Subject: the same virtualhost with http and https?

From: "Matus \"fantomas\" Uhlar" <[email-masked]>
Date: Fri, 15 Feb 2002 17:56:19 +0100

Hello,

I'd like to know, how does modssl decide which port is ssl and which one is
non-ssl? if I bind apache to two ports, how to tell which one should be used
for ssl connects and which one for non-ssl connects?

Another question. if I run http on port 80 and httpd on port 443, and I
define only one virtualhost:

<VirtualHost ip.address>
ServerName blablabla
</VirtualHost>

will that virtualhost be available via both ports/protocols?
Or, do I need to define two virtualhosts, one on port 80 without ssl and one
on 443 with ssl?

-- 
 Matus "fantomas" Uhlar, [email-masked] ; http://www.fantomas.sk/
 Warning: I don't wish to receive spam to this address.
 Varovanie: Nezelam si na tuto adresu dostavat akukolvek reklamnu postu.
 Depression is merely anger without enthusiasm. 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Owen Boyle <[email-masked]>
Date: Fri, 15 Feb 2002 18:48:40 +0100

> for ssl connects and which one for non-ssl connects?

Apache is the process - mod_ssl is just a module. Only port 80 is
listened to by default by apache so to get SSL to work you must
explicitly say "Listen 443".

> will that virtualhost be available via both ports/protocols?

I guess so... but this not a good idea since SSL requires lots of extra
directives (like "SSLEngine on" - how they would interact with the HTTP
host is not obvious...

> Or, do I need to define two virtualhosts, one on port 80 without ssl and one

This is a much better idea - keep the SSL and HTTP hosts completely
separate, you will sleep better.

>  Warning: I don't wish to receive spam to this address.

You'll be lucky!

---

From: "Matus \"fantomas\" Uhlar" <[email-masked]>
Date: Fri, 15 Feb 2002 19:38:43 +0100

-> > I'd like to know, how does modssl decide which port is ssl and which one is
-> > non-ssl? if I bind apache to two ports, how to tell which one should be used
-> > for ssl connects and which one for non-ssl connects?
-> 
-> Apache is the process - mod_ssl is just a module. Only port 80 is
-> listened to by default by apache so to get SSL to work you must
-> explicitly say "Listen 443".

Yes i know that :) The question is - how will mod_ssl know that it should
process connections on port 443 and not on port 80.

-> > Another question. if I run http on port 80 and httpd on port 443, and I
-> > define only one virtualhost:
-> > 
-> > <VirtualHost ip.address>
-> > ServerName blablabla
-> > </VirtualHost>
-> > 
-> > will that virtualhost be available via both ports/protocols?
-> 
-> I guess so... but this not a good idea since SSL requires lots of extra
-> directives (like "SSLEngine on" - how they would interact with the HTTP
-> host is not obvious...

hmmm. I think I can put genric SSL directives into server's config and none
special are _required_ for virtualhosts. I just have some virtualhosts and
wish to give access to all of them without reconfiguring them. 
And that ebout sslengine was exactly hat i wanteddo know. couls i turnon
SSLEngine on for all connections to one port and turn it off for all
connections on other port?

-> > Or, do I need to define two virtualhosts, one on port 80 without ssl and one
-> > on 443 with ssl?
-> 
-> This is a much better idea - keep the SSL and HTTP hosts completely
-> separate, you will sleep better.

 Eagles may soar, but weasels don't get sucked into jet engines.

---

From: "R. DuFresne" <[email-masked]>
Date: Fri, 15 Feb 2002 13:55:49 -0500 (EST)

> process connections on port 443 and not on port 80.

For one, it's a standard well known port:

darkstar:~# grep 443 /etc/services
https           443/tcp         https           # http protocol over
TLS/SSL
for two, it would most likely be part of your httpd.conf, with the listen
directive.

Get to know your /etc/services file and know it well, and if you have one
not, or a sparse one, do a google search, the well know port/protocol
combos are well documented on various url's out there...

> connections on other port?

