You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Nishaliny Thurairatnam <ni...@foodreg.my> on 2009/04/30 15:10:01 UTC
[users@httpd] Two virtual hosts with 2 different sets of SSL certificates
Hi,
I've been tearing my hair out over this for quite some time now...so,
this is the scenario:
I have 2 different virtual hosts, both with different server name's and
aliases, naturally with different sets of SSL certificates. My problem
is, no matter how I try to arrange them, one virtual host settings
ALWAYS takes precedence over the other. I don't want it to take
precedence, I want them both to be read as equals, meaning if I want to
access <VirtualHost1>, then I should access <VirtualHost1>, regardless
of whether <VirtualHostA1> takes precedence.
You see, the problem when it takes precedence is that, when I access my
web page on the browser for the Vhost that has lower precedence, the SSL
certificates for this host is matched incorrectly. It refers to the
certificates defined in the Vhost with higher precedence. It's truly
frustrating :-(
Please, if anyone could shed some light as to how I can resolve
this....I'd appreciate it very much... and please, if I'm doing
something wrong, feel free to let me know...I'm no 'guru' and I don't
claim to know the universe :-)
Thanks very much in advance!
Regards,
Nisha
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Two virtual hosts with 2 different sets of SSL
certificates
Posted by André Warnier <aw...@ice-sa.com>.
Nishaliny Thurairatnam wrote:
> Hi,
>
> Thanks for your reply... I have them both on one server, with only one
> IP... if I used a domain name for one and an IP for the other host,
> would that work?
Haven't thought about it in detail, but I don't think so, not with a
single IP.
Because your IP-based host would probably get all requests.
> If I cannot assign unique IP's for each vhost, is there another way to
> work around it?
>
I don't think so either, except as indicated already in other responses.
Try to understand what happens with HTTPS/SSL connections, and you will
realise why.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Two virtual hosts with 2 different sets of SSL
certificates
Posted by Krist van Besien <kr...@gmail.com>.
On Thu, Apr 30, 2009 at 3:30 PM, Nishaliny Thurairatnam
<ni...@foodreg.my> wrote:
> Hi,
>
> Thanks for your reply... I have them both on one server, with only one
> IP... if I used a domain name for one and an IP for the other host,
> would that work?
No.
Because your browser translates a domain name to an IP anyway. Your
server still has to perform an SSL handshake before it knows which
virtualhost will handle the request.
The only thing you could do, if all your vhosts are subdomains of the
same domain, is to use a wildcard ssl certificate.
So if you have
host1.domain.com
host2.domain.com
then you can get a ssl certificate for *.domain.com, and use that.
Krist
--
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Two virtual hosts with 2 different sets of SSL
certificates
Posted by Nishaliny Thurairatnam <ni...@foodreg.my>.
Hi,
Thanks for your reply... I have them both on one server, with only one
IP... if I used a domain name for one and an IP for the other host,
would that work?
If I cannot assign unique IP's for each vhost, is there another way to
work around it?
Thanks.
Regards,
Nisha
J. Greenlees wrote:
> Nishaliny Thurairatnam wrote:
>
>> Hi,
>>
>> I've been tearing my hair out over this for quite some time now...so,
>> this is the scenario:
>>
>> I have 2 different virtual hosts, both with different server name's and
>> aliases, naturally with different sets of SSL certificates. My problem
>> is, no matter how I try to arrange them, one virtual host settings
>> ALWAYS takes precedence over the other. I don't want it to take
>> precedence, I want them both to be read as equals, meaning if I want to
>> access <VirtualHost1>, then I should access <VirtualHost1>, regardless
>> of whether <VirtualHostA1> takes precedence.
>>
>> You see, the problem when it takes precedence is that, when I access my
>> web page on the browser for the Vhost that has lower precedence, the SSL
>> certificates for this host is matched incorrectly. It refers to the
>> certificates defined in the Vhost with higher precedence. It's truly
>> frustrating :-(
>>
>
> ssl vhosting has to be ip based.
> you need a unique ip address for each ssl vhost.
> Apache serves ssl certificates based on ip address, not name.
>
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> " from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>
>
>
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Two virtual hosts with 2 different sets of SSL
certificates
Posted by Jonas Eckerman <jo...@frukt.org>.
J. Greenlees wrote:
> ssl vhosting has to be ip based.
Not really. It's just the certificates that is choosen based on IP and port.
> you need a unique ip address for each ssl vhost.
You don't need that. Yo do need a unique IP+port pair for each
cerificate-set if you wish to use different certificates for different
sites.
If you only have one IP adress you can use the same cerificate-set for
all your name based virtual hosts. Of course the certificate should be
issued for all those hosts.
