Welcome to HostingForumz.com!
FAQFAQ      ProfileProfile    Private MessagesPrivate Messages   Log inLog in

Multiple SSL sites, Multiple IP Addresses

 
   Web Hosting Problem Solving Community! (Home) -> Apache RSS
Next:  allow user:pass in URL  
Author Message
Harvey Schmidlapp

External


Since: Nov 19, 2007
Posts: 2



(Msg. 1) Posted: Mon Nov 19, 2007 10:21 am
Post subject: Multiple SSL sites, Multiple IP Addresses
Archived from groups: alt>apache>configuration (more info?)

I've been running an Apache 2.0 server for a while with multiple name-
based virtual sites on port 80 and one SSL site on the same IP
address. I need to add a second SSL site and I'm having trouble with
the configuration. I have an available IP Address so that's not a
problem. In /etc/httpd/conf/httpd.conf I have these lines (among many
others, of course):

NameVirtualHost *:80
NameVirtualHost *:443

Then, in the /etc/httpd/conf.d/sslsite.conf file, I have this:

<VirtualHost *:80>
ServerName www.foobar.com
Redirect / http://www.foobar.com/
</VirtualHost>

<VirtualHost *:443>
DocumentRoot /path/to/foobar/docs
ServerName www.foobar.com:443
ServerAdmin hls.TakeThisOut@foobar.com
....

That's working right now.

When I tried to add a second SSL server, however, I get the same
certificate for both, (when I can get anything at all). What I'm
thinking is that the problem comes from the fact that although I have
two public IP Addresses, the router is converting them to the same
private address for use on the server.

To test this, I set everything back to the working (single SSL site)
state. Then I changed the <VirtualHost *:443> line above to
<VirtualHost 198.162.1.2:443>. When I restart apache now, it
complains that NameVirtualHost *:443 has no VirtualHosts but I figured
that's okay but maybe not. When I browse to the site, Firefox gives
me an error message saying:

www.foobar.com has sent an incorrect or unexpected message. Error
Code: -12263

So, that's not right. What should the VirtualHost line have in it?
The public IP Address behaves the same way (Error -12263).

So, first question -- Is the router and single private address at
least part of my problem? If so, I'll create a second for the other
site.

Second question -- What should my apache configuration file look like?

--
HHH

 >> Stay informed about: Multiple SSL sites, Multiple IP Addresses 
Back to top
Login to vote
Harvey Schmidlapp

External


Since: Nov 19, 2007
Posts: 2



(Msg. 2) Posted: Mon Nov 19, 2007 10:25 am
Post subject: Re: Multiple SSL sites, Multiple IP Addresses [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

On Nov 19, 1:21 pm, Harvey Schmidlapp <henryhart... RemoveThis @westat.com> wrote:
> To test this, I set everything back to the working (single SSL site)
> state. Then I changed the <VirtualHost *:443> line above to
> <VirtualHost 198.162.1.2:443>.

Doh! When I used 192.168.1.2 instead, which is the correct private
address, it worked. So, my guess is that I'd just add a second
private address and then set up static NAT to map the public IP
address for the second site to that. I'll try that. Sorry for the
bother. If this is wrong, feel free to jump in and correct me.

--
HHH

 >> Stay informed about: Multiple SSL sites, Multiple IP Addresses 
Back to top
Login to vote
phantom

External


Since: Aug 23, 2007
Posts: 66



(Msg. 3) Posted: Tue Nov 20, 2007 6:01 am
Post subject: Re: Multiple SSL sites, Multiple IP Addresses [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

"Harvey Schmidlapp" <henryhartley.TakeThisOut@westat.com> wrote in message
news:f27a7941-ea71-42b9-8e02-29990e318569@f3g2000hsg.googlegroups.com...
> I've been running an Apache 2.0 server for a while with multiple name-
> based virtual sites on port 80 and one SSL site on the same IP
> address. I need to add a second SSL site and I'm having trouble with
> the configuration. I have an available IP Address so that's not a
> problem. In /etc/httpd/conf/httpd.conf I have these lines (among many
> others, of course):
>
> NameVirtualHost *:80
> NameVirtualHost *:443
>
> Then, in the /etc/httpd/conf.d/sslsite.conf file, I have this:
>
> <VirtualHost *:80>
> ServerName www.foobar.com
> Redirect / http://www.foobar.com/
> </VirtualHost>
>
> <VirtualHost *:443>
> DocumentRoot /path/to/foobar/docs
> ServerName www.foobar.com:443
> ServerAdmin hls.TakeThisOut@foobar.com
> ...

