1

I have a Web server Apache on FreeBSD and want to bind SSL only to one of many domains. Now my configuration is

NameVirtualHost *:80

<VirtualHost *:80>
DocumentRoot /home/web/web/domain01.com
ServerName domain01.com
ServerAlias www.domain01.com
</VirtualHost>

<VirtualHost *:80>
DocumentRoot /home/web/web/ssldomain.com
ServerName ssldomain.com
ServerAlias www.ssldomain.com
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/home/web/web/ssldomain.com"
ServerName www.ssldomain.com 
ServerAlias ssldomain.com
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "/usr/local/etc/apache22/ssl/www.ssldomain.com.crt"
SSLCertificateKeyFile "/usr/local/etc/apache22/ssl/private.key"
SSLCertificateChainFile "/usr/local/etc/apache22/ssl/intermediate.crt"
</VirtualHost>

All ok, but in browser on https://www.domain01.com/ shows pages of ssldomain.com site. It is bad.

How can I tune Apache to prevent showing pages of ssldomain.com on https://www.domain01.com in browser.

UPD: I was trying to define VirtualHosts :80 and :443 for both domains. 1) using original SSL of ssldomain.com for both domains; 2) using original SSL for ssldomain.com and self-signed SSL for domain01.com. In both case browser shows error of certificate on HTTPS but pages are right.

Config for this two cases

Include etc/apache22/extra/httpd-ssl.conf

NameVirtualHost *:80
NameVirtualHost *:443

<VirtualHost *:80>
DocumentRoot /home/web/web/domain01.com
ServerName domain01.com
ServerAlias www.domain01.com
</VirtualHost>

<VirtualHost *:443>
DocumentRoot /home/web/web/domain01.com
ServerName domain01.com
ServerAlias www.domain01.com
SSLEngine on
SSLCertificateFile "/usr/local/etc/apache22/ssl/domain01.com/server.cert"
SSLCertificateKeyFile "/usr/local/etc/apache22/ssl/domain01.com/server.key"
# This is for second case (of course 2 lines above are comments)
# SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
# SSLCertificateFile "/usr/local/etc/apache22/ssl/www.ssldomain.com.crt"
# SSLCertificateKeyFile "/usr/local/etc/apache22/ssl/private.key"
# SSLCertificateChainFile "/usr/local/etc/apache22/ssl/intermediate.crt"

#Redirect permanent / http://www.domain01.com/
</VirtualHost>

<VirtualHost *:80>
DocumentRoot /home/web/web/ssldomain.com
ServerName ssldomain.com
ServerAlias www.ssldomain.com
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/home/web/web/ssldomain.com"
ServerName www.ssldomain.com 
ServerAlias ssldomain.com
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "/usr/local/etc/apache22/ssl/www.ssldomain.com.crt"
SSLCertificateKeyFile "/usr/local/etc/apache22/ssl/private.key"
SSLCertificateChainFile "/usr/local/etc/apache22/ssl/intermediate.crt"
</VirtualHost>

With best regards!

Evgeniy
  • 113
  • 1
  • 7

2 Answers2

2

Apache will default to the first vhost for that IP (or wild cards that match like the * in this case) and port (443) if it cannot find a vhost with a matching ServerName or ServerAlias. So you need to set up a separate site for www.domain01.com on port 443, just like you have done www.ssldomain.com:443 so it doesn't fall back to the only one you've got as a default.

This vhost can be set up to redirect back to HTTP if you want (note this redirect is done after the SSL negotiation so still requires a valid cert - every SSL vhost requires a cert to be set up for it, though you can use the same cert if it's valid for that vhost too).

On that point, how is it that you are not getting a cert error on https://www.domain01.com? I would guess that either you are (and only if you ignore it do you see www.ssldomain.com content), or your cert covers both domains in (in which case setting this up as a separate vhost and redirecting back to http is definitely the way to go).

