You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by "Mikhail T." <mi...@aldan.algebra.com> on 2012/04/16 17:34:53 UTC
Why aren't name-based vhosts not working properly under SSL?
If the SSL-certificate is the same for all named vhosts configured for the given
IP-address/port-number combination, why can not the vhosts have different
DocumentRoots and other settings?
Thank you. Yours,
-mi
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by Reindl Harald <h....@thelounge.net>.
Am 16.04.2012 17:34, schrieb Mikhail T.:
> If the SSL-certificate is the same for all named vhosts configured for the given IP-address/port-number
> combination, why can not the vhosts have different DocumentRoots and other settings?
because SSL was misdesigned years ago and the Host-Header
is also sent encrypted, so the server can not know for
with hostname the ssl-handshake is and since he knows
the Hostname AFTER handshake it is too late
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by "Mikhail T." <mi...@aldan.algebra.com>.
On 16.04.2012 12:24, Plüm, Rüdiger, Vodafone Group wrote:
>
> Without a NameVirtualHost directive this cannot work as you intend.
>
> Add NameVirtualHost *:433
>
I see... I thought, I'm already giving Apache all the information it needs,
though (with ServerAlias directives)... But if spelling-out the NameVirtualHost
is all I need to add, that works for me...
Thank you! Yours,
-mi
RE: Why aren't name-based vhosts not working properly under SSL?
Posted by Plüm,
Rüdiger,
Vodafone Group <ru...@vodafone.com>.
Without a NameVirtualHost directive this cannot work as you intend.
Add NameVirtualHost *:433
Regards
Rüdiger
From: Mikhail T. [mailto:mi+thun@aldan.algebra.com]
Sent: Montag, 16. April 2012 18:07
To: dev@httpd.apache.org; covener@gmail.com
Subject: Re: Why aren't name-based vhosts not working properly under SSL?
On 16.04.2012 11:55, Eric Covener wrote:
Got a pointer to your configuration?
Well, the real one I was designing now uses a work-around (single vhost with mod_rewrite examining the Host-header and picking the proper subdirectore). Here is a mock one, that I'd rather be using -- instead of messing with mod_rewrite:
Listen: 443
# Common settings for all:
SSLCertificateFile conf/ssl.crt/everywhere.cer
SSLCertificateKeyFile conf/ssl.key/everywhere.key
SSLCertificateChainFile conf/ssl.crt/Comodo-intermediate.cer
<VirtualHost *:443>
ServerName drupal6
ServerAlias project1.example.com
ServerAlias project2.example.net
DocumentRoot /www/drupal6
</VirtualHost>
<VirtualHost *:443>
ServerName drupal7
ServerAlias project3.example.com
ServerAlias project4.example.net
DocumentRoot /www/drupal7
</VirtualHost>
Older projects 1 and 2 use Drupal-6, while the new projects 3 and 4 -- Drupal-7. Yours,
-mi
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by "Mikhail T." <mi...@aldan.algebra.com>.
On 16.04.2012 11:55, Eric Covener wrote:
> Got a pointer to your configuration?
Well, the real one I was designing now uses a work-around (single vhost with
mod_rewrite examining the Host-header and picking the proper subdirectore). Here
is a mock one, that I'd rather be using -- instead of messing with mod_rewrite:
Listen: 443
# Common settings for all:
SSLCertificateFile conf/ssl.crt/everywhere.cer
SSLCertificateKeyFile conf/ssl.key/everywhere.key
SSLCertificateChainFile conf/ssl.crt/Comodo-intermediate.cer
<VirtualHost *:443>
ServerName drupal6
ServerAlias project1.example.com
ServerAlias project2.example.net
DocumentRoot /www/drupal6
</VirtualHost>
<VirtualHost *:443>
ServerName drupal7
ServerAlias project3.example.com
ServerAlias project4.example.net
DocumentRoot /www/drupal7
</VirtualHost>
Older projects 1 and 2 use Drupal-6, while the new projects 3 and 4 -- Drupal-7.
Yours,
-mi
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by Eric Covener <co...@gmail.com>.
> No, this does not answer my question. In my scenario the SSL-certificate is
> the same for all vhosts concerned. So Apache could use that certificate to
> establish the SSL connection, and then parse the Host:-header to determine,
> which group of other (non-SSL) settings to apply to the request. But Apache
> does not do that -- not in 2.2.22.
>
> Is this an omission, that can and should be fixed, or am I missing something
> else? Thanks!
Got a pointer to your configuration?
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by Tom Evans <te...@googlemail.com>.
2012/4/17 Igor Galić <i....@brainsware.org>:
> Hi Tom,
>
> some constructive criticism, if you so allow:
Thanks, I don't actually have a problem with my config. The OP
questioned whether my cut-down version of the config actually did use
different ServerRoot, etc, so I posted a more complete example.
