Apache configuration using SNI and mix of SSL certs

Question

Up to this point I've been using SNI in my ssl.conf file with Apache 2.2.31 I'm serving up different sites all in the same document root. For example:

NameVirtualHost *:443

<VirtualHost *:443>
DocumentRoot "/var/www/html"
ServerName www.domain1.com

ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn

SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 -TLSv1
SSLCipherSuite ...
SSLHonorCipherOrder on

SSLCertificateFile /etc/pki/tls/certs/domain1.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/domain1.com.key
SSLCertificateChainFile /etc/pki/tls/certs/gd_bundle_domain1.crt
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/var/www/html"
ServerName www.domain2.com

SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 -TLSv1
SSLCipherSuite ...
SSLHonorCipherOrder on

SSLCertificateFile /etc/pki/tls/certs/domain2.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/domain2.com.key
SSLCertificateChainFile /etc/pki/tls/certs/gd_bundle_domain2.crt
</VirtualHost>

...

Now I've added a wildcard cert in the hopes I can add sub-domains without any extra Apache configuration to another new domain. So the ssl.conf looks like this:

NameVirtualHost *:443

<VirtualHost *:443>
DocumentRoot "/var/www/html"
ServerName www.domain1.com

ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn

SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 -TLSv1
SSLCipherSuite ...
SSLHonorCipherOrder on

SSLCertificateFile /etc/pki/tls/certs/domain1.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/domain1.com.key
SSLCertificateChainFile /etc/pki/tls/certs/gd_bundle_domain1.crt
</VirtualHost>

<VirtualHost *:443>
DocumentRoot "/var/www/html"
ServerName www.domain2.com

SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 -TLSv1
SSLCipherSuite ...
SSLHonorCipherOrder on

SSLCertificateFile /etc/pki/tls/certs/domain2.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/domain2.com.key
SSLCertificateChainFile /etc/pki/tls/certs/gd_bundle_domain2.crt
</VirtualHost>

...

<VirtualHost *:443>
DocumentRoot "/var/www/html"
ServerName newdomain.com

SSLEngine on
SSLProtocol all -SSLv2 -SSLv3 -TLSv1
SSLCipherSuite ...
SSLHonorCipherOrder on

SSLCertificateFile /etc/pki/tls/certs/newdomain_wildcard.com.crt
SSLCertificateKeyFile /etc/pki/tls/private/newdomain_wildcard.com.key
SSLCertificateChainFile /etc/pki/tls/certs/gd_bundle_newdomain_wildcard.crt
</VirtualHost>

It works for newdomain.com but not on other sub-domains (i.e. test.newdomain.com). I also get this warning on server start if that relevant:

[warn] RSA server certificate wildcard CommonName (CN) `*.newdomain.com' does NOT match server name!?

If I change ServerName to *.newdomain.com, I don't get warnings but the certificate doesn't work at all.

The ServerName you specified is not in that certificate. Use the correct certificate. — Michael Hampton, Feb 03 '16 at 02:53
@MichaelHampton Perhaps I generated the certificate incorrectly? I specified *.newdomain.com in the CSR. Are you suggesting this was incorrect? — Tom, Feb 03 '16 at 03:30
Sure, for a wildcard cert that's fine. But your ServerName doesn't match. — Michael Hampton, Feb 03 '16 at 03:37
@MichaelHampton I tried ServerName as `*.newdomain.com`. No warnings but the cert is not working at all then — Tom, Feb 03 '16 at 04:11

score 0 · Accepted Answer · answered Feb 06 '16 at 07:58

I'm pretty sure you have to give an actual ServerName and not a wildcard one.

Does your new cert have just "*.newdomain.com" or also "newdomain.com"? I'd guess just the first so can only be used for subdomains and not top level domain (TLD). In that case just set the ServerName to www.newdomain.com, or any other ServerName that the wildcard will match. It's good practice to have a cert that also covers the bare TLD though.

You should also move the newdomain server config to be first. That way it will be the default and anything not explicitly match will fall in here (e.g. If someone uses ransom.newdomain.com). Currently as www.domain1.com is first it will match these requests and presumably cause a cert error.

Apache configuration using SNI and mix of SSL certs

1 Answers1