Subject: RE: SSL and vhosts

From: David Marshall <[email-masked]>
Date: Fri, 5 Apr 2002 08:45:33 -0800

After Apache 1.3.19 (I believe) name-based virtual hosts work with SSL and
get the right certificate if

a. each name-based host has a unique ip address
   An easy way to do this is to multihome a nic.
b. Traffic for the host comes in with the right ip address
   I Mention this if you are using firewalls and address translation.
b. If using a passphrase, all certificates need to use the same passphrase. 

I have been using this with Stronghold 3 build 3014 and higher. StrongHold
is RedHat's Apache/Mod_SSL package.

David Marshall

-----Original Message-----
From: Hunt,Keith A [mailto:[email-masked]]
Sent: Friday, April 05, 2002 8:20 AM
To: [email-masked]
Subject: SSL and vhosts

Please pardon me if this is a dumb question.  I have read that SSL and
name-based vhosts cannot be done, yet I set it up and it seems to be working
OK, apart from the expected complaints about mismatched host name and server
certificate.  Am I missing something?  I am running Apache 1.3.23 and modssl
2.8.7. on Linux

Keith Hunt  330.972.2968  [email-masked]
Internet & Server Systems
The University of Akron 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Hunt,Keith A" <[email-masked]>
Date: Fri, 5 Apr 2002 11:53:01 -0500

Hmmm.  I am only using a single IP address.  If I was going to use separate IP addresses, then I wouldn't be using name-based vhosts.

> From: David Marshall [mailto:[email-masked]]
> Sent: Friday, April 05, 2002 11:46 AM
> To: [email-masked]'
> Subject: RE: SSL and vhosts
> 
>

---

From: David Marshall <[email-masked]>
Date: Fri, 5 Apr 2002 09:01:16 -0800

Then you are going to continue to get the certificate warnings as the
certificate will have to be the same for all vhosts. As result your users
will have the mismatched host and server complaints. At my shop, we would
say that is not working :).

David

-----Original Message-----
From: Hunt,Keith A [mailto:[email-masked]]
Sent: Friday, April 05, 2002 8:53 AM
To: [email-masked]
Subject: RE: SSL and vhosts

Hmmm.  I am only using a single IP address.  If I was going to use separate
IP addresses, then I wouldn't be using name-based vhosts.

---

From: "Hunt,Keith A" <[email-masked]>
Date: Fri, 5 Apr 2002 14:00:09 -0500

Ahhh, now I begin to understand.  I was incorrectly thinking the secure channel just could not be established.  You say it is established but defaults to using the first certificate it can find.  That would mean I can forget about my next step, which would have been to try different certificates for different hosts.  I can either live with the name mismatch, or use IP-based VHosts.

Thanks for your help, Jeff.  I did look in the archives, but either you have explained it better or else the explanations have finally started to sink in.

> From: Jeff [mailto:[email-masked]]
> Sent: Friday, April 05, 2002 12:49 PM
> Subject: Re: SSL and vhosts
> 
> 
> Keith,
> 
> Perhaps it would be better to say "Name-based VHosts will not work
> correctly or as expected"..
> If you search the archives, you will find this has been 
> brought up many
> times and some very good explanations..
> 
> Basically, the securing of the channel between browser and 
> server is done
> BEFORE any HTTP request is sent to the server - so it is 
> impossible for the
> server to know which name-based VHost you actually want (it 
> will use the
> certificate for the first NBVH)
> However, after the channel is secured, then the HTTP request 
> is sent, and
> the server can identify which NBVH you want and reply appropriately..
> 
> Naturally, it is impossible for the certificate of the first 
> NBVH to match
> more than one NBVH, so users access any other NBVH will always get a
> certificate/server name mismatch..
> 
> Only option for it to work correctly is to use different IP/Port
> combinations for each SSL-required VHost
> 
> Rgds
> Jeff
> 
> ----- Original Message -----
> From: "Hunt,Keith A" <[email-masked]>
> To: <[email-masked]>
> Sent: Saturday, April 06, 2002 3:21 AM
> > Well, that all depends on what one is trying to accomplish 
> -- this case
> is for a known, limited, internal user population.  As I 
> said, the mismatch
> between host names and cert names is expected at this point.  
> Heck, the
> cert I am using doesn't match the box at all, let alone the 
> vhost name.
> This is still a test machine.  My next step would be to see 
> if separate
> certs could be used for separate vhosts and eliminate the 
> mismatched name
> problem.  I haven't decided whether that is even very important for my
> purposes.
> >
> > What is perplexing to me is not the mismatched names issue, 
> but rather
> why this works at all when everything I have read says it 
> won't.  That is,
> it won't work at all in the sense that the encrypted 
> connection cannot be
> established because of the sequence things are done in the handshake.
> >
> <snipped>