Subject: Illegal attempt to re-initialise SSL for server

From: [email-masked] (Domenico Andreoli)
Date: Sat, 1 Mar 2003 16:27:53 +0100

hi,

i'm able to get this error message with the following configuration
file fragment put in the global context:

---------------- CUT HERE ------------------------------
# ...
SSLEngine on
SSLCertificateFile /etc/apache/ssl.crt/server.crt
SSLCertificateKeyFile /etc/apache/ssl.key/server.key

<VirtualHost _default_:*>
</VirtualHost>
# ...
---------------- CUT HERE ------------------------------

without any VirtualHost diretive apache starts correctly with SSL on
every port it listens to.

as soon as i insert a VirtualHost directive, even if empty, apache
doesn't start and i get the error message in subject.

if i put the SSL directive into a VirtualHost everything works as usual.

i can reproduce it with different configuration files.

any advice?

thanks
cavok

-----[ Domenico Andreoli, aka cavok
 --[ http://filibusta.crema.unimi.it/~cavok/gpgkey.asc
   ---[ 3A0F 2F80 F79C 678A 8936  4FEE 0677 9033 A20E BC50

---

From: Cliff Woolley <[email-masked]>
Date: Sat, 1 Mar 2003 10:59:33 -0500 (EST)

> ---------------- CUT HERE ------------------------------

It ought to look like this:

<VirtualHost foo:443>
SSLEngine on
SSLCertificateFile ...
SSLCertificateKeyFile ...
</VirtualHost>

Note that your use of the certificate and key across all virtual hosts,
whether by putting it in the server-wide config or by putting it in
VirtualHost _default_:*, won't generally work.  Your clients will get
errors when they try to browse to your site if the hostname doesn't match
the one stored in the certificate, for example.  You should have a
different certificate/key pair for every hostname on which you wish to run
SSL.  And of course each of those virtual hosts needs to be on a unique
IP:port pair--no name-based virtual hosting.

--Cliff
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked] (Domenico Andreoli)
Date: Sat, 1 Mar 2003 17:21:41 +0100

> IP:port pair--no name-based virtual hosting.
right right. this is not a issue because this configuration has not
any sense.

many thanks
cavok

ps: may i quote your message? i'd like to include your reply to who reported
the original problem (debian bug report #169083).

---

From: Cliff Woolley <[email-masked]>
Date: Sat, 1 Mar 2003 11:14:42 -0500 (EST)

On Sat, 1 Mar 2003, Domenico Andreoli wrote:

> ps: may i quote your message? i'd like to include your reply to who
> reported the original problem (debian bug report #169083).

Sure!  It's a public list after all.  :)

--Cliff

---------------------------------------------------------------------
   Cliff Woolley
   Apache HTTP Server Project
   Apache Software Foundation
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]