Re: Multi site SSL problems

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On Thu, May 9, 2024 at 6:54 PM Chris me <phunction@xxxxxxxxxxx> wrote:

Hi, I am having an issue trying to get multiple sites with their own SSL cert. I purchased AlphaSSL certs for them.

The strange thing, the first cert works, the second gives me an ERR_SSL_PROTOCOL_ERROR, but only on some systems.

 

This is what I am using now:

 

(

Site1 is fine, Site2 gives me the error.

 

I originally tried with NameVirtualHost *.443

And then <VirtualHost *.443>

But when I go to site2, it complains that the cert is invalid because it is using the cert from site1?

)

 

 

<IfModule mod_ssl.c>

NameVirtualHost 192.99.9.188:443

 

<VirtualHost www.site1.com:443>

ServerName www.site1.com

ServerAdmin webmaster@xxxxxxxxx

DocumentRoot /home/httpd/sites/site1

<Directory /home/httpd/sites/site1>

                       

                        Order allow,deny

                        Allow from all

                </Directory>

 

        SSLEngine on

        SSLProtocol all -SSLv2 -SSLv3

        SSLCertificateFile    /etc/ssl/site1.ca/server.crt

        SSLCertificateKeyFile /etc/ssl/site1.ca/server.key

        SSLCertificateChainFile /etc/ssl/site1.ca/bundle.crt

</VirtualHost>

 

<VirtualHost www.site2.com:443>

ServerName www.site2.com

ServerAdmin webmaster@xxxxxxxxx

DocumentRoot /home/httpd/sites/site2

<Directory /home/httpd/sites/site2>

                       

                        Order allow,deny

                        Allow from all

                </Directory>

 

        SSLEngine on

        SSLProtocol all -SSLv2 -SSLv3

        SSLCertificateFile    /etc/ssl/site2.ca/server.crt

        SSLCertificateKeyFile /etc/ssl/site2.ca/server.key

        SSLCertificateChainFile /etc/ssl/site2.ca/bundle.crt

</VirtualHost>

</IfModule mod_ssl.c>


So many red flags here:

- Always use *:PORT when defining a vhost, unless you know exactly what you are doing
- Set the ServerName directive in every single vhost
- Do not use the 2.2 authz directives (Allow/Deny/Order) and use Require instead
- Unload the mod_access_compat module when apachectl configtest passes

Lastly, show the output from apachectl -S when the fixes are applied 

[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux