Subject: Multiple SSL VirtualHosts in apache

From: Steve Pirk <[email-masked]>
Date: Wed, 5 Feb 2003 17:01:36 -0800 (PST)

I check the mail archives, but could not find a good
answer for this "problem" I am having.

I am building out a dev environment using apache
on Solaris. The dev environment needs to run under
SSL (to simulate the production environment). I am
starting with 4 virtual servers. They all use the
same cert file, but are on different ports.

The problem I am running into is that only the "first"
VirtualHost works. Requests to subsequent ports result
in a mod_ssl:error:HTTP-request error. Here is the error_log
entry:

[Wed Feb  5 16:45:11 2003] [error] mod_ssl: SSL handshake failed: HTTP
spoken on HTTPS port; trying to send HTML error page (OpenSSL library
error follows)
[Wed Feb  5 16:45:11 2003] [error] OpenSSL: error:1407609C:SSL
routines:SSL23_GET_CLIENT_HELLO:http request [Hint: speaking HTTP to HTTPS
port!?]

This is being used in conjunction with an auth package,
but the redirect after logging in is https://

Does anyone knnow of a good way to have multiple
SSL virtual servers on one apache instance?

Here is a sample of httpd.conf. In this case, port 7000
works, but 7001 and 7002 get the mod_ssl error.

  <VirtualHost 172.16.202.25:7000>
    DocumentRoot        /some/doc/root
    SSLEngine on
    SSLCertificateFile    /usr/local/apache/certs/my_cert.crt
    SSLCertificateKeyFile /usr/local/apache/certs/my_cert.key
  </VirtualHost>

  <VirtualHost 172.16.202.25:7001>
    DocumentRoot        /some/doc/root
    SSLEngine on
    SSLCertificateFile    /usr/local/apache/certs/my_cert.crt
    SSLCertificateKeyFile /usr/local/apache/certs/my_cert.key
  </VirtualHost>

  <VirtualHost 172.16.202.25:7002>
    DocumentRoot        /some/doc/root
    SSLEngine on
    SSLCertificateFile    /usr/local/apache/certs/my_cert.crt
    SSLCertificateKeyFile /usr/local/apache/certs/my_cert.key
  </VirtualHost>

--
Steve (egrep)
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "R. DuFresne" <[email-masked]>
Date: Wed, 19 Feb 2003 10:19:36 -0500 (EST)

The error you posted from logs implies the request the server is getting
is http rather then https, perhaps your  redirect or rewrite is not
functioning properly?

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: Cliff Woolley <[email-masked]>
Date: Wed, 19 Feb 2003 10:26:45 -0500 (EST)

On Wed, 5 Feb 2003, Steve Pirk wrote:

> They all use the same cert file, but are on different ports.

I'm not so sure you can do that.  But anyway, assuming for a second that

> in a mod_ssl:error:HTTP-request error. Here is the error_log

Interesting.  What version of Apache is this?  If 1.3.x, what version of
mod_ssl?  The mod_ssl:error:HTTP-request thing is supposed to be purely
internal; if it ever leaks out to the client, something is screwed up.  I
found some odd cases a while back where you could set up redirections in
an odd way and it would do that, but I've forgotten the details and would
have to dig them up.  What redirects are you doing?  Any rewriterules?

--Cliff

---

From: Steve Pirk <[email-masked]>
Date: Wed, 19 Feb 2003 14:31:01 -0800 (PST)

Yeah, we had it slightly misconfigured. Now that I think
about it, I cannot remember the exact fix. I will look
over the httpd.conf file.

Thanks!
--
Steve (egrep)