Have you actually parsed through the defult httpd.conf file that is
installed when you compile the openssl/mod-ssl/apache combo <some folks
will ass in MM in that combo>  It's pretty well documented, and reading
through it as one parses the FAQ and other documentation included is
always a good starting point.

> -> separate, you will sleep better.

Thanks,

Ron DuFresne
-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: Matus fantomas Uhlar <[email-masked]>
Date: Sun, 17 Feb 2002 14:46:06 +0100

-> > -> > I'd like to know, how does modssl decide which port is ssl and which one is
-> > -> > non-ssl? if I bind apache to two ports, how to tell which one should be used
-> > -> > for ssl connects and which one for non-ssl connects?
-> > -> 
-> > -> Apache is the process - mod_ssl is just a module. Only port 80 is
-> > -> listened to by default by apache so to get SSL to work you must
-> > -> explicitly say "Listen 443".
-> > 
-> > Yes i know that :) The question is - how will mod_ssl know that it
-> > should process connections on port 443 and not on port 80.
-> 
-> For one, it's a standard well known port:
-> 
-> darkstar:~# grep 443 /etc/services
-> https           443/tcp         https           # http protocol over
-> TLS/SSL

Does mod_ssl walk through /etc/services ? By compile time or by runtime?

-> for two, it would most likely be part of your httpd.conf, with the listen
-> directive.

How do I define that apache should accept only non-encrypted connections on
port 80 and only encrypted on 443? 

What if I would use other two ports? 81 and 444 for example. Would apache
crash? or will it tell it doesn't know what kind of connections should wait
on those ports? or will it expect http connections everywhere?

-> > hmmm. I think I can put genric SSL directives into server's config and
-> > none special are _required_ for virtualhosts. I just have some
-> > virtualhosts and wish to give access to all of them without
-> > reconfiguring them.  And that ebout sslengine was exactly hat i
-> > wanteddo know. couls i turnon SSLEngine on for all connections to one
-> > port and turn it off for all connections on other port?
-> 
-> Have you actually parsed through the defult httpd.conf file that is
-> installed when you compile the openssl/mod-ssl/apache combo <some folks
-> will ass in MM in that combo> It's pretty well documented, and reading
-> through it as one parses the FAQ and other documentation included is
-> always a good starting point.

I didn't install anything yet. I am deciding between apache-ssl and mod-ssl;

I did search the docs on the web. But i could not find answer to my
questions. That's why I subscribed here. Maybe you could point me to exact
answer of my question;

<VirtualHost 192.168.0.1>
ServerName blabla1
</VirtualHost>

<VirtualHost 192.168.0.1>
ServerName blabla2
</VirtualHost>

will both servers, blabla1 and blabla2 be available on port 80 w/o SSL and
on port 443 with SSL? should I use this to define behaviour of ports?

<VirtualHost *:80>
SSLEngine Off
</VirtualHost>

<VirtualHost *:443>
SSLEngine On
</VirtualHost>

 I drive way too fast to worry about cholesterol.

---

From: NickM <[email-masked]>
Date: Sun, 17 Feb 2002 18:19:56 +0100 (CET)

> port 80 and only encrypted on 443? 

This is only decided by the SSLEngine on statement, without that it doesnt 
matter what port number is what it will still be standard http.

> on those ports? or will it expect http connections everywhere?

You can use any port you like pretty much, as long as its not already used.

> on port 443 with SSL? should I use this to define behaviour of ports?

As you have them there it is simply going to be two http servers.

> </VirtualHost>

As you have it here, ONLY because of the sslengine directive will the second 
one be SSL enabled, otherwise it would be http on port 443

To recap:

<VirtualHost 192.168.0.1:443>
  SSLEngine On
</VirtualHost>

Will be https://192.168.0.1/

<VirtualHost 192.168.0.1:443>
</VirtualHost>

Will be http://192.168.0.1:443/

<VirtualHost 192.168.0.1:80>
  SSLEngine On
</VirtualHost>

Will be https://192.168.0.1:80/

Nick