You can only properly have one SSL site per IP address, so you need to throw
away any reference to *:443 and use something similar to the following:

NameVirtualHost 1.1.1.1:443
<VirtualHost 1.1.1.1:443>
....
</VirtualHost>

NameVirtualHost 1.1.1.2:443
<VirtualHost 1.1.1.2:443>
....
</VirtualHost>
 >> Stay informed about: Multiple SSL sites, Multiple IP Addresses 
Back to top
Login to vote
shimmyshack

External


Since: Apr 17, 2007
Posts: 88



(Msg. 4) Posted: Tue Nov 20, 2007 3:59 pm
Post subject: Re: Multiple SSL sites, Multiple IP Addresses [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

On Nov 20, 9:12 am, "phantom" <nob....DeleteThis@blueyonder.invalid> wrote:
> "Harvey Schmidlapp" <henryhart....DeleteThis@westat.com> wrote in message
>
> news:f27a7941-ea71-42b9-8e02-29990e318569@f3g2000hsg.googlegroups.com...
>
>
>
> > I've been running an Apache 2.0 server for a while with multiple name-
> > based virtual sites on port 80 and one SSL site on the same IP
> > address. I need to add a second SSL site and I'm having trouble with
> > the configuration. I have an available IP Address so that's not a
> > problem. In /etc/httpd/conf/httpd.conf I have these lines (among many
> > others, of course):
>
> > NameVirtualHost *:80
> > NameVirtualHost *:443
>
> > Then, in the /etc/httpd/conf.d/sslsite.conf file, I have this:
>
> > <VirtualHost *:80>
> > ServerName www.foobar.com
> > Redirect / http://www.foobar.com/
> > </VirtualHost>
>
> > <VirtualHost *:443>
> > DocumentRoot /path/to/foobar/docs
> > ServerName www.foobar.com:443
> > ServerAdmin h....DeleteThis@foobar.com
> > ...
>
> You can only properly have one SSL site per IP address, so you need to throw
> away any reference to *:443 and use something similar to the following:
>
> NameVirtualHost 1.1.1.1:443
> <VirtualHost 1.1.1.1:443>
> ...
> </VirtualHost>
>
> NameVirtualHost 1.1.1.2:443
> <VirtualHost 1.1.1.2:443>
> ...
> </VirtualHost>

theres info on how to generate multiple certs for a single ip address
here:
http://wiki.cacert.org/wiki/VhostTaskForce
http://www.cacert.org (which hasnt reached the status of a recognized
Certificate Authority, but is aiming to be included in browsers
soonish) can do it free
 >> Stay informed about: Multiple SSL sites, Multiple IP Addresses 
Back to top
Login to vote
D. Stussy

External


Since: Nov 01, 2007
Posts: 25



(Msg. 5) Posted: Wed Nov 21, 2007 12:24 pm
Post subject: Re: Multiple SSL sites, Multiple IP Addresses [Login to view extended thread Info.]
Archived from groups: per prev. post (more info?)

"shimmyshack" <matt.farey.DeleteThis@gmail.com> wrote in message
news:0d2bd90a-3ccd-4f2c-a369-50ad4a84a586@41g2000hsh.googlegroups.com...
> On Nov 20, 9:12 am, "phantom" <nob....DeleteThis@blueyonder.invalid> wrote:
> > "Harvey Schmidlapp" <henryhart....DeleteThis@westat.com> wrote in message
> >
> > news:f27a7941-ea71-42b9-8e02-29990e318569@f3g2000hsg.googlegroups.com...
> >
> >
> >
> > > I've been running an Apache 2.0 server for a while with multiple name-
> > > based virtual sites on port 80 and one SSL site on the same IP
> > > address. I need to add a second SSL site and I'm having trouble with
> > > the configuration. I have an available IP Address so that's not a
> > > problem. In /etc/httpd/conf/httpd.conf I have these lines (among many
> > > others, of course):
> >
> > > NameVirtualHost *:80
> > > NameVirtualHost *:443
> >
> > > Then, in the /etc/httpd/conf.d/sslsite.conf file, I have this:
> >
> > > <VirtualHost *:80>
> > > ServerName www.foobar.com
> > > Redirect / http://www.foobar.com/
> > > </VirtualHost>
> >
> > > <VirtualHost *:443>
> > > DocumentRoot /path/to/foobar/docs
> > > ServerName www.foobar.com:443
> > > ServerAdmin h....DeleteThis@foobar.com
> > > ...
> >
> > You can only properly have one SSL site per IP address, so you need to throw
> > away any reference to *:443 and use something similar to the following:
> >
> > NameVirtualHost 1.1.1.1:443
> > <VirtualHost 1.1.1.1:443>
> > ...
> > </VirtualHost>
> >
> > NameVirtualHost 1.1.1.2:443
> > <VirtualHost 1.1.1.2:443>
> > ...
> > </VirtualHost>
>
> theres info on how to generate multiple certs for a single ip address
> here:
> http://wiki.cacert.org/wiki/VhostTaskForce
> http://www.cacert.org (which hasnt reached the status of a recognized
> Certificate Authority, but is aiming to be included in browsers
> soonish) can do it free

BS. It's not possible to have multiple certificates. The SSL layer is
negotiated before the application layer - and only the application layer knows
which virtual host is being contacted. As the certificate DN must match and the
certificate is selected based on IP, there can only be one certificate per IP
address+port. Wldcarding of the DN may have been proposed but never made it
into the standard - because it weakens security.
 >> Stay informed about: Multiple SSL sites, Multiple IP Addresses 
Back to top
Login to vote
Display posts from previous:   
   Web Hosting Problem Solving Community! (Home) -> Apache All times are: Pacific Time (US & Canada) (change)
Page 1 of 1

 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum



[ Contact us | Terms of Service/Privacy Policy ]