Subject: problem installing cert on virtual host

From: Dan McComb <[email-masked]>
Date: Fri, 14 Mar 2003 16:20:26 -0800

I've successfully installed one virtual host on my server to listen on  
port 443, and it's been running great. But when I added another virtual  
host directive to listen on same port further down in the file, I find  
that the first listener is the one that "picks up" the request. This  
results in an error in IE: "the identity certificate name is not  
correct." If I comment out the first virtual host, the problem  
disappears and the second one works fine. I need them to work  
together...

Anyone know how can I configure my virtual hosts/httpd.conf to avoid  
this problem?

/dan mccomb

------------------------------------------------------------------------ 
------------

Visual Contact
311 First Ave. S, Suite 200
Seattle, WA 98104

206.223.0417 Office
206.718.5361 Cell

[email-masked]
http://www.visualcontact.com

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: [email-masked]
Date: Fri, 14 Mar 2003 14:58:38 -1000

> Anyone know how can I configure my virtual hosts/httpd.conf to avoid  

Hi - I'm new to mod_ssl, but have just successfully
done what you are describing. Can you post
the pertianant part of you httpd.conf?

Also - do you point to each servers' certificate
and private key within each vhost with the
SSLCertuficateFile and
CCLCertificateKeyFile directives?

Aloha => Beau;

---

From: Dan McComb <[email-masked]>
Date: Fri, 14 Mar 2003 17:14:01 -0800

Thanks Beau,

Here's the pertinent bits (this file may look a bit strange -- it's a  
Mac OS X Server conf file, but functions in almost every way like  
traditional http.conf file):

#<RAdmin 159>
NameVirtualHost 63.231.43.185:443
Listen 63.231.43.185:443
<VirtualHost 63.231.43.185:443>
ServerName ncascades.org
#WebPerfCacheEnable Off
#SiteAutomaticallyDisabled Off
ServerAdmin [email-masked]
DocumentRoot "/Volumes/Bigone/Accounts/nci/Sites"
DirectoryIndex index.html index.ldmx
CustomLog "/Volumes/Bigone/Accounts/nci/Logs/access_log" combined
ErrorLog "/Volumes/Bigone/Accounts/nci/Logs/error_log"
<IfModule mod_ssl.c>
SSLEngine On
SSLLog "/private/var/log/httpd/ssl_engine_log"
#SSLCertificateChainFile "/private/etc/httpd/ssl.crt/ca.crt159"
SSLCertificateFile "/private/etc/httpd/ssl.crt/server.crt159"
SSLCertificateKeyFile "/private/etc/httpd/ssl.key/server.key159"
SSLCipherSuite "RSA:-HIGH:-MEDIUM:-LOW:+EXP"
#SSLPassPhrase ncascades.org:443 "blahblah"
</IfModule>
<IfModule mod_dav.c>
DAVLockDB "/private/var/run/davlocks/.davlock159"
DAVMinTimeout 600
</IfModule>
<Directory "/Volumes/Bigone/Accounts/nci/Sites">
Options All +MultiViews +ExecCGI -Indexes
AllowOverride All
<IfModule mod_dav.c>
DAV Off
</IfModule>
</Directory>
#<Realm 1>
<Directory "/Volumes/Bigone/Accounts/nci/Sites">
AuthName "ncascades.org"
AuthType Basic
<Limit PUT DELETE PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
Require no-user
</Limit>
</Directory>
#</Realm>
</VirtualHost>
#</RAdmin>

