Wrong application loads on port 443

Question

I have a server with two web application that configured as follow:

app1:

www.domain1.com
has https version

app2:

www.domain1.com
has not https version

This is my VirtualHost config for domain1:

Listen 443
NameVirtualHost *:443
SSLStrictSNIVHostCheck off

<VirtualHost --ip--:80>
    ServerName www.domain1.com
    DocumentRoot /usr/local/ROOT
    <Directory /usr/local/ROOT>
        Options FollowSymLinks 
        AllowOverride All
        Order allow,deny
        Allow from All
    </Directory>
    errorlog /var/log/httpd/domain1.error.log
    CustomLog /var/log/httpd/domain1.access.log common 
    JkMount /* ajpmc
</VirtualHost>

<VirtualHost --ip--:443>
    ServerName www.domain1.com:443
    DocumentRoot /usr/local/ROOT
    <Directory /usr/local/ROOT>
        Options FollowSymLinks 
        AllowOverride All
        Order allow,deny
        Allow from All
    </Directory>
    errorlog /var/log/httpd/domain1.error.log
    CustomLog /var/log/httpd/domain1.access.log common 

    SSLEngine on
    SSLCertificateFile "/usr/local/security/paadbox.cert"
    SSLCertificateKeyFile "/usr/local/security/paadbox.pem"

    JkMount /* ajpmc
</VirtualHost>

Edit: And this is configuration for domain2:

<VirtualHost --ip--:80>
    ServerName www.domain2.com
    DocumentRoot /var/www/html/domain2
    <Directory /var/www/html/domain2>
        Options FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from All
    </Directory>
    errorlog /var/log/httpd/domain2.error.log
    CustomLog /var/log/httpd/domain2.access.log common
</VirtualHost>

Note that I have just 1 ip.

These urls works fine in browser:

http://www.domain1.com
http://www.domain2.com
https://www.domain1.com

And when I try to load this URL (app2):

https://www.domain2.com

the first app (app1) loads in my browser. What is the problem???

What do you *expect* to happen when you load `https://www.domain2.com/`? You only have one vhost on port 443 so that's the vhost users are going to get, no matter what domain they have in their URL. If you expect something different, you should add your expectation to your question. — Ladadadada, Jan 26 '14 at 17:06

score 0 · Accepted Answer · answered Jan 26 '14 at 13:55

Historically, you can only have one SSL virtual host per ip address. SNI -- server name indication -- was designed to work around this issue.

While in theory most browsers now support SNI, there are several requirements that must be met for that to work. You can read more about Apache and SNI here.

In the absence of SNI, virtual host selection happens before Apache knows the virtual host name being requested by the client. This means that there can only be a single SSL virtual host for a given ip address.

You can do name based virtual hosting without SNI if all your virtual hosts share a common domain, because then you can use a wildcard SSL certificate that will be valid for all of them. However, this sounds like it wouldn't apply in your case.

Thank you so much. So I have to have at least 2 ip to solve this problem without headache. — S.Yavari, Jan 26 '14 at 14:11

Marki · Answer 2 · 2014-01-26T13:58:04.460

-2

In general, you cannot do name-based virtual hosting using SSL just like that.

Each SSL VirtualHost needs one IP.

http://wiki.apache.org/httpd/NameBasedSSLVHosts

edited Jan 26 '14 at 13:58

answered Jan 26 '14 at 13:50

Marki

2,854
3
28
45

1

This is incorrect; you can do name-based hosting using SSL, provided that you meet the necessary requirements. – larsks Jan 26 '14 at 13:52
So, enlighten us, sir ;-) – Marki Jan 26 '14 at 13:55

Wrong application loads on port 443

2 Answers2