>
> I can see a lot of repetition here, you might
> profit a lot from mod_macro
No thanks! I prefer a little repetition over magic and indirection.
>
> [snip]
>> <LocationMatch ^(?!/errors/)>
>> SSLRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
>> SSLVerifyClient optional
>> </LocationMatch>
>
> It seems sensible to set this in server context, so you
> don't have to repeat it over and over again.
Those three are not the only vhosts, and the alias is not relevant
outside those three vhosts.
Cheers
Tom
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by Tom Evans <te...@googlemail.com>.
On Mon, Apr 16, 2012 at 5:25 PM, Issac Goldstand <ma...@beamartyr.net> wrote:
> Are you sure that your client supports SNI?
>
This is not reliant on SNI.
Cheers
Tom
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by Issac Goldstand <ma...@beamartyr.net>.
Are you sure that your client supports SNI?
On 16/04/2012 19:21, Tom Evans wrote:
> On Mon, Apr 16, 2012 at 4:51 PM, Mikhail T. <mi...@aldan.algebra.com> wrote:
>> On 16.04.2012 11:40, Tom Evans wrote:
>>
>> They can. Excerpt from my httpd.conf:
>>
>> Your excerpt does not show different DocumentRoots -- nor any other
>> settings... Could you show more contents? What is the Apache version you are
>> using? In all my attempts, Apache a) issues a pointless warning about
>> multiple SSL vhosts on the same IP/port; b) uses the settings (including
>> DocumentRoot) from the first vhost encountered for all of them.
>>
> Er, OK:
>
> NameVirtualHost *:80
> NameVirtualHost *:443
>
>
> <VirtualHost *:443>
> ServerName rc.xxxxxx.com
>
> SSLEngine on
> SSLCipherSuite
> ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
> SSLCertificateFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.crt
> SSLCertificateKeyFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.key
> SSLCACertificateFile /etc/ssl/xxxxxx/ca.crt
> ErrorDocument 403 /errors/certneeded.html
> Alias /errors /usr/local/etc/apache22/xxxxxxerrors
> SSLVerifyClient optional
>
> <LocationMatch ^(?!/errors/)>
> SSLRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
> SSLVerifyClient optional
> </LocationMatch>
>
> SSLVerifyDepth 1
> SSLCARevocationFile /etc/ssl/xxxxxx/ca.crl
> SSLOptions +StdEnvVars
> SSLUserName SSL_CLIENT_S_DN_Email
> RequestHeader set X-SSL-Enabled 1
>
> DocumentRoot /usr/home/tom/projects/rc/htdocs
>
> <Directory /usr/home/tom/projects/rc/htdocs>
> Order allow,deny
> Allow from all
> </Directory>
>
> #CustomLog /var/log/httpd-ssl-rc.log "%t %h %{SSL_PROTOCOL}x
> %{SSL_CIPHER}x \"%r\" %b"
>
> SetEnv proxy-nokeepalive 1
>
> RewriteEngine on
> RewriteCond %{REQUEST_URI} !^/favicon.ico
> RewriteCond %{REQUEST_URI} !^/media
> RewriteCond %{REQUEST_URI} !^/amedia
> RewriteCond %{REQUEST_URI} !^/errors
> RewriteRule ^/(.*)$ /rc.fcgi/$1 [QSA,L]
>
> FastCGIExternalServer /usr/home/tom/projects/rc/htdocs/rc.fcgi
> -socket /usr/home/tom/projects/rc/run/rc.socket
> </VirtualHost>
>
>
> <VirtualHost *:443>
> ServerName sab.xxxxxx.com
>
> SSLEngine on
> SSLCipherSuite
> ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
> SSLCertificateFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.crt
> SSLCertificateKeyFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.key
> SSLCACertificateFile /etc/ssl/xxxxxx/ca.crt
> SSLVerifyClient optional
>
> ErrorDocument 403 /errors/certneeded.html
> Alias /errors /usr/local/etc/apache22/xxxxxxerrors
>
> <LocationMatch ^(?!/errors/)>
> SSLRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
> SSLVerifyClient optional
> </LocationMatch>
>
> SSLVerifyDepth 1
> SSLCARevocationFile /etc/ssl/xxxxxx/ca.crl
> SSLUserName SSL_CLIENT_S_DN_Email
> SSLOptions +StdEnvVars
> RequestHeader set X-SSL-Enabled 1
>
> DocumentRoot /var/empty
>
> <Directory /var/empty>
> Order allow,deny
> Allow from all
> </Directory>
>
> ProxyPass /errors !
> ProxyPass / http://ethan.xxxxxx.com:8085/sabnzbd/ retry=0
> ProxyPassReverse / http://ethan.xxxxxx.com:8085/sabnzbd/
> SetEnv proxy-nokeepalive 1
> </VirtualHost>
>
> <VirtualHost *:443>
> ServerName svn.xxxxxx.com
>
> SSLEngine on
> SSLCipherSuite
> ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
> SSLCertificateFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.crt
> SSLCertificateKeyFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.key
> SSLCACertificateFile /etc/ssl/xxxxxx/ca.crt
> SSLVerifyClient optional
>
> ErrorDocument 403 /errors/certneeded.html
> Alias /errors /usr/local/etc/apache22/xxxxxxerrors
>
> <Location />
> DAV svn
> SVNPath /tank/svn/repos/devel
> </Location>
>
> <LocationMatch ^(?!/errors/)>
> SSLRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
> SSLVerifyClient optional
> </LocationMatch>
>
> SSLVerifyDepth 1
> SSLCARevocationFile /etc/ssl/xxxxxx/ca.crl
> SSLUserName SSL_CLIENT_S_DN_Email
> </VirtualHost>
>
> This is httpd 2.2.21 btw
>
> Cheers
>
> Tom
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by Igor Galić <i....@brainsware.org>.
----- Original Message -----
> On Mon, Apr 16, 2012 at 4:51 PM, Mikhail T.
> <mi...@aldan.algebra.com> wrote:
> > On 16.04.2012 11:40, Tom Evans wrote:
> >
> > They can. Excerpt from my httpd.conf:
> >
> > Your excerpt does not show different DocumentRoots -- nor any other
> > settings... Could you show more contents? What is the Apache
> > version you are
> > using? In all my attempts, Apache a) issues a pointless warning
> > about
> > multiple SSL vhosts on the same IP/port; b) uses the settings
> > (including
> > DocumentRoot) from the first vhost encountered for all of them.
> >
>
> Er, OK:
Hi Tom,
some constructive criticism, if you so allow:
I can see a lot of repetition here, you might
profit a lot from mod_macro
[snip]
> <LocationMatch ^(?!/errors/)>
> SSLRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
> SSLVerifyClient optional
> </LocationMatch>
It seems sensible to set this in server context, so you
don't have to repeat it over and over again.
[snip]
> This is httpd 2.2.21 btw
>
> Cheers
>
> Tom
i
--
Igor Galić
Tel: +43 (0) 664 886 22 883
Mail: i.galic@brainsware.org
URL: http://brainsware.org/
GPG: 6880 4155 74BD FD7C B515 2EA5 4B1D 9E08 A097 C9AE
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by Tom Evans <te...@googlemail.com>.
On Mon, Apr 16, 2012 at 4:51 PM, Mikhail T. <mi...@aldan.algebra.com> wrote:
> On 16.04.2012 11:40, Tom Evans wrote:
>
> They can. Excerpt from my httpd.conf:
>
> Your excerpt does not show different DocumentRoots -- nor any other
> settings... Could you show more contents? What is the Apache version you are
> using? In all my attempts, Apache a) issues a pointless warning about
> multiple SSL vhosts on the same IP/port; b) uses the settings (including
> DocumentRoot) from the first vhost encountered for all of them.
>
Er, OK:
NameVirtualHost *:80
NameVirtualHost *:443
<VirtualHost *:443>
ServerName rc.xxxxxx.com
SSLEngine on
SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.crt
SSLCertificateKeyFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.key
SSLCACertificateFile /etc/ssl/xxxxxx/ca.crt
ErrorDocument 403 /errors/certneeded.html
Alias /errors /usr/local/etc/apache22/xxxxxxerrors
SSLVerifyClient optional
<LocationMatch ^(?!/errors/)>
SSLRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
SSLVerifyClient optional
</LocationMatch>
SSLVerifyDepth 1
SSLCARevocationFile /etc/ssl/xxxxxx/ca.crl
SSLOptions +StdEnvVars
SSLUserName SSL_CLIENT_S_DN_Email
RequestHeader set X-SSL-Enabled 1
DocumentRoot /usr/home/tom/projects/rc/htdocs
<Directory /usr/home/tom/projects/rc/htdocs>
Order allow,deny
Allow from all
</Directory>
#CustomLog /var/log/httpd-ssl-rc.log "%t %h %{SSL_PROTOCOL}x
%{SSL_CIPHER}x \"%r\" %b"
SetEnv proxy-nokeepalive 1
RewriteEngine on
RewriteCond %{REQUEST_URI} !^/favicon.ico
RewriteCond %{REQUEST_URI} !^/media
RewriteCond %{REQUEST_URI} !^/amedia
RewriteCond %{REQUEST_URI} !^/errors
RewriteRule ^/(.*)$ /rc.fcgi/$1 [QSA,L]
FastCGIExternalServer /usr/home/tom/projects/rc/htdocs/rc.fcgi
-socket /usr/home/tom/projects/rc/run/rc.socket
</VirtualHost>
<VirtualHost *:443>
ServerName sab.xxxxxx.com
SSLEngine on
SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.crt
SSLCertificateKeyFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.key
SSLCACertificateFile /etc/ssl/xxxxxx/ca.crt
SSLVerifyClient optional
ErrorDocument 403 /errors/certneeded.html
Alias /errors /usr/local/etc/apache22/xxxxxxerrors
<LocationMatch ^(?!/errors/)>
SSLRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
SSLVerifyClient optional
</LocationMatch>
SSLVerifyDepth 1
SSLCARevocationFile /etc/ssl/xxxxxx/ca.crl
SSLUserName SSL_CLIENT_S_DN_Email
SSLOptions +StdEnvVars
RequestHeader set X-SSL-Enabled 1
DocumentRoot /var/empty
<Directory /var/empty>
Order allow,deny
Allow from all
</Directory>
ProxyPass /errors !
