Apache rewrite before mod_jk (remove www) - apache

Question

Here's the context:
I am working with Centos 7, apache 2.4.6 and tomcat 8.0.
I have a classical php website that is stored in /var/www folder.
I have a JEE website that is stored in tomcat webapps folder.
I have a wildcard ssl certificate (signed).
Here's what I want:
I want ALL accesses to my server to be redirected to correct website, with https, and without www.
Here are the use cases:
URL 'example.com' ==> redirected to https OK
URL 'www.example.com' ==> redirected https + remove www OK
URL 'https://www.example.com' ==> keep https + remove www OK
URL 'test.example.com' ==> redirected to https OK
URL 'www.test.example.com' ==> redirected https + remove www OK
URL 'https://www.test.example.com' ==> KO not redirected - browser displays a page saying that website is badly configured and connection not secured (because the wildcard ssl does not cover 2 levels)
This last point is what I'm trying to fix.
Here's my configuration:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
Redirect / https://example.com/
</VirtualHost>
<VirtualHost *:80>
ServerName test.example.com
ServerAlias www.test.example.com
Redirect / https://test.example.com/
</VirtualHost>
<VirtualHost *:443>
ServerName example.com
ServerAlias www.example.com
DocumentRoot /var/www/public/example
SSLEngine on
SSLCertificateFile xxx
SSLCertificateKeyFile xxx
SSLCertificateChainFile xxx
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,NE,R=301]
</VirtualHost>
<VirtualHost *:443>
ServerName test.example.com
ServerAlias www.test.example.com
SSLEngine on
SSLCertificateFile xxx
SSLCertificateKeyFile xxx
SSLCertificateChainFile xxx
RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteCond %{HTTP_HOST} ^(?:www\.)?(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,NE,R=301]
JkMount / worker_test
JkMount /* worker_test
</VirtualHost>
So, it seems that I'm almost there, but what am I doing wrong ?

Answer 1

As far as I know, you cannot configure more than one https virtual host for each IP, that's it, name based virtual hosting is limited to only one SSL virtual host.
This info is from https://wiki.apache.org/httpd/NameBasedSSLVHosts
As a rule, it is impossible to host more than one SSL virtual host on the same IP address and port. This is because Apache needs to know the name of the host in order to choose the correct certificate to setup the encryption layer. But the name of the host being requested is contained only in the HTTP request headers, which are part of the encrypted content. It is therefore not available until after the encryption is already negotiated. This means that the correct certificate cannot be selected, and clients will receive certificate mismatch warnings and be vulnerable to man-in-the-middle attacks.
In reality, Apache will allow you to configure name-based SSL virtual hosts, but it will always use the configuration from the first-listed virtual host (on the selected IP address and port) to setup the encryption layer. In certain specific circumstances, it is acceptable to use a single SSL configuration for several virtual hosts. In particular, this will work if the SSL certificate applies to all the virtual hosts. For example, this will work if:
All the VirtualHosts are within the same domain, eg: one.example.com and two.example.com.
You have a wildcard SSL certificate for that domain (one where the Common Name begins with an asterix: i.e *.example.com)
I´ve heard about using SNI to achieve this kind of configurations, but I have never tested: SSL with Virtual Hosts Using SNI