Subject: 2 VirtualHosts with 2 Certificates

From: "toxshark" <[email-masked]>
Date: Wed, 8 Jan 2003 19:58:10 +0100

i have the apache configured with 2 VirtualHosts on port 443.
both VirtualServers have separately CertificateFiles and
CertificateKeyFiles.
but now if i connect to the VirtualHost2, the Host have the Certificate
from the VirtualServer1!
both Hosts have now the same Certificate.
 
my httpd.config: 
 
... 
NameVirtualHost 92.35.28.17:443 
 
<VirtualHost 92.35.28.17:443> 
ServerName domain1.com 
ServerAlias www.domain1.com 
DocumentRoot "/web1/" 
SSLEngine on 
SSLCertificateFile /usr/local/etc/apache/key/ssl1.cert 
SSLCertificateKeyFile /usr/local/etc/apache/key/ssl1.key 
</VirtualHost> 
 
<VirtualHost 92.35.28.17:443> 
ServerName domain2.com 
ServerAlias www.domain2.com 
DocumentRoot "/web2/" 
SSLEngine on 
SSLCertificateFile /usr/local/etc/apache/key/ssl2.cert 
SSLCertificateKeyFile /usr/local/etc/apache/key/ssl2.key 
</VirtualHost>
...

---

From: Mads Toftum <[email-masked]>
Date: Wed, 8 Jan 2003 20:28:58 +0100

> both Hosts have now the same Certificate.
A classical FAQ - http://www.modssl.org/docs/2.8/ssl_faq.html#vhosts
you need different ip's or different ports.

vh

Mads Toftum
-- 
`Darn it, who spiked my coffee with water?!' - lwall

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Dave Paris <[email-masked]>
Date: Wed, 8 Jan 2003 15:00:38 -0500

Per all the documentation and countless examples in the archives of 
this mail list, you must either use two different IPs or use different 
ports.  You *cannot* used Named Virtual Hosts for SSL.  Period.

-dsp

On Wednesday, Jan 8, 2003, at 13:58 US/Eastern, toxshark wrote:

> ihave the apache configured with 2 VirtualHosts on port 443.
>
> bothVirtualServers have separately CertificateFiles and 
> CertificateKeyFiles.
>
> butnow if i connect to the VirtualHost2, the Host have the Certificate 
> from the VirtualServer1!
>
> bothHosts have now the same Certificate.
>
>  
>
> myhttpd.config:
>
>  
>
> ...
>
> NameVirtualHost92.35.28.17:443
>
>  
>
> ServerNamedomain1.com
> ServerAliaswww.domain1.com
>
> DocumentRoot"/web1/"
>
> SSLEngineon
>
> SSLCertificateFile/usr/local/etc/apache/key/ssl1.cert
>
> SSLCertificateKeyFile/usr/local/etc/apache/key/ssl1.key
>
> </VirtualHost>
>
>  
>
> ServerNamedomain2.com
> ServerAliaswww.domain2.com
>
> DocumentRoot"/web2/"
>
> SSLEngineon
>
> SSLCertificateFile/usr/local/etc/apache/key/ssl2.cert
>
> SSLCertificateKeyFile/usr/local/etc/apache/key/ssl2.key
>
> </VirtualHost>
>
> ...
>
>  
>

---

From: James Barwick <[email-masked]>
Date: Thu, 09 Jan 2003 05:29:47 +0800

Should have read the MOST FREQUENTLY ASKED FREQUENTLY ASKED QUESTIONS!!!

Can't do that.  Learn a little more about SSL.  It's IP based, not name 
based.  So, you can only have
one certificate and one firtual host on 92.35.28.17:443.  Sorry...but 
that's the way it goes.

Same question answer number four billion six hundred seventeen million 
two hundred thirty-four thousand nine hunderd twenty-four!

;)

JDB

toxshark wrote:

> but now if i connect to the VirtualHost2, the Host have the 
> Certificate from the VirtualServer1!
>

---

From: "Irving Carrion" <[email-masked]>
Date: Thu, 9 Jan 2003 09:41:54 -0500

Everyone knows this question will not stop coming... is it possible to
return an error message to the user when restarting apache?  Only a
suggestion....  =)

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of James Barwick
Sent: Wednesday, January 08, 2003 4:30 PM
To: [email-masked]
Subject: Re: 2 VirtualHosts with 2 Certificates

;)

JDB

---

From: James Collier <[email-masked]>
Date: Mon, 13 Jan 2003 10:36:38 +1300

> return an error message to the user when restarting apache?  Only a
Please DON'T do this.

Confession time. I actually have a use for NBVHs with SSL, and I'd 
prefer not to have it broken gratuitously.

I run a site whose members collaborate using a number of Web-based 
tools.  All members are issued with client certificates signed by our 
private CA, and I have a single instance of Apache+mod-ssl with a single 
IP address acting as an SSL-only reverse-proxy for these tools.

Some parts of the site have varying authorisation policy rules, and some 
of the proxied tools assume that they own the root of the site and can't 
cope with explicit ports in URLs.  For these reasons, it is convenient 
to split the site into multiple NBVHs.

These NBVHs are all derived off the same 3rd-level domain, and thus we 
can use the same wildcard certificate for each NBVH (users whose 
browsers don't recognise wildcard certificates need only placate the 
browser once in most cases).

This set-up has been working for over two years now, but I do 
occasionally have wakeful nights wondering if someone will break this 
counter-documented capability.

I realise I am on thin ice as it would be a "reasonable" optimisation to 
assign the final virtual host at an earlier stage than is currently the 
case with SSL.

Am I on my own here?

---

From: "Barry Smoke" <[email-masked]>
Date: Sun, 12 Jan 2003 21:23:27 -0600

>browser once in most cases).

o.k...you have my attention now...
wildcard certificate?
Can wildcard certificates be purchased, or is this only if you are self
signing?

I sure would like to buy one certificate, and have all my subdomains on
my main domain recognize it without a warning window popping up for
internet customers...

https://arhosting.com
https://www.arhosting.com
https://secure.arhosting.com
https://www.secure.arhosting.com

I would like to cover all of my bases with one certificate...
Is this possible?

---

From: Mads Toftum <[email-masked]>
Date: Mon, 13 Jan 2003 10:36:05 +0100

> Can wildcard certificates be purchased, or is this only if you are self
According to Thawte's website they still issue wildcard certs.

> my main domain recognize it without a warning window popping up for
YMMV - some versions of MSIE does not accept wildcard certs because M$ 
decided to stop doing that for a couple of releases.

> I would like to cover all of my bases with one certificate...
*arhosting.com should probably do it.

vh

Mads Toftum