You are viewing a plain text version of this content. The canonical link for it is here.
Posted to apache-bugdb@apache.org by George Mitchell <ge...@m5p.com> on 2002/02/19 07:31:35 UTC
other/9871: Server presents wrong certificate with NameVirtualHost
>Number: 9871
>Category: other
>Synopsis: Server presents wrong certificate with NameVirtualHost
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: apache
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: apache
>Arrival-Date: Mon Feb 18 22:40:00 PST 2002
>Closed-Date:
>Last-Modified:
>Originator: george+apache@m5p.com
>Release: 2.0.32-beta
>Organization:
apache
>Environment:
FreeBSD 4.5-RELEASE
FreeBSD ashmont.m5p.com 4.5-RELEASE FreeBSD 4.5-RELEASE #0: Fri Feb 8 22:53:56 PST 2002 george@ashmont.m5p.com:/usr/src/sys/compile/ASHMONT i386
>Description:
With multiple virtual hosts sharing one IP address (named virtual hosts),
the SSL module always presents the certificate from the first NameVirtualHost
regardless of the Host: in the request from the client. However, the data
which gets served comes from the proper VirtualHost DocumentRoot.
>How-To-Repeat:
https://www.unilect.com/ presents correct certificate.
https://www.m5p.com/ presents wrong certificate (from www.unilect.com).
>Fix:
>Release-Note:
>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, you need]
[to include <ap...@Apache.Org> in the Cc line and make sure the]
[subject line starts with the report component and number, with ]
[or without any 'Re:' prefixes (such as "general/1098:" or ]
["Re: general/1098:"). If the subject doesn't match this ]
[pattern, your message will be misfiled and ignored. The ]
["apbugs" address is not added to the Cc line of messages from ]
[the database automatically because of the potential for mail ]
[loops. If you do not include this Cc, your reply may be ig- ]
[nored unless you are responding to an explicit request from a ]
[developer. Reply only with text; DO NOT SEND ATTACHMENTS! ]
Re: other/9871: Server presents wrong certificate with NameVirtualHost
Posted by Aaron Bannert <aa...@clove.org>.
On Tue, Feb 19, 2002 at 01:54:19PM +0200, Graham Leggett wrote:
> Name virtual hosting with SSL does work if you have a wildcard
> certificate - as long as that cert is valid for all the different
> possible name virtual hosts for the reason you describe above.
>
> For this reason I would say leave it as it is.
Can we detect if a wildcard cert applies to a vhost? If not, perhaps
this "feature" is not explicit enough in the docs?
-aaron
Re: other/9871: Server presents wrong certificate with NameVirtualHost
Posted by Graham Leggett <mi...@sharp.fm>.
Aaron Bannert wrote:
> Since the Host: header is part of the encrypted stream, it is not
> known to the server by the time the cert is required to establish an
> SSL connection. For this reason it is not possible to do name-based
> virtual hosting w/ SSL.
>
> Perhaps we should make this an explicit failure condition in the
> mod_ssl code?
Name virtual hosting with SSL does work if you have a wildcard
certificate - as long as that cert is valid for all the different
possible name virtual hosts for the reason you describe above.
For this reason I would say leave it as it is.
Regards,
Graham
--
-----------------------------------------
minfrin@sharp.fm "There's a moon
over Bourbon Street
tonight..."
Re: other/9871: Server presents wrong certificate with NameVirtualHost
Posted by Aaron Bannert <aa...@clove.org>.
On Tue, Feb 19, 2002 at 06:31:35AM -0000, George Mitchell wrote:
> With multiple virtual hosts sharing one IP address (named virtual hosts),
> the SSL module always presents the certificate from the first NameVirtualHost
> regardless of the Host: in the request from the client. However, the data
> which gets served comes from the proper VirtualHost DocumentRoot.
Since the Host: header is part of the encrypted stream, it is not
known to the server by the time the cert is required to establish an
SSL connection. For this reason it is not possible to do name-based
virtual hosting w/ SSL.
Perhaps we should make this an explicit failure condition in the
mod_ssl code?
-aaron