Subject: Re: virtual hosting and ssl

From: Michael Grant <[email-masked]>
Date: Mon, 6 May 2002 22:20:19 +0200 (MEST)

> While we're on this topic...
> Owen Boyle wrote .... on 01.03.26 
> 
> "This question comes up so often it ought to be in the .sig of the list... ", and 
> this ends with "Use different port numbers for different SSL hosts".
> 
> I personally don't know what the .sig would mean, but the last comment 
> intriques me.  
> 
> By using different IP ports ... might something like the following work?
> For example:

I have made this work, however there are drawbacks to this solution.

1) you need at least 2 certs, one for the virtual hosting server and
the second one for the client (in our example, server.cert and
acme.com.cert).  If you used self-signed certs, the user is asked
TWICE to accept the cert, one for the server.cert and secondly for the 
acme.com cert.

2) when you contact https://acme.com, what you end up with in the
browser's location is actually "https://acme.com:8443".  If someone
bookmarks this and you rearrange your port numbers, they're screwed.

<VirtualHost 192.168.1.1:443>
        ServerAdmin [email-masked]
        ServerName acme.com
	Redirect / https://acme.com:8443
        SSLCertificateFile /path/to/original/server.cert 
        SSLCertificateKeyFile /path/to/original/server.key
</VirtualHost>

<VirtualHost 192.168.1.1:443>
        ServerAdmin [email-masked]
        ServerName perigee.com
	Redirect / https://perigee.com:8444
        SSLCertificateFile /path/to/original/server.cert 
        SSLCertificateKeyFile /path/to/original/server.key
</VirtualHost>

<VirtualHost 192.168.1.1:8443>
        ServerAdmin [email-masked]
        ServerName acme.com
        DocumentRoot /var/www/acme.com
        SSLCertificateFile /path/to/original/acme.com.cert 
        SSLCertificateKeyFile /path/to/original/acme.com.key
</VirtualHost>

<VirtualHost 192.168.1.1:8444>
        ServerAdmin [email-masked]
        ServerName perigee.com
        DocumentRoot /var/www/perigee.com
        SSLCertificateFile /path/to/original/perigee.com.cert 
        SSLCertificateKeyFile /path/to/original/perigee.com.key
</VirtualHost>

By the way, in putting this email together, I actually tried this on
my server (with different names).  One thing I did not get working was 
using this in conjunction with VirtualDocumentRoot like this:

(replace first 2 virtual hosts above with this)
<VirtualHost 192.168.1.1:443>
        ServerAdmin [email-masked]
        ServerName server.com
	VirtualDocumentRoot /www/%0
	Redirect /www/acme.com https://acme.com:8443
	Redirect /www/perigee.com https://perigee.com:8444
        SSLCertificateFile /path/to/original/server.cert 
        SSLCertificateKeyFile /path/to/original/server.key
</VirtualHost>

I could never get this to follow the redirects.

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Michael Grant <[email-masked]>
Date: Mon, 6 May 2002 23:24:58 +0200 (MEST)

> I have made this work, however there are drawbacks to this solution.

Grrr, I take it back, I can't reproduce it now.  I still get the "name 
check, site name does not match certificate" warning before it follows 
the redirect.

---

From: Nisarg Rav <[email-masked]>
Date: Mon, 6 May 2002 21:44:43 -0700 (PDT)

ya one thing to say ..

have u enabled following directive for those all domains 

SetEnvIf User-Agent ".*MSIE.*" \
         nokeepalive ssl-unclean-shutdown \
         downgrade-1.0 force-response-1.0	
and then try

hth 

--- Michael Grant <[email-masked]> wrote:
>I've been playing around with the apache and our virtual hosts.  I am
>well aware that I could have different certs for each IP address if I
>were using IP based virtual hosting but I'm using name based virtual
>hosts.
>
>I host a variety of domains which are not at all subdomains of my main 
>domain.  What I would like to do is have one cert for all my domains.
>
>I sort of have it working with name based virtual hosting, but in some
>cases, I get the following warning in Internet Explorer:
>
>"The name on the security certificate does not match the name of the
>site."
>
>It appears that some web browsers, Netscape for example, support a *
>as a wild card in the CN.  For example CN=*grant.org.  There's also
>some talk on Microsoft's web site of some versions of IE supporting
>this too.  Though, apparently not 5.01 running on windows 98 or me. 
>
>The cases seem to be:
>
>1) I generate a cert with CN=grant.org.  No complaints when I connect
>to https://grant.org.  Both Netscape & IE complain if I connect to
>www.grant.org or any other of my domains.
>
>2) I generate a cert with CN=*grant.org.  No complaints when I connect 
>to https://www.grant.org or https://grant.org from Netscape.  IE
>complains that the name is incorrect.  I can import the self-signed
>cert into both IE's and Netscape's trusted root ca list.
>
>3) I generate a cert with CN=*.  No complaints when I connect to any
>of my domains with Netscape, however IE complains that the name is
>incorrect.  I can import the self-signed cert into Netscape's trusted
>root ca list but NOT IE's.
>
>Can someone tell me if there is a right way to generate a cert that
>works with more than one site with the various different browsers out
>there? 
>
>Michael Grant

_____________________________________________________________
Want a new web-based email account ? ---> http://www.firstlinux.net

_____________________________________________________________
Promote your group and strengthen ties to your members with [email-masked] by Everyone.net  http://www.everyone.net/?btn=tag
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]