apache always serves first named vhost regardless of SNI setting

Question

Apache is always serving the first named vhost regardless of SNI setting. I'm unsure what is causing this. I no longer get the message

Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)

but I was as of 2pm today. The only thing I remember changing is adding the last virtual host declaration in:

LoadModule ssl_module modules/mod_ssl.so
#LoadModule ssl_module /usr/lib64/libgnutls.so

NameVirtualHost 10.10.150.166:443
<IfModule mod_ssl.c>
     #If you add NameVirtualHost *:443 here, you will also have to change
     #the VirtualHost statement in /etc/apache2/sites-available/default-ssl
     #to 
     #Server Name Indication for SSL named virtual hosts is currently not
     #supported by MSIE on Windows XP.
    Listen 443
</IfModule>






SSLPassPhraseDialog  builtin
SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin


<VirtualHost mail.napalpha.net:443>
SSLStrictSNIVHostCheck on
ServerName mail.napalpha.net
ServerAlias mail.napalpha.net
DocumentRoot /var/www/roundcubemail
# Use separate log files for the SSL virtual host; note that LogLevel
# is not inherited from httpd.conf.
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn

SSLEngine   on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW



SSLCertificateFile /etc/pki/CA/certs/mail_napalpha_net.crt
SSLCertificateKeyFile /etc/pki/CA/private/mail.napalpha.net.key
SSLCertificateChainFile /etc/pki/CA/IntermediateCAs/GeoTrust_Intermediate.crt
SSLCACertificateFile /etc/pki/CA/CABundle/GeoTrust_CA_Bundle.crt

<Files ~ "\.(cgi|shtml|phtml|php3?)$">
    SSLOptions +StdEnvVars
</Files>
<Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
</Directory>

SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0



CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

Alias /cluebringer "/usr/share/cluebringer/webui/"
Alias /iredadmin/static "/var/www/iredadmin/static/"
WSGIScriptAlias /iredadmin "/var/www/iredadmin/iredadmin.py/"
Alias /awstats/icon "/usr/share/awstats/wwwroot/icon/"
Alias /awstatsicon "/usr/share/awstats/wwwroot/icon/"
ScriptAlias /awstats "/usr/share/awstats/wwwroot/cgi-bin/"
Alias /mail "/var/www/roundcubemail/"
Alias /phppgadmin "/var/www/phppgadmin/"
Alias /groupoffice "/var/www/groupoffice/"
</VirtualHost> 

<VirtualHost www.procyon-alpha.com:443>
        ServerName www.procyon-alpha.com
        ServerAlias www.procyon-alpha.com
        DocumentRoot /var/www/ProcyonAlpha
#       SSLEngine On
        SSLStrictSNIVHostCheck on  
        ErrorLog logs/ssl_error_log
        TransferLog logs/ssl_access_log
        LogLevel warn
        SSLCertificateFile /etc/pki/CA/certs/SSL_www_procyon-alpha_com.crt
        SSLCertificateKeyFile /etc/pki/CA/private/procyon-alpha.key
        SSLCertificateChainFile /etc/pki/CA/IntermediateCAs/GeoTrust_Intermediate.crt
        SSLCACertificateFile /etc/pki/CA/CABundle/GeoTrust_CA_Bundle.crt
        CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"


</VirtualHost>

<VirtualHost owncloud.procyon-alpha.com:443>
        ServerName owncloud.procyon-alpha.com
        ServerAlias owncloud.procyon-alpha.com
        DocumentRoot /var/www/owncloud
        SSLStrictSNIVHostCheck on
#        SSLEngine On
<Directory /var/www/owncloud/install>
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Order allow,deny
    allow from all
</Directory>
        ErrorLog logs/ssl_error_log
        TransferLog logs/ssl_access_log
        LogLevel warn
        SSLCertificateFile /etc/pki/CA/certs/SSL_owncloud_procyon-alpha_com.crt
        SSLCertificateKeyFile /etc/pki/CA/private/owncloud.procyon-alpha.com.key
        SSLCertificateChainFile /etc/pki/CA/IntermediateCAs/GeoTrust_Intermediate.crt
        SSLCACertificateFile /etc/pki/CA/CABundle/GeoTrust_CA_Bundle.crt

        CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

</VirtualHost>

httpd -S outputs:

VirtualHost configuration:
10.10.150.166:443      is a NameVirtualHost
         default server mail.napalpha.net (/etc/httpd/conf.d/sslcombined.conf:30)
         port 443 namevhost mail.napalpha.net (/etc/httpd/conf.d/sslcombined.conf:30)
                 alias mail.napalpha.net
         port 443 namevhost www.procyon-alpha.com (/etc/httpd/conf.d/sslcombined.conf:79)
                 alias www.procyon-alpha.com
         port 443 namevhost owncloud.procyon-alpha.com (/etc/httpd/conf.d/sslcombined.conf:98)
                 alias owncloud.procyon-alpha.com
Syntax OK

If you disregard the cert warning the correct content is served. I'm at a loss here.

You seem to have commented out the `SSLEngine On` directive for all but the first virtual host. — Vivek Thomas, Sep 15 '14 at 05:26

Vivek Thomas · Answer 1 · 2014-09-15T14:31:35.187

1

I am assuming 10.10.150.166 is the IP address of the server on which Apache is running and where the requests would be routed to. (Is the server behind some kind of firewall and you have NAT in place? Just asking cause its a non-public IP address) If not, you need to update the NameVirtualHost directive to point to the right IP address.

You also need to ensure all three hostnames i.e. mail.napalpha.net, www.procyon-alpha.com, owncloud.procyon-alpha.com resolve to the IP address as given in the NameVirtualHost directive on the server. If this is different from the publicly visible IP address, you can have an appropriate entry in the /etc/hosts file.

Another approach would be to have each VirtualHost definition to have the IP address and port like below. (Having a hostname in the VirtualHost definition is not recommended)

<VirtualHost <IP address>:443>
....
....
</VirtualHost>

The SSLEngine On directive needs to be uncommented for the last two virtual hosts as well.

edited Sep 15 '14 at 14:31

answered Sep 15 '14 at 14:25

Vivek Thomas

729
4
8

If I uncomment SSLEngine On for www.procyon-alpha.com I get suEXEC mechanism enabled (wrapper: /usr/sbin/suexec) and apache will not start. – OverworkedTechydude Sep 15 '14 at 16:50
That would just be a NOTICE, not an ERROR preventing Apache from starting. It would appear there is something else wrong with the SSL configuration as Apache fails to start only when you enable SSLEngine, perhaps the certificate and key file may not have the right permissions and Apache is not able to read the files? – Vivek Thomas Sep 15 '14 at 17:07
It was a cert error. There was a key mismatch which prevented SSLEngine On from working and that in turn caused Apache to present the default cert. Now the correct certs are served but when I go to procyon-alpha.com or owncloud.procyon-alpha.com I get sent to /mail and the mail.napalpha.net content is served. I delete /mail and everything is kosher. – OverworkedTechydude Sep 15 '14 at 21:50

apache always serves first named vhost regardless of SNI setting

1 Answers1