Regards
/Jonas
--
Jonas Eckerman
Fruktträdet & Förbundet Sveriges Dövblinda
http://www.fsdb.org/
http://www.frukt.org/
http://whatever.frukt.org/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Two virtual hosts with 2 different sets of SSL
certificates
Posted by "J. Greenlees" <li...@jaqui-greenlees.net>.
Nishaliny Thurairatnam wrote:
> Hi,
>
> I've been tearing my hair out over this for quite some time now...so,
> this is the scenario:
>
> I have 2 different virtual hosts, both with different server name's and
> aliases, naturally with different sets of SSL certificates. My problem
> is, no matter how I try to arrange them, one virtual host settings
> ALWAYS takes precedence over the other. I don't want it to take
> precedence, I want them both to be read as equals, meaning if I want to
> access <VirtualHost1>, then I should access <VirtualHost1>, regardless
> of whether <VirtualHostA1> takes precedence.
>
> You see, the problem when it takes precedence is that, when I access my
> web page on the browser for the Vhost that has lower precedence, the SSL
> certificates for this host is matched incorrectly. It refers to the
> certificates defined in the Vhost with higher precedence. It's truly
> frustrating :-(
ssl vhosting has to be ip based.
you need a unique ip address for each ssl vhost.
Apache serves ssl certificates based on ip address, not name.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Two virtual hosts with 2 different sets of SSL
certificates
Posted by Jonas Eckerman <jo...@frukt.org>.
Nishaliny Thurairatnam wrote:
> I have 2 different virtual hosts, both with different server name's and
> aliases, naturally with different sets of SSL certificates.
You cant't have different sets of SSL cerificates for hosts sharing
IP+port as the SSL cerificates are used *before* the reuest headers are
parsed.
Either use different IP+port for the two hosts, or have them share one
set of SSL certificates.
Regards
/Jonas
--
Jonas Eckerman
Fruktträdet & Förbundet Sveriges Dövblinda
http://www.fsdb.org/
http://www.frukt.org/
http://whatever.frukt.org/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Two virtual hosts with 2 different sets of SSL
certificates
Posted by André Warnier <aw...@ice-sa.com>.
Nishaliny Thurairatnam wrote:
> Hi,
>
> I've been tearing my hair out over this for quite some time now...
Stop doing that, because you will have no hair left before you find a
solution.
so,
> this is the scenario:
>
> I have 2 different virtual hosts, both with different server name's and
> aliases, naturally with different sets of SSL certificates. My problem
> is, no matter how I try to arrange them, one virtual host settings
> ALWAYS takes precedence over the other. I don't want it to take
> precedence, I want them both to be read as equals, meaning if I want to
> access <VirtualHost1>, then I should access <VirtualHost1>, regardless
> of whether <VirtualHostA1> takes precedence.
>
> You see, the problem when it takes precedence is that, when I access my
> web page on the browser for the Vhost that has lower precedence, the SSL
> certificates for this host is matched incorrectly. It refers to the
> certificates defined in the Vhost with higher precedence. It's truly
> frustrating :-(
>
> Please, if anyone could shed some light as to how I can resolve
> this....I'd appreciate it very much... and please, if I'm doing
> something wrong, feel free to let me know...I'm no 'guru' and I don't
> claim to know the universe :-)
>
I think you are trying to do something that is currently not possible :
combine name-based virtual hosts with SSL.
The base of name-based virtual hosting is this :
A) When the browser sends a request over HTTP, it sends :
Line 1 : the requested URI :
GET /something HTTP/1.1
Line 2 :
Host: myhost.company.com
(then further header lines and body)
B) when the server receives this request, it parses the request *and*
the header lines, among which the "Host:" header line.
That is what tells the server *which virtual host* is supposed to handle
this request.
The server then goes on to compare this hostname, with the "ServerName"
of each <VirtualHost> section.
If it finds a match, then it handles the request using the configuration
of the matching <VirtualHost> section.
If it does not find a match, then it handles this request using the
configuration of the *first* <VirtualHost> section, because this is the
*default* virtual host.
Ok so far ?
(This is all explained pretty well in the on-line Virtual Hosts
documentation).
Now, the problem with SSL, is that everything is encrypted, even the
very first browser request. And to decrypt it, the server needs the
decryption key.
But it can only have this decryption key, when it knows to which host
this request is addressed, because the key is specific to the host.
So it can never decrypt the request (including the HTTP headers, and
particularly the "Host:" header) in advance.
So we have a chicken-end-egg situation.
The underlying problem is that the SSL communication channel is
something that must be established first, before Apache even gets the
request to examine.
The final result anyway, is that you can have a combination like
- several VirtualHost (non-SSL) listening on port 80
- one and only one VirtualHost listening on port 443, and it has to be
the only one because it must be the default host (for it's port).
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org