Subject: Multiple SSL-enabled vhosts

From: Joe Auty <[email-masked]>
Date: Thu, 17 Jan 2002 20:43:33 -0500 (EST)

Hi,

Thanks to all those that helped me with my original problem and being
patient with my dependence on this list. I think I'm starting to 'get it'.
I just have (hopefully) one more question before I leave you guys
alone.... =)

I want to have 2 different certificates used in 2 different virtual
hosts on my server.

I have:

"SSLCertificateFile /etc/httpd/conf/ssl.crt/cert1.crt" specified
for one virtualhost, and:

"SSLCertificateFile /etc/httpd/conf/ssl.crt/cert2.crt" specified for the
other.

The problem is that other/second vhost is using cert1.crt for some reason.
When I do a "openssl x509 -noout -text -in cert2.crt" I get the correct
information for that certificate which is, of course, different than
cert1.

Is there a way to specify multiple SSLCertificateFile directives for
different vhosts, or will the first one specified be used unconditionally
for all other vhosts?

Thanks in advance for your response and help...

(I promise I won't CC anybody who responds to me... I did this in case the
individuals I were responding to had filters for regular listmail) =)

-- 
Joe Auty
[email-masked]
http://www.netmusician.org
http://www.jeahost.com

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Owen Boyle <[email-masked]>
Date: Fri, 18 Jan 2002 10:35:24 +0100

> different vhosts, or will the first one specified be used unconditionally

Hate to have to tell you but it can't be done. You cannot have more than
one SSL VH on any given IP address/Port. To have more than one SSL VH on
the same machine, they have to use different IP addresses or different
ports - name-based VHs don't work.

See

http://www.modssl.org/docs/2.8/ssl_faq.html#ToC47 and 
http://marc.theaimsgroup.com/?l=apache-modssl&m=98559369910170&w=2

for why...

Rgds,

Owen Boyle.

---

From: "Julian C. Dunn" <[email-masked]>
Date: Fri, 18 Jan 2002 11:43:25 -0500 (EST)

>> I want to have 2 different certificates used in 2 different virtual

<snip>

> ports - name-based VHs don't work.

I don't think that's what the original person was asking: he was asking
if he could use two different certificates on two different virtual hosts,
which might not, actually, MUST not be on the same IP. The answer is yes, it is
possible... I am doing it here. But you have to make sure you are using the
correct key file that corresponds to the right certificate, e.g.

<VirtualHost 10.10.10.2:443>
    SSLCertificateKeyFile /some/key/file
    SSLCertificateFile /some/cert/file
    .
    .
</VirtualHost>

<VirtualHost 10.10.10.3:443>
    SSLCertificateKeyFile /some/other/key/file
    SSLCertificateFile /some/other/cert/file
    .
    .
    .
</VirtualHost>

- Julian

-- 
Julian C. Dunn, B.A.Sc.   <[email-masked]>
Senior Software Developer, VerticalScope Inc.
111 Peter St., Suite 700, Toronto, ON
Tel: (416) 341-8950 x236  Fax: (416) 341-8959

istream >> ostream >> "We all scream for ice cream";

---

From: Joe Auty <[email-masked]>
Date: Fri, 18 Jan 2002 11:47:42 -0500 (EST)

> ports - name-based VHs don't work.

I see....

Have you ever setup more than one SSL VH using more than one IP on the
same machine and gotten this to work?

I've set my DNS to point to cert2 with an IP address ending in '.115', and
cert1 ends with '.114'.

My virtual hosts in httpd.conf are setup as following:

<VirtualHost IP.114:443>
Pathtocert1
Servername server.com
</VirtualHost>

<VirtualHost IP.115:443>
Pathtocert2
Servername joe.server.com
</VirtualHost>

The results are, again, going to joe.server.com gives the same certificate
as just going to server.com. Of course, I have two IP addresses designated
to the same machine (.114 and .115).

Am I on the right track?

---

From: Owen Boyle <[email-masked]>
Date: Fri, 18 Jan 2002 17:56:37 +0100

> to the same machine (.114 and .115).

Kind of - you don't need to define SServerName since the IP address does
the defining. You get the selection in the browser - i.e.
https://ip.114/ and http://ip.115/ should go to the different hosts...

Rgds,

Owen.

---

From: Joe Auty <[email-masked]>
Date: Fri, 18 Jan 2002 12:52:21 -0500 (EST)

> https://ip.114/ and http://ip.115/ should go to the different hosts...

You mean the browser takes the domain name from the browser, does a DNS
lookup, and equates this to the IP, and because the IPs are differnet in
my example, the Servername is not necessary?

What if I wanted to setup something like the following:

<VirtualHost IP.114:443>
pathtocert1
Servername joe.com
DocumentRoot /home/joe
</VirtualHost>

<VirtualHost IP.114:443>
pathtocert1
Servername auty.com
DocumentRoot /home/auty
</VirtualHost>

Because the IP is now ambigious, I'm assuming the Servername is required
unless I used the NameVirtualHost * convention (which I haven't really
gotten working with SSL in my brief attempts)?

This (the above) seems to work as expected, although when I do a apachectl
startssl I get an error message about the one taking precident over the
other... the error message doesn't seem to affect any usage, it seems to
work fine. Am I right? If not, is there a way to get around the error?

---

From: Owen Boyle <[email-masked]>
Date: Mon, 21 Jan 2002 10:02:25 +0100

> my example, the Servername is not necessary?

Yes - kind of... The browser always does a DNS lookup of the name you
type in. That's how it knows which IP address to send the request to
(TCP/IP only cares about IP addresses). The distinction comes in the
server. If you have two different VHs on different IPs then it is easy
for the server to distinguish them. You can put ServerName into these
VHs if you like, but, with the IP address, apache has enough to decide
which VH to use.

If you wanted to have more than one name-based VH on each IP address
then you'd need the ServerNames again.

> gotten working with SSL in my brief attempts)?

You missed the point of a previous mail - you can't have name-based SSL
VHs. It doesn't work. It's impossible.

> work fine. Am I right? If not, is there a way to get around the error?

It "seems to work" because you are using the same certificate for both
VHs. What is happening is accidental behaviour - the server uses the
certificate from the first VH to establish the SSL session. Since the
session is now established, it can see the full HTTP header and so can
use the "Host:" field to determine which VH to use. 

This setup "works" if you don't care what certificate your VHs use but
since authentication is as important as encryption in SSL, it is not a
general solution. If you can spare the IP addresses, the correct way to
proceed is with separate IP-based SSL VHs on each IP address. For
non-SSL VHs, you can put as many as you like on each IP address so long
as you put NameVirtualHost and define ServerName in each one. It breaks
down like this:

SSL VHs

- must be IP-based or Port-based (name-based doesn't work).
- only one per IP/port.
- if you use conventional port 443, only one per IP address.
- ServerName is redundant (no harm if you use it - it is just ignored)
- NameVirtualHost meaningless

non-SSL VHs

- Can be IP, port or name-based
  If name-based:
- Unlimited number of name-based VHs per IP
- needs NameVirtualHost
- needs ServerName in each VH

If you have many non-SSL VHs and one SSL VH on a particular IP, it is
good idea to define the port on the NameVirtualHost directive, e.g.

NameVirtualHost 192.168.1.1:80

This suppresses a warnign about mixing SSL and non-SSL.

Rgds,
Owen Boyle.