Is it possible to have both SSL protocol and non-SSL protocol running on the same server in Apache 2.x?
So if I access http://example.com (non-SSL) and https://example.com (SSL) they would both be available.
If so, would I need to create a virtual host? How would this VirtualHost directive look like, could anyone give me an example? (Assuming I already have the certificates)
Yes, you simply add another VirtualHost for the same name on port 443 (HTTPS).
Set SSLProtocol to whichever protocols you wish to allow.
<VirtualHost *:80>
ServerName your-domain.com
DocumentRoot /var/www/your-domain-root
</VirtualHost>
<VirtualHost *:443>
DocumentRoot /var/www/your-domain-root
ServerName your-domain.com
SSLEngine On
SSLOptions +StrictRequire
SSLCertificateFile /path/to/server.crt
SSLCertificateKeyFile /path/to/server.key
SSLProtocol TLSv1
</VirtualHost>
Related
I installed the ssl, but browsers are showing it's not secure.
I bought my ssl from ssls.com
this is my /etc/httpd/conf/httpd.conf file:
ServerAdmin webmaster#dummy-host.example.com
DocumentRoot /root/public_html
ServerName www.example.com
ErrorLog logs/dummy-host.example.com-error_log
CustomLog logs/dummy-host.example.com-access_log common
SSLEngine on
SSLCertificateFile /etc/ssl/certs/example_com.crt
SSLCertificateKeyFile /etc/ssl/certs/example_com.privatekey
SSLCertificateChainFile /etc/ssl/certs/example_com.ca-bundle
It's showing my ssl is self-signed, but that's not what I want.
Actually I fixed the issue. Listen was set to
listen 80
and I changed it to
listen 443
To enable SSL, I've uncommented this line in httpd.conf:
# Secure (SSL/TLS) connections
Include /Applications/MAMP/conf/apache/extra/httpd-ssl.conf
The httpd-ssl.conf file itself I've left untouched, and created .crt and .key files for a self-signed SSL certificate in the places it's expecting to see them by default:
SSLCertificateFile "/Applications/MAMP/conf/apache/server.crt"
SSLCertificateKeyFile "/Applications/MAMP/conf/apache/server.key"
Back in the main httpd.conf, I've created a VirtualHost for a site I want to use SSL, and configured like this to eventually get it working:
NameVirtualHost *
<VirtualHost *>
DocumentRoot "/Users/jonnott/Documents/sslsite1.dev"
ServerName sslsite1.dev:443
ServerAlias www.sslsite1.dev
SSLEngine on
SSLCertificateFile "/Applications/MAMP/conf/apache/server.crt"
SSLCertificateKeyFile "/Applications/MAMP/conf/apache/server.key"
</VirtualHost>
This SSL site now works fine.
However, the problem I have is that now whenever I try to visit any local non-SSL hosts, I get this error:
Bad Request
Your browser sent a request that this server could not understand.
Reason: You're speaking plain HTTP to an SSL-enabled server port.
Instead use the HTTPS scheme to access this URL, please.
These other non-SSL sites are configured in httpd.conf like this:
<VirtualHost *>
DocumentRoot "/Users/jonnott/Documents/site2.dev"
ServerName site2.dev
ServerAlias www.site2.dev
</VirtualHost>
What am I missing / doing wrong?
I think I've pretty much figured it out after reading this:
http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts2
I needed BOTH of these in my httpd.conf before the start of my VirtualHost directives:
NameVirtualHost *:80
NameVirtualHost *:443
..and then each VirtualHost needed to be port-specific:
<VirtualHost *:80>
DocumentRoot "/Users/jonnott/Documents/Projects/site1"
ServerName site1.dev:80
</VirtualHost>
<VirtualHost *:443>
DocumentRoot "/Users/jonnott/Documents/Projects/site1"
ServerName site1.dev:443
SSLEngine on
SSLCertificateFile "/Applications/MAMP/conf/apache/server.crt"
SSLCertificateKeyFile "/Applications/MAMP/conf/apache/server.key"
</VirtualHost>
i got the following setup
Listen 443
NameVirtualHost *:443
<virtualhost *:443>
Servername 1.domain.com
DocumentRoot /1
SSLEngine on
SSLVerifyClient none
SSLCertificateFile /etc/apache/1.cer
SSLCertificateKeyFile /etc/apache/1.key
SSLCertificateChainFile /etc/apache/1.crt
</virtualhost>
<virtualhost *:443>
Servername 2.domain.com
DocumentRoot /2
SSLEngine on
SSLVerifyClient none
SSLCertificateFile /etc/apache/2.cer
SSLCertificateKeyFile /etc/apache/2.key
SSLCertificateChainFile /etc/apache/2.crt
</virtualhost>
for some reason SNI takes the certificate from 1.domain.com on website 2 resulting in a not secure connection warning page. anyone got an idea why?
i'm using apache Apache/2.2.15 (Unix)
and OpenSSL 1.0.1e-fips
i've manged to get it to work, apparently apache requires the namevirtualhost to be in the /etc/httpd/conf.d/ssl.conf file instead of the httpd.conf
I want to configure two virtual hosts with their own ssl certificates on apache (apache 2.2.22 and openssl 1.0.1, debian 7.6). I've found many articles about SNI, but still can't configure it properly. Here's my config:
ports.conf
NameVirtualHost *:80
NameVirtualHost *:443
Listen 80
<IfModule mod_ssl.c>
Listen 443
</IfModule>
<IfModule mod_gnutls.c>
Listen 443
</IfModule>
test1-ssl
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName test1.com
DocumentRoot /var/www/test1
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/test1.crt
SSLCertificateKeyFile /etc/apache2/ssl/test1.key
</VirtualHost>
</IfModule>
test2-ssl
<IfModule mod_ssl.c>
<VirtualHost *:443>
ServerName test2.test.pl
DocumentRoot /var/www/test2
SSLEngine on
SSLCertificateFile /etc/apache2/ssl/test2.crt
SSLCertificateKeyFile /etc/apache2/ssl/test2.key
</VirtualHost>
</IfModule>
Domain https://test1.com works properly (with its own certificate).
