Re: [users@httpd] Unexpected extra certificate

[Peter Thomassen <th...@a4a.de>]

Dear experts,

Unfortunately, I have not been able to make progress on this issue. Do
you have any suggestions how to investigate?

Thanks a lot,
Peter

On 03/23/2017 02:09 PM, Peter Thomassen wrote:
> Hi,
> 
> Using Apache 2.4.10 on Ubuntu, I configured a bunch of virtual hosts
> with SSL, plus an extra virtual host before them, to catch requests for
> hostnames that are not otherwise defined.
> 
> When responding to a request to one of the regular virtual hosts, it
> turns out that Apache sends the correct certificate, plus the one from
> the default vhost. You can see this behavior in
> 
> 	https://www.ssllabs.com/ssltest/analyze.html?d=web.a4a.de&s=2a01%3a4f8%3a10a%3a1d5c%3a8000%3a0%3a0%3a7&latest
> 
> ... where there are two certificates, one from Let's Encrypt for
> web.a4a.de / www.web.a4a.de, and the other self-signed for * (this is
> the default vhost's certificate).
> 
> There are no certificate-related directives outside the VirtualHost
> blocks. It somehow seems like the SSL configuration from the default
> vhost leaks into the others, which seems very strange to me.
> 
> I was unable to find a way to serve only the appropriate certificate. Do
> you have any ideas?
> 
> Thanks,
> Peter
> 

-- 
Mit freundlichen Grüßen
Peter Thomassen

OpenPGP Key: 0x2BA469F9

Verwirrender Anhang? Das ist eine digitale Unterschrift.
Details: https://www.anonym-surfen.de/help/email-openpgp.html

------------------------------------------
a4a GmbH
Scheffelstr. 14
97072 Würzburg
Germany

fon: +49-931-2705351
fax: +49-931-27049942

web: https://a4a.de
e-mail: info@a4a.de

Geschäftsführer: Dr. Peter Thomassen
Registergericht AG Würzburg HRB 10041
USt-IdNr.: DE263344753

Re: [users@httpd] Unexpected extra certificate

[Michele Cherici <on...@contezero.com>]

Hi Peter,

your setup should be correct, the self-signed certificate is shown in ssllabs result because they test a connection with a client that does not support SNI.

Here you can find more info:
https://community.qualys.com/thread/16759-dead-link-in-devssllabscom-if-second-certificate-is-not-trusted#comment-35338

Michele

------------
web: https://www.cazar.it
Linkedin: https://it.linkedin.com/in/michelecherici/en


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org