Subject: mod-ssl Virtual Hosts

From: "Irving Carrion" <[email-masked]>
Date: Fri, 8 Nov 2002 13:30:55 -0500

Hello All!

Just recently I was able to get this mod-ssl library working on Apache.
It is working just fine.  Much thanks to the developer team.

Anyway my question is...

Currently I use name-based virtual hosts for all of our websites.

http://domain1.com
http://domain2.com

We would like to have the ability to get each domain a https address as
well like...

https://domain1.com
https://domain2.com

What would be the best method of tackling this, since mod-ssl doesn't
support name-based virtual host?

I've thought of using IP Based virtual host, but there isn't enough
static ip's to go around.  I've also thought of using
proxypass/proxyreverse to point it to an internal static ip.  Am I on
target with this?

I would really appreciate any help or suggestions ANYONE can provide.

Thanks!
IRV

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Dave Paris <[email-masked]>
Date: Fri, 8 Nov 2002 19:04:57 +0000

a) you could try surfing the archives of this list since an arguable 
10% of the traffic is either this exact question or directly relates to 
it.
b) you could use different ports
c) you could use different IPs.  they're not *that* rare .. and .. it 
could be sanely argued that if you've got content important enough to 
protect using SSL, the cost of "using up" an IP is just part of the 
cost of making that _important_ information accessible.

-dsp

---

From: "Irving Carrion" <[email-masked]>
Date: Fri, 8 Nov 2002 14:59:35 -0500

Thanks for the reply.

According to the docs the following should work...

   <VirtualHost newvhost.domain.org:443>
   ... standard directives such as DocumentRoot, Logfile, ErrorLog here
...
   <IfModule mod_ssl.c>
   SSLEngine on
   SSLCertificateFile    /etc/apache/ssl.crt/server.crt
   SSLCertificateKeyFile /etc/apache/ssl.key/server.key
   SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
   </IfModule>
   </VirtualHost>

Now when I add another one like this 

   <VirtualHost ANOTHER.domain.org:443>
   ... standard directives such as DocumentRoot, Logfile, ErrorLog here
...
   <IfModule mod_ssl.c>
   SSLEngine on
   SSLCertificateFile    /etc/apache/ssl.crt/server.crt
   SSLCertificateKeyFile /etc/apache/ssl.key/server.key
   SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
   </IfModule>
   </VirtualHost>

Only the first domain works and the second does not.

So your saying to use ip based virtual host like this... 

   <VirtualHost 10.0.0.1:443>
   ... standard directives such as DocumentRoot, Logfile, ErrorLog here
...
   <IfModule mod_ssl.c>
   SSLEngine on
   SSLCertificateFile    /etc/apache/ssl.crt/server.crt
   SSLCertificateKeyFile /etc/apache/ssl.key/server.key
   SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
   </IfModule>
   </VirtualHost>

Is this correct?

Thanks!
IRV

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Dave Paris
Sent: Friday, November 08, 2002 2:05 PM
To: [email-masked]
Subject: Re: mod-ssl Virtual Hosts

-dsp