Btw, contrary to popular belief you do not need a separate IP address to set up multiple SSL hosts on the Apache instance - even for old browsers which do not support SNI. There is another work around. See here for more details: Disabling SNI for specific virtualhost on Apache

Community
  • 1
Barry Pollard
  • 4,591
  • 15
  • 26
  • So I try to setup "VirtualHost on *:443" for domain01.com with "SSLEngine on" to get another page on https://www.domain01.com/ in browser but Apache can't start. – Evgeniy Oct 03 '15 at 16:02
  • Can Apache start VirtualHost with "SSLEngine on" section only or I must to define SSLCertificateFile, SSLCertificateKeyFile, SSLCertificateChainFile? – Evgeniy Oct 03 '15 at 16:06
  • Ok, Apache starts after creating fake certificate but when I try ssldomain.com in browser it show an error of certificate and then the page of domain01.com on VirtualHost 443. Strange! – Evgeniy Oct 03 '15 at 16:25
  • You must define a cert for each SSL vhost as you've discovered. Add you config to your original question and we'll take a look. Sounds like you haven't set the ServerName or ServerAlias correctly so it's picking up an incorrect vhost - perhaps the first one which is the default. – Barry Pollard Oct 03 '15 at 18:12
  • Ok, I update my question with a config – Evgeniy Oct 03 '15 at 18:56
  • Ok so you've put your non-SSL domain config first with a different cert file. This means older browsers that do not support SNI and therefore do not send the ServerName in the SSL connection (mostly IE8 on XP and some android phones) will default to this config for the cert negotiation for both sites. You clearly either didn't read or didn't understand that link I gave. Newer browsers (e.g. Chrome) should work with this config though. Which browser are you testing on? Also do pages show correctly even if cert doesn't? They should but above comment suggests no, but question says yes. – Barry Pollard Oct 03 '15 at 19:07
  • I tested it with latest Chrome – Evgeniy Oct 03 '15 at 19:18
  • If i use original cert only on ssldoman.com and not use any cert on domain01.com browser shows https:// www.ssldomain.com/ correctly and http:// www.domain01.com/ correctly. But I want to block https:// www.domain01.com/, because it shows pages of ssldomain.com. – Evgeniy Oct 03 '15 at 19:21
  • Just saying I want to https:// and http:// if ssldomain.com/ work correctly, and http:// of domain01.com work correctly and https:// of domain01.com don't work or have redirect to http:// of domain01.com. Ufff... – Evgeniy Oct 03 '15 at 19:28
  • The second set of config you have given above should give you that for most browsers (once you uncomment the redirect line of course). I can't guess why it doesn't except to presume you don't have it set up exactly as shown above (I'm guessing you've sanitised the domain names at least so sure you didn't correct any other typo when doing that?). Also what version of Apache and OpenSSL are you using as they will need SNI support? – Barry Pollard Oct 03 '15 at 19:32
  • Thanks for your answears, I will testing web server by this way. Apache/2.2.14 OpenSSL 0.9.8e – Evgeniy Oct 03 '15 at 19:42
  • Looks like you need OpenSSL 0.9.8g or higher to use SNI and allow two different certs on same IP (http://www.codealpha.net/631/name-based-virtual-hosts-with-ssl-using-apache2-on-ubuntu-lucid/). Best solution is to use same cert as per link in my original answer and have both domains on that single cert. – Barry Pollard Oct 03 '15 at 19:48
  • And I read your original answear more attentively )) – Evgeniy Oct 03 '15 at 19:55
  • You right on 100%! I only change order of domains and its working! The first is ssldomain.com and the second is domain01.com. – Evgeniy Oct 04 '15 at 06:47
0

This works for me, I only change order of domains - the first is ssldomain.com with original SSL certificate, and the second is domain01.com with the same SSL certificate and redirect.

Include etc/apache22/extra/httpd-ssl.conf

NameVirtualHost *:80
NameVirtualHost *:443

<VirtualHost *:80>
DocumentRoot /home/web/web/ssldomain.com
ServerName ssldomain.com
ServerAlias www.ssldomain.com
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/home/web/web/ssldomain.com"
ServerName www.ssldomain.com 
ServerAlias ssldomain.com
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "/usr/local/etc/apache22/ssl/www.ssldomain.com.crt"
SSLCertificateKeyFile "/usr/local/etc/apache22/ssl/private.key"
SSLCertificateChainFile "/usr/local/etc/apache22/ssl/intermediate.crt"
</VirtualHost>

<VirtualHost *:80>
DocumentRoot /home/web/web/domain01.com
ServerName domain01.com
ServerAlias www.domain01.com
</VirtualHost>

<VirtualHost *:443>
DocumentRoot /home/web/web/domain01.com
ServerName domain01.com
ServerAlias www.domain01.com
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile "/usr/local/etc/apache22/ssl/www.ssldomain.com.crt"
SSLCertificateKeyFile "/usr/local/etc/apache22/ssl/private.key"
SSLCertificateChainFile "/usr/local/etc/apache22/ssl/intermediate.crt"

Redirect permanent / http://www.domain01.com/
</VirtualHost>

Special thanks to @BazzaDP.

Evgeniy
  • 113
  • 1
  • 7