSLCertificateChainFile /etc/ssl/private/bundle/domain2.com.crt.bundle
CustomLog '/var/log/apache2/d/domain2.com_acces' ssl_combined
ErrorLog '/var/log/apache2/d/domain2.com_error'
RewriteLog '/var/log/apache2/d/domain2.com_rewri'
</VirtualHost>
|
