Subject: name-based vhost woes

From: Phil Hagen <[email-masked]>
Date: Tue, 1 Jan 2002 23:20:45 -0500 (EST)

Greetings!
	With the help of the mailing list archives, I've gotten SSL
transactions functional on one name-based vhost, and other non-SSL vhosts
working as well.  I understand that I can only have one port 443 server
name running on the machine.
	However, is it possible to have apache generate an error message
of some sort when trying to https:// to one of the non-SSL vhosts?  For
example consider the following configurations:
- - foo.com:80
- - foo.com:443
- - bar.com:80
- - bar.org:80
- - etc.

	With an http://foo.com, all works as expected, an https://foo.com
works properly, as do http://bar.com and http://bar.org.  However, when
entering https://bar.com or https://bar.org, I get a warning that the
server is offering a certificate for a differently-named server.  If I opt
to accept it anyway under NS, I get the contents of https://foo.com,
though the location bar shows https://bar.com.
	Is it possible to have an https request to the non-SSL vhosts get
killed without rolling over to the one SSL config?
	Thanks for the great support lists, and excellent code!

- -Phil Hagen

- -- 
http://identityvector.com/~phil/ (PGP Key, software, etc)
PGP key also at http://www.keyserver.net

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Rajidhar Etta" <[email-masked]>
Date: Wed, 2 Jan 2002 04:09:17 -0500

I can think of two solutions (not sure if whether both of them turns out
to be 'NOT ELIGENT' solutions)
1. 
Within the virtual host section of foo.com:443, you could do the
following:
SetEnvIfNoCase Host bar\.com bar
SetEnvIfNoCase Host bar\.org bar
(above sets two environment variable bar if the HTTP header Host field
contains bar.com OR bar.org). 
Then in your <Directory> section of DocumentRoot (say if it is /d1/d2 )
<Directory /d1/d2>
...
...
..
Allow from env!=bar
</Directory> Which actually blocks access to any page.... You can use
the above in <Location> Also. 

2. Use mod_rewrite  (RewriteCond which checks the HOST  & RewriteRule)
inside the virtualhost to  redirect to any error page. 

Rajidhar Etta 
eComServer, Inc 
609.951.8500 (x 192) 
609.203.3697 (Cell)

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Phil Hagen
Sent: Tuesday, January 01, 2002 11:21 PM
To: [email-masked]
Subject: name-based vhost woes

Greetings!
transactions functional on one name-based vhost, and other non-SSL
vhosts

	With an http://foo.com, all works as expected, an
https://foo.com
works properly, as do http://bar.com and http://bar.org.  However, when
entering https://bar.com or https://bar.org, I get a warning that the
server is offering a certificate for a differently-named server.  If I
opt
to accept it anyway under NS, I get the contents of https://foo.com,
though the location bar shows https://bar.com.
	Is it possible to have an https request to the non-SSL vhosts
get
killed without rolling over to the one SSL config?
	Thanks for the great support lists, and excellent code!

- -Phil Hagen

- --

---

From: Phil Hagen <[email-masked]>
Date: Sun, 6 Jan 2002 21:01:10 -0500 (EST)

Just to provide a follow-up, I was able to fix the original problem by
learning some rudimentary mod_rewrite stuff as suggested by a few.
Basically, this did the trick:

<VirtualHost IP:443>
...
	RewriteEngine On
	RewriteCond %{HTTP_HOST}	!secure.domain.dom
	RewriteRule ^/(.*)		http://%{HTTP_HOST}
...
</VirtualHost>
<VirtualHost IP:80>
	ServerName secure.domain.dom
	RewriteEngine On
	RewriteCond %{SERVER_PORT}	^80$
	RewriteRule ^/(.*)		http://domain.dom
</VirtualHost>

Result:  All https:// requests to other VHosts are redirected to their
http:// counterparts, and any http:// requests to the secure VHost are
sent to the unsecured main site.
I'm sure there is a more effective way to meet the ALWAYS_TRUE condition
done with SERVER_PORT above, but this one works for now.

Hope this helps someone in a similar position out!!

- -Phil Hagen

- --