How do I combine two SSL-enabled servers in one Apache instance?

Question

I have two different sites, foo.com and bar.com, each running on a different (virtual) machine. Each has an SSL-enabled Ruby-on-Rails site running as follows:

# foo.com:/etc/apache2/sites-availables/foo.com.conf:

<VirtualHost *:80>
    ServerName foo.com
    ServerAlias www.foo.com
    DocumentRoot /var/www/apps/foo.com/current/public
</VirtualHost>

<VirtualHost *:443>
    ServerName foo.com
    ServerAlias www.foo.com
    DocumentRoot /var/www/apps/foo.com/current/public

    SSLEngine On
    SSLCertificateKeyFile /etc/apache2/ssl/foo.com.key
    SSLCertificateFile /etc/apache2/ssl/WWW.FOO.COM.crt
    SSLCertificateChainFile /etc/apache2/ssl/Apache_Plesk_Install.txt
</VirtualHost>

(Replace "foo.com" with "bar.com" as appropriate.)

I am in the process of merging the two code-bases in order to ease ease between users of foo.com and bar.com. Eventually they will both reside on the same server (foo.com) and both domain names will point to the same IP. The single server will be perfectly capable of handling the traffic from both sites -- they only get on order of a few dozen unique users each day, with peak load in the hundreds or low thousands.

The following is my proposed checklist of things to do for the merge. My question is: what am I forgetting?

copy the private key, certificate, and certificate chain file from bar.com:/etc/apache2/ssl/* to foo.com:/etc/apache2/ssl/bar.com/*
copy the bar.com site configuration from bar.com:/etc/apache2/sites-available/bar.com.conf to foo.com:/etc/apache2/sites-available/bar.com/conf and edit the SSL configuration as per the previous point
(possibly change the foo.com SSL configuration to look more like the new bar.com ones)
restart Apache on foo.com
change the bar.com name listing to an alias to foo.com

Will that work? Will users get the right certificates or will they see certificate warnings?

score 4 · Accepted Answer · edited Apr 13 '17 at 12:14

4

both domain names will point to the same IP

If you want to avoid certificate warnings with 2 different sites sharing the same IP:port, you will need to use a SAN/UCC certificate that supports multiple/alternate names in one cert.

Take a look at this thread:

Apache SSL VirtualHosts on a single IP using UCC/SAN certificate

If ordering a SAN/UCC cert is not an option, you will need to use multiple IP addresses.

edited Apr 13 '17 at 12:14

Community

1

answered Mar 01 '10 at 19:15

micah

974
6
11

+1, Hit the nail on the head. – Chris S Mar 01 '10 at 19:30
or multiple ports on same IP – sumar Mar 01 '10 at 20:26
This is because the SSL part of the request is resolved before the virtual-host, right? Hmm, I might have to figure out how to get the host to point two public IPs at the same virtual machine. Thanks :) – James A. Rosen Mar 02 '10 at 13:23
James, correct. SSL certificates are exchanged before any HTTP headers are sent. – micah Mar 10 '10 at 14:55

How do I combine two SSL-enabled servers in one Apache instance?

1 Answers1