Separate SSL certificate selection from virtual host configuration in apache

Question

Currently, my apache configuration includes one SSL certificate (with all domains listed as Alternative Subject Names). I furthermore have one virtual host configuration per domain that serves both SSL and non-SSL requests. All this happens on one public IP.

I’d like to switch to multiple SSL certificates, one per domain, using Subject Name Indication. I know it is possible if I duplicate all vhost configuration entries, once for port 80 and once for port 443 with SSL (as already discussed on SF).

But I would rather have something that resembles my current setup, with these features:

All SSL related configuration in one place. In the best case a statement telling apache „Use all SSL certificates in this directory, and for each HTTP request, pick the right one based on the SNI information“
Virtual host configuration non-duplicated and with no special mention of SSL at all.
Possibility to server many domain names with one virtual host configuration, while still having separate certificates for each.

Is that possible?

I guess a sledgehammer solution would be having apache server only on port 80, and on port 443 a reverse proxy that handles SSL (including certificate selection) and then proxies the request to port 80. I am hoping for more elegant ways :-) — Joachim Breitner, Jan 07 '13 at 21:54
Are all of your virtual hosts on the same IP, or does each domain have a separate IP address? — esquireofoz, Jan 07 '13 at 22:19
Also filed as a feature request at https://issues.apache.org/bugzilla/show_bug.cgi?id=54385 — Joachim Breitner, Jan 08 '13 at 09:57
And against mod_gnutls at https://sourceforge.net/apps/mantisbt/modgnutls/view.php?id=15 — Joachim Breitner, Jan 08 '13 at 10:10

score 3 · Answer 1 · answered Jan 08 '13 at 07:08

There's no getting around the structure of virtual hosts that Apache needs to support this configuration; the <VirtualHost> blocks need to exist and need to contain the config directives to set up the listeners.

The best you can do is something like this..

<VirtualHost *:80>
  # Give this file the directives like ServerName and DocumentRoot that
  # are the same between 80 and 443:
  Include /etc/confdir/domain-a.conf
</VirtualHost>
<VirtualHost *:443>
  # Same file as above, so config will be "shared"
  Include /etc/confdir/domain-a.conf
  # SSL directives for this domain (SSLEngine, cert config) in this file:
  Include /etc/confdir/ssl/domain-a-ssl.conf
</VirtualHost>

If only https://issues.apache.org/bugzilla/show_bug.cgi?id=47256 were fixed... — Joachim Breitner, Jan 08 '13 at 09:46

Separate SSL certificate selection from virtual host configuration in apache

1 Answers1