How to lets-encrypt several virtual servers on apache

Question

I host several instances of the same ruby on rails application via passenger on an Apache server. In the past these applications have been made available via separate Domains. But now I received a domain and several sub-branches from our IT department and I have to serve the applications in the following way:

domain.example.de/app_one
domain.example.de/app_two
....

While this works nicely without lets-encrypt (just have to configure apache and the ruby on rails applicatons that way). I want to have the pages delivered via https (lets-encrypt) as before. I configured Apache that way:

<VirtualHost *:80>
    ServerName http://domain.example.de/app_one

    # Tell Apache and Passenger where your app's 'public' directory is
    DocumentRoot /var/www/app_one/public

    PassengerRuby /usr/local/rvm/gems/ruby-2.3.8/wrappers/ruby

    # Relax Apache security settings
    <Directory /var/www/app_one/public>
      Allow from all
      Options -MultiViews
      # Uncomment this if you're on Apache >= 2.4:
      Require all granted
    </Directory>
RewriteEngine on
RewriteCond %{SERVER_NAME} =domain.example.de/app_one
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

But when calling

sudo certbot --apache

It does not list out that new "ServerNames" to issue certificates for. If I call certbot with the "-d" flag and provide the "ServerName" manually then I get an error that the domain name contains invalid characters.

Is it possible to issue a certificate for each application in that way? Or do I have to issue one for the domain and use it for every app under that domain then?

score 1 · Accepted Answer · answered May 20 '20 at 07:56

http://domain.example.de/app_one is not a valid domain name. The domain portion of that is domain.example.de. This is what you should use in the ServerName directive, and in certbot. Everything else is configured elsewhere.

/app_one can be configured in a <Location> block or as a reverse proxy, http:// is already implied by the :80 part in your <VirtualHost>

Regarding certbot, the --apache parameter only tells it to use Apache to handle the verification. You still need to provide the domain with the -d parameter.

How to lets-encrypt several virtual servers on apache

1 Answers1