#<RAdmin 160>
#NameVirtualHost 63.231.43.185:443
#Listen 63.231.43.185:443
<VirtualHost 63.231.43.185:443>
ServerName www.pacific-papers.com
#WebPerfCacheEnable Off
#SiteAutomaticallyDisabled Off
ServerAdmin [email-masked]
DocumentRoot "/Volumes/Bigone/Accounts/pacific_paper/Sites"
DirectoryIndex index.html index.ldmx
CustomLog "/Volumes/Bigone/Accounts/nci/Logs/access_log" combined
ErrorLog "/Volumes/Bigone/Accounts/nci/Logs/error_log"
<IfModule mod_ssl.c>
SSLEngine On
SSLLog "/private/var/log/httpd/ssl_engine_log"
#SSLCertificateChainFile "/private/etc/httpd/ssl.crt/ca.crt160"
SSLCertificateFile "/private/etc/httpd/ssl.crt/server.crt160"
SSLCertificateKeyFile "/private/etc/httpd/ssl.key/server.key160"
SSLCipherSuite "RSA:-HIGH:-MEDIUM:-LOW:+EXP"
#SSLPassPhrase www.pacific-papers.com:443 "blahblah"
</IfModule>
<IfModule mod_dav.c>
DAVLockDB "/private/var/run/davlocks/.davlock160"
DAVMinTimeout 600
</IfModule>
<Directory "/Volumes/Bigone/Accounts/pacific_paper/Sites">
Options All +MultiViews +ExecCGI -Indexes
AllowOverride All
<IfModule mod_dav.c>
DAV Off
</IfModule>
</Directory>
#<Realm 1>
<Directory "/Volumes/Bigone/Accounts/pacific_paper/Sites">
AuthName "www.pacific-papers.com"
AuthType Basic
<Limit PUT DELETE PROPFIND PROPPATCH MKCOL COPY MOVE LOCK UNLOCK>
Require no-user
</Limit>
</Directory>
#</Realm>
</VirtualHost>
#</RAdmin>

Visual Contact

206.223.0417 Office
206.718.5361 Cell

[email-masked]

---

From: [email-masked]
Date: Fri, 14 Mar 2003 20:47:41 -1000

On 14 Mar 2003 at 17:14, Dan McComb wrote:

> [...]
> > [...]

Hi -

I see nothing wrong with your conf file. I have some
suggestions:

* since your SSL servers work one at a time, perhaps
this is not an SSL problem. Remember, the first
vhost is the 'default': any request that does
not match a name (within that ip:port group)
is sent to that first server. Why don't you comment
out the SSL directives, change the ports to 80,
and see if you can browse to each vhost?

* in the same vein, is you bind (dns) server setup
OK?

* you may want to look at each server cert:

openssl rsa -noout -text -in <whetever>.crt

the subject CN should match the server name.

* if you certs are self-signed, your browser
will give you an error - that the CA is not
recognized as trusted - but everything else
should be OK if your CN matches the server
name.

Let me know how it goes...

Aloha => Beau;

---

From: "Jeff" <[email-masked]>
Date: Sat, 15 Mar 2003 17:12:20 +1000

Actually, the answer is RTFM..

You can not have multiple SSL vhosts responding to one IP/port
combination..  The FIRST SSL vhost will ALWAYS respond when making the
connection.. This is due to how the protocol works..

Refer http://marc.theaimsgroup.com/?l=apache-modssl&m=98576871506980&w=2
for more info

Rgds
Jeff

---

From: [email-masked]
Date: Fri, 14 Mar 2003 22:51:58 -1000

> Refer http://marc.theaimsgroup.com/?l=apache-modssl&m=98576871506980&w=2

Thanks Jeff - upon redoing my tests I found that
I was getting the first 443 server also; I found
the info here:

http://httpd.apache.org/docs-
2.0/ssl/ssl_faq.html#vhosts

Aloha => Beau;

---

From: "R. DuFresne" <[email-masked]>
Date: Sat, 15 Mar 2003 09:28:31 -0500 (EST)

If this is tough to get into the FAQ, being it is asked weekly, perhps it
can be added to the footer of list messages?

Thanks,

Ron DuFresne

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!

---

From: Dan McComb <[email-masked]>
Date: Sat, 15 Mar 2003 16:04:38 -0800

Thanks Beau and Jeff for your help in resolving this.

I was able to get it working very quickly by assigning the second  
virtual host to listen on another port number.

Best,

/dan

On Friday, March 14, 2003, at 11:12  PM, Jeff wrote:

> Refer  
> http://marc.theaimsgroup.com/?l=apache-modssl&m=98576871506980&w=2
> for more info
>
> Rgds
> Jeff
>
>>> --------------------------------------------------------------------- 
>>> -
>>>>> --
>>>>> ------------
>>>>>
>>>> [...]
>>
>> Hi -
>>

Visual Contact

206.223.0417 Office
206.718.5361 Cell

[email-masked]