Subject: RE: 2 VirtualHosts with 2 Certificates

From: "Boyle Owen" <[email-masked]>
Date: Thu, 9 Jan 2003 16:14:39 +0100

>-----Original Message-----
>From: Irving Carrion [mailto:[email-masked]]
>Sent: Donnerstag, 9. Januar 2003 15:42
>To: [email-masked]
>Subject: RE: 2 VirtualHosts with 2 Certificates
>
>
>Everyone knows this question will not stop coming... is it possible to
>return an error message to the user when restarting apache?  

The trouble is that it is not really an error.

- mod_ssl asks apache for the certificate pertaining to the virtual host
defined by the request's TCP/IP attributes (IP and port).
- Apache uses its standard ruleset (namely: if you have several VHs on
the same IP/port, use the first one) to get the cert.
- mod_ssl receives the cert and happily does the SSL negotiation.

There is nothing illegal in a config which attempts NBVH with SSL VHs so
it is difficult to spot the "error". 

>Only a
>suggestion....  =)
>
>-----Original Message-----
>From: [email-masked]
>[mailto:[email-masked]] On Behalf Of James Barwick
>Sent: Wednesday, January 08, 2003 4:30 PM
>To: [email-masked]
>Subject: Re: 2 VirtualHosts with 2 Certificates
>
>Should have read the MOST FREQUENTLY ASKED FREQUENTLY ASKED 
>QUESTIONS!!!
>
>Can't do that.  Learn a little more about SSL.  It's IP based, 
>not name 
>based.  So, you can only have
>one certificate and one firtual host on 92.35.28.17:443.  Sorry...but 
>that's the way it goes.
>
>Same question answer number four billion six hundred seventeen million 
>two hundred thirty-four thousand nine hunderd twenty-four!
>
>;)
>
>JDB
>
>toxshark wrote:
>
>> i have the apache configured with 2 VirtualHosts on port 443.
>>
>> both VirtualServers have separately CertificateFiles and 
>> CertificateKeyFiles.
>>
>> but now if i connect to the VirtualHost2, the Host have the 
>> Certificate from the VirtualServer1!
>>
>> both Hosts have now the same Certificate.
>>
>>  
>>
>> my httpd.config:
>>
>>  
>>
>> ...
>>
>> NameVirtualHost 92.35.28.17:443
>>
>>  
>>
>> <VirtualHost 92.35.28.17:443>
>>
>> ServerName domain1.com
>>
>> ServerAlias www.domain1.com
>>
>> DocumentRoot "/web1/"
>>
>> SSLEngine on
>>
>> SSLCertificateFile /usr/local/etc/apache/key/ssl1.cert
>>
>> SSLCertificateKeyFile /usr/local/etc/apache/key/ssl1.key
>>
>> </VirtualHost>
>>
>>  
>>
>> <VirtualHost 92.35.28.17:443>
>>
>> ServerName domain2.com
>>
>> ServerAlias www.domain2.com
>>
>> DocumentRoot "/web2/"
>>
>> SSLEngine on
>>
>> SSLCertificateFile /usr/local/etc/apache/key/ssl2.cert
>>
>> SSLCertificateKeyFile /usr/local/etc/apache/key/ssl2.key
>>
>> </VirtualHost>
>>
>> ...
>>
>>  
>>
>
>
>______________________________________________________________________
>Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
>User Support Mailing List                      [email-masked]
>Automated List Manager                            [email-masked]
>
>______________________________________________________________________
>Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
>User Support Mailing List                      [email-masked]
>Automated List Manager                            [email-masked]
>

This message is for the named person's use only. It may contain
confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please notify the sender urgently
and then immediately delete the message and any copies of it from your
system. Please also immediately destroy any hardcopies of the message.
You must not, directly or indirectly, use, disclose, distribute, print,
or copy any part of this message if you are not the intended recipient.
The sender's company reserves the right to monitor all e-mail
communications through their networks. Any views expressed in this
message are those of the individual sender, except where the message
states otherwise and the sender is authorised to state them to be the
views of the sender's company. 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]