ProxyPass / http://ethan.xxxxxx.com:8085/sabnzbd/ retry=0
ProxyPassReverse / http://ethan.xxxxxx.com:8085/sabnzbd/
SetEnv proxy-nokeepalive 1
</VirtualHost>
<VirtualHost *:443>
ServerName svn.xxxxxx.com
SSLEngine on
SSLCipherSuite
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.crt
SSLCertificateKeyFile /etc/ssl/xxxxxx/star.xxxxxx.com/apache.key
SSLCACertificateFile /etc/ssl/xxxxxx/ca.crt
SSLVerifyClient optional
ErrorDocument 403 /errors/certneeded.html
Alias /errors /usr/local/etc/apache22/xxxxxxerrors
<Location />
DAV svn
SVNPath /tank/svn/repos/devel
</Location>
<LocationMatch ^(?!/errors/)>
SSLRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
SSLVerifyClient optional
</LocationMatch>
SSLVerifyDepth 1
SSLCARevocationFile /etc/ssl/xxxxxx/ca.crl
SSLUserName SSL_CLIENT_S_DN_Email
</VirtualHost>
This is httpd 2.2.21 btw
Cheers
Tom
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by "Mikhail T." <mi...@aldan.algebra.com>.
On 16.04.2012 11:40, Tom Evans wrote:
> They can. Excerpt from my httpd.conf:
Your excerpt does not show different DocumentRoots -- nor any other settings...
Could you show more contents? What is the Apache version you are using? In all
my attempts, Apache a) issues a pointless warning about multiple SSL vhosts on
the same IP/port; b) uses the settings (including DocumentRoot) from the first
vhost encountered for all of them.
On 16.04.2012 11:39, Reindl Harald wrote:
> because SSL was misdesigned years ago and the Host-Header is also sent
> encrypted, so the server can not know for with hostname the ssl-handshake is
> and since he knows the Hostname AFTER handshake it is too late
No, this does not answer my question. In my scenario the SSL-certificate is the
same for all vhosts concerned. So Apache could use that certificate to establish
the SSL connection, and then parse the Host:-header to determine, which group of
other (non-SSL) settings to apply to the request. But Apache does not do that --
not in 2.2.22.
Is this an omission, that can and should be fixed, or am I missing something
else? Thanks!
-mi
Re: Why aren't name-based vhosts not working properly under SSL?
Posted by Tom Evans <te...@googlemail.com>.
On Mon, Apr 16, 2012 at 4:34 PM, Mikhail T. <mi...@aldan.algebra.com> wrote:
> If the SSL-certificate is the same for all named vhosts configured for the
> given IP-address/port-number combination, why can not the vhosts have
> different DocumentRoots and other settings?
>
> Thank you. Yours,
>
> -mi
>
They can. Excerpt from my httpd.conf:
NameVirtualHost *:443
<VirtualHost *:443>
ServerName rc.xxxxxx.com
SSLEngine on
SSLCertificateFile /etc/ssl/star.xxxxxx.com/apache.crt
</VirtualHost>
<VirtualHost *:443>
ServerName sab.xxxxxx.com
SSLEngine on
SSLCertificateFile /etc/ssl/star.xxxxxx.com/apache.crt
</VirtualHost>
<VirtualHost *:443>
ServerName svn.xxxxxx.com
SSLEngine on
SSLCertificateFile /etc/ssl/star.xxxxxx.com/apache.crt
</VirtualHost>
Cheers
Tom