Subject: Re: your mail

From: "Ian Newlands" <[email-masked]>
Date: Thu, 21 Aug 2003 12:05:48 +0800

If I hadn't already exhausted resources I would not have made this post in 
the first place.  I have tried 3 different versions of apache, searched 
through previous postings, used search engines etc. bought 2 books on apache 
and have been attempting to get this going for almost 2 months now.

I'm glad you're amused by my frustration here.

If there is anyone out there that is willing to submit a serious response to 
this I would appreciate it greatly.

Regards,

Ian Newlands

----- Original Message -----
From: "Dave Paris" <[email-masked]>
To: <[email-masked]>
Cc: "Ian Newlands" <[email-masked]>
Sent: Thursday, August 21, 2003 11:58 AM
Subject: Re: virtual hosting

>geeze.  is it that time of the month already for this question?  seems like 
>it was just yesterday when it was asked last .. maybe I'm just thinking of 
>the other 100,000 times it was asked.
>
>in all seriousness, this dead horse has been beaten so many times on this 
>list there isn't even a carcass left to hit at this point.  please go dig 
>through the mail list archives to see why name-based virtual hosts don't 
>work with SSL.
>
>yes, that's a flippant answer.  no, you're not likely to get a reply any 
>more serious.
>
>-dsp
>
>On Wednesday, Aug 20, 2003, at 22:09 US/Eastern, Ian Newlands wrote:
>
> > I am currently running about 15 virtual hosts using name based on port > 
>80, and 1 virtual host using SSL.
> >
> > My SSL host is currently working with the following:
> >
> >    <VirtualHost _default_:443>
> >
> > However I want to change this to the IP based hosting for this host, > 
>allowing me to then add more SSL based virtual hosts on this setup, so > I 
>tried changing this to the following:
> >
> >    <VirtualHost 203.xxx.xxx.xxx:443>
> >
> > By doing this my SSL virtual host stops working altogether.
> >
> > I try the following to debug it on a remote machine:
> >
> >    # openssl s_client -connect 203.xxx.xxx.xxx:443
> >    CONNECTED(00000003)
> >    27604:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown > 
>protocol:s23_clnt.c:475:
> >
> > I do the exact same thing on the local machine and it responds with a > 
>valid SSL response.
> >
> > Can anyone suggest might be wrong here?
> >
> > Regards,
> >
> > Ian Newlands
> >
> > _________________________________________________________________
> > Hotmail is now available on Australian mobile phones. Go to  > 
>http://ninemsn.com.au/mobilecentral/signup.asp
> >
> > ______________________________________________________________________
> > Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
> > User Support Mailing List                      [email-masked]
> > Automated List Manager                            [email-masked]
> >
>
>
>

_________________________________________________________________
Hot chart ringtones and polyphonics. Go to  
http://ninemsn.com.au/mobilemania/default.asp

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Merton Campbell Crockett <[email-masked]>
Date: Wed, 20 Aug 2003 21:23:54 -0700 (PDT)

Ian:

Look at Netscape's specification for the SSL protocol, RFC 2246 published by
the IETF covering TLS 1.0, or any of a number of books regarding SSL/TLS
that have been published in the last few years.

Basically, the problem is that the entire payload of the TCP/IP packet is
encrypted.  All that is visible is the IP address in the IP header.

Merton Campbell Crockett

-- 
BEGIN:				vcard
VERSION:			3.0
FN:				Merton Campbell Crockett
ORG:				General Dynamics Advanced Information Systems;
				Intelligence and Exploitation Systems
N:				Crockett;Merton;Campbell
EMAIL;TYPE=internet:		[email-masked]
TEL;TYPE=work,voice,msg,pref:	+1(805)497-5045
TEL;TYPE=fax,work:		+1(805)497-5050
TEL;TYPE=cell,voice,msg:	+1(805)377-6762
END:				vcard
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Kiyoshi Watanabe <[email-masked]>
Date: Thu, 21 Aug 2003 14:57:21 +0900 (JST)

Probably you might want to see
http://httpd.apache.org/docs-2.0/ssl/ssl_faq.html#vhosts2

FAQ is the best place to start.

-Kiyoshi
Kiyoshi Watanabe

---

From: Dave Paris <[email-masked]>
Date: Thu, 21 Aug 2003 06:13:17 -0400

Ian,

http://www.google.com/search?num=20&hl=en&lr=lang_en&ie=UTF- 
8&safe=off&q=SSL+%22name+based+virtual+hosts%22&spell=1

That's a Google query for:   SSL "name based virtual hosts"

The very first hit is:   
http://httpd.apache.org/docs/vhosts/name-based.html

The summary text presented by Google reads:
"Name-based Virtual Hosts
  ... Name-based virtual hosting cannot be used with SSL secure servers  
because
  of the nature of the SSL protocol. ... Using Name-based Virtual Hosts.  
..."

If you don't like that one, there are 1,890 other matches .. several of  
the first 20 clearly say in the summary text presented by Google that  
you can't do name-based virtual hosts with SSL.

Please note I have not to date, nor am I now, calling you [insert  
derogatory/deriding term or phrase here], nor am I saying you're a  
worthless human.  I'm simply pointing out the obvious fact that the way  
your mind seems to go about solving problems and researching does not  
mesh well with the tasks you're trying to accomplish.  You claim to  
have spent two MONTHS trying to find what I found in under 10 SECONDS.   
That doesn't make me one bit of a better person than you... it just  
says that my mind works in a way that is different from yours.  I'd  
wager there are certain tasks you accomplish quite easily that would  
take me some effort.  It's the way us humans seem to be designed.

Every once in awhile, it's a good thing to look at who we are and what  
we're good at and then review what we've chosen to do in life.  Doing a  
job that meshes well with how you think can be all the difference  
between looking forward to an rewarding day at the office and a bruised  
forehead from repeatedly smashing your head against a wall in  
self-frustration.  [ of course, I'm omitting the forehead bruising  
caused by external influences like PHBs ;-) ]   As for the tone of your  
note .. life's tough, grab a helmet.

Kind Regards,
-dsp

On Thursday, Aug 21, 2003, at 00:05 US/Eastern, Ian Newlands wrote:

> If I hadn't already exhausted resources I would not have made this  
> post in the first place.  I have tried 3 different versions of apache,  
> searched through previous postings, used search engines etc. bought 2  
> books on apache and have been attempting to get this going for almost  
> 2 months now.
>
> If there is anyone out there that is willing to submit a serious  
> response to this I would appreciate it greatly.
>
> Regards,
>
> Ian Newlands
>
>
>> geeze.  is it that time of the month already for this question?   
>> seems like it was just yesterday when it was asked last .. maybe I'm  
>> just thinking of the other 100,000 times it was asked.
>>
>> in all seriousness, this dead horse has been beaten so many times on  
>> this list there isn't even a carcass left to hit at this point.   
>> please go dig through the mail list archives to see why name-based  
>> virtual hosts don't work with SSL.
>>
>> yes, that's a flippant answer.  no, you're not likely to get a reply  
>> any more serious.
>>
>> -dsp
>>
>> > I am currently running about 15 virtual hosts using name based on  
>> port > 80, and 1 virtual host using SSL.
>> >
>> > However I want to change this to the IP based hosting for this  
>> host, > allowing me to then add more SSL based virtual hosts on this  
>> setup, so > I tried changing this to the following:
>> >
>> >    27604:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown  
>> > protocol:s23_clnt.c:475:
>> >
>> > I do the exact same thing on the local machine and it responds with  
>> a > valid SSL response.
>> >