Domain https://test2.test.pl displays content of domain test1.com and uses test1 ssl certificate instead of test2.crt (as it is defined in config file test2-ssl).
Any ideas,sugestions very appreciated.
Kind regards,
and thanks in advance!
After little more searching it turns out that it's possible (https://www.digicert.com/ssl-support/apache-multiple-ssl-certificates-using-sni.htm). My only problem was two separate configuration files for domains... when I configure virtualhost for domains in one config file it worked.
In my use case, I had 2 certificates, one wildcard and one not.
I put on a single file both configs:
<VirtualHost *.wildcard.com:443>
....
<VirtualHost normal.com:443>
...
but didn't work. The solution was this:
<VirtualHost *:443>
....
<VirtualHost *:443>
...
for both domains, provided that on every virtualhost definition you add the desired ServerName and ServerAlias:
ServerName normal.com
ServerAlias www.normal.com
ServerAlias m.normal.com
etc
I have a CentOS/Apache+OpenSSL server. I host two domain names with wildcard sub domains (application logic surfaces the correct site), e.g.
https://*.testing1.com
https://*.testing2.com
It works great over HTTP:-
<VirtualHost *:80>
# Admin email, Server Name (domain name) and any aliases
ServerAdmin webmaster#testing1.com
ServerName testing1.com
ServerName testing2.com
ServerAlias *.testing1.com *.testing2.com
# Index file and Document Root (where the public files are located)
DirectoryIndex index.html index.php
DocumentRoot /home/app/public_html/public
</VirtualHost>
I've purchased two Wildcard SSL certificated for both testing1.com and testing2.com, but I'm unsure how to set it up in this structure:-
<VirtualHost *.testing1.com:443>
SSLEngine On
SSLCertificateFile /etc/httpd/ssl/*.testing1.com.crt
SSLCertificateKeyFile /etc/httpd/ssl/*.testing1.com.key
SSLCACertificateFile /etc/httpd/ssl/geotrust.cer
ServerAdmin john#testing1.com
ServerName testing1.com
ServerAlias *.testing1.com
DirectoryIndex index.html index.php
DocumentRoot /home/app/public_html/public
</VirtualHost>
<VirtualHost *.testing2.com:443>
SSLEngine On
SSLCertificateFile /etc/httpd/ssl/*.testing2.com.crt
SSLCertificateKeyFile /etc/httpd/ssl/*.testing2.com.key
SSLCACertificateFile /etc/httpd/ssl/geotrust.cer
ServerAdmin john#testing2.com
ServerName testing2.com
ServerAlias *.testing2.com
DirectoryIndex index.html index.php
DocumentRoot /home/app/public_html/public
</VirtualHost>
The above for the SSL doesn't work, with the *.testing1.com definition, nor with just testing1.com.
I will also need to repeat this for testing2.com
Name-based virtualhosts and SSL wil only work if all the virtualhosts are within the same domain and you have a wildcard SSL certificate for that domain.
But you have 2 different domains.
In this case it will only work if you give each SSL-enabled virtualhost it's own IPaddress.
So you should use IP-based virtualhosts, not Name-based.
Explanation:
The ServerName which is requested, is contained in the HTTP request headers, but before that the SSL encryption must be already setup. So the ServerName is only available after the encryption has been setup. Therefore Apache can never know which SSL certificate te serve up and wil just use the first one available on that particular IPaddress.
With the single dedicated IP we can configure domain-based wildcard SSL in centos + apache2.2 server.
Hope the configurations below will help you guys!!
NameVirtualHost IP:80
NameVirtualHost IP:443
Domain 1
<VirtualHost IP:80>
ServerName abc.domain1.com
DocumentRoot /var/www/html/domain1
</VirtualHost>
<VirtualHost IP:443>
ServerName *.domain1.com
DocumentRoot /var/www/html/domain1
SSLEngine On
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /var/www/html/domain1/cert/5465456.crt
SSLCertificateKeyFile /var/www/html/domain1/cert/domain1.com.key
SSLCertificateChainFile /var/www/html/domain1/cert/g2-g1.crt
</VirtualHost>
Domain 2
<VirtualHost IP:80>
ServerName abc.domain2.com
DocumentRoot /var/www/html/domain2
</VirtualHost>
<VirtualHost IP:443>
ServerName abc.domain2.com
DocumentRoot /var/www/html/domain2
SSLEngine On
SSLCipherSuite ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /var/www/html/domain2/cert/5465456.crt
SSLCertificateKeyFile /var/www/html/domain2/cert/domain1.com.key
SSLCertificateChainFile /var/www/html/domain2/cert/g2-g1.crt
</VirtualHost>