You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by bf...@comcast.net on 2008/08/28 17:46:24 UTC
[users@httpd] How to install SSL certificate for virtual server?
I have an apache 1.3x server which utilizes SSL. Lets say the name is
www.myserver1.com. I use apachectl startssl to start the server, and can
access it using https://www.myserver1.com. Now I have a second virtual
server named www.myserver2.com using the same IP, which I want to secure.
When I attempt to access it, I get the following error in Firefox:
Secure Connection Failed
www.myserver2.com uses an invalid security certificate.
The certificate is only valid for www.myserver1.com
(Error code: ssl_error_bad_cert_domain)
Here's an excerpt of my virtual host configuration:
<VirtualHost 64.211.42.81>
ServerName www.myserver2.com
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /usr/local/apache/conf/ssl.crt/www.myserver2.com.crt
SSLCertificateKeyFile /usr/local/apache-1.3.37/conf/ssl.key/www.myserver2.com.key
<Files ~ "\.(cgi|shtml|phtml|php3|roc|rock?)$">
SSLOptions +StdEnvVars
</Files>
SetEnvIf User-Agent ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
CustomLog /usr/local/apache/logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>
How do you secure a second virtual host with an SSL certificate, so I can then
access https://www.myserver2.com?
-Thanks
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] How to install SSL certificate for virtual server?
Posted by Joseph S D Yao <js...@tux.org>.
On Fri, Aug 29, 2008 at 08:11:24AM +0200, Krist van Besien wrote:
> On Thu, Aug 28, 2008 at 17:46, <bf...@comcast.net> wrote:
>
> > How do you secure a second virtual host with an SSL certificate, so I can then
> > access https://www.myserver2.com?
>
> The usual answer to this question is: You can't. See:
> http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts2
>
> There is an experimental extension to the SSL protocol, called SNI,
> which would make virtualhosts possible. As far as I can see this
> requires a recompile of both apache and openssl...
ISTM that you can run a second instance of 'httpd' with a second
certificate on a different port [e.g. https://www.myserver2.com:8443/]
and a different configuration file. I have never tried this, though.
--
/*********************************************************************\
**
** Joe Yao jsdy@tux.org - Joseph S. D. Yao
**
\*********************************************************************/
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] How to install SSL certificate for virtual server?
Posted by Krist van Besien <kr...@gmail.com>.
On Thu, Aug 28, 2008 at 17:46, <bf...@comcast.net> wrote:
> How do you secure a second virtual host with an SSL certificate, so I can then
> access https://www.myserver2.com?
The usual answer to this question is: You can't. See:
http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts2
There is an experimental extension to the SSL protocol, called SNI,
which would make virtualhosts possible. As far as I can see this
requires a recompile of both apache and openssl...
Krist
--
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] How to install SSL certificate for virtual server?
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
> On Aug 28, 2008, at 8:46 AM, bfb21@comcast.net wrote:
>
> ><VirtualHost 64.211.42.81>
On 31.08.08 11:25, Sander Temme wrote:
> This needs to be a different IP address from the one for www.myserver1.com
> . You'll also need a Listen statement for it (if you're not listening
> on all available IPs).
Actually, it only needs different IP address OR port number, see below.
> > ServerName www.myserver2.com
> ^^^^^^^^^^^^^^^^^
> This hostname needs to resolve to the IP address above.
Not exactly - connection to given server name (and resulting IP) should end
at the IP(:port) combination specified above in <VirtualHost> directive.
There are NAT devices, load balancers and failover switches that can listen
on one IP:port and forward the connection to other IP:port combination
... just to know the possibilities, we use something like that.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Despite the cost of living, have you noticed how popular it remains?
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] How to install SSL certificate for virtual server?
Posted by Sander Temme <sc...@apache.org>.
On Aug 28, 2008, at 8:46 AM, bfb21@comcast.net wrote:
> <VirtualHost 64.211.42.81>
^^^^^^^^^^^^^
This needs to be a different IP address from the one for www.myserver1.com
. You'll also need a Listen statement for it (if you're not listening
on all available IPs).
> ServerName www.myserver2.com
^^^^^^^^^^^^^^^^^
This hostname needs to resolve to the IP address above.
> SSLCertificateFile /usr/local/apache/conf/ssl.crt/www.myserver2.com.crt
> SSLCertificateKeyFile /usr/local/apache-1.3.37/conf/ssl.key/www.myserver2.com.key
Any reason why the paths are different?
Were you given a chain of authority file by your CA? You need to
point to that with SSLCertificateChainFile so the client can make the
connection between the CA that signed your cert and the root CA it
knows about.
S.
--
Sander Temme
sctemme@apache.org
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF