2 SSL hosts on 1 ip 1

[CGI101]

so currently i have 2 websites hosted on 1 ip...

<VirtualHost 192.168.123.5>
ServerAlias DOMAIN-ONE.com
</VirtualHost>

<IfDefine SSL>
<VirtualHost 192.168.123.5:443>
ServerName DOMAIN-ONE.com
</VirtualHost>
</IfDefine>

AND THEN

<VirtualHost 192.168.123.5>
ServerAlias DOMAIN-TWO.com
</VirtualHost>

<IfDefine SSL>
<VirtualHost 192.168.123.5:443>
ServerName DOMAIN-TWO.com
</VirtualHost>
</IfDefine>

now the problem is that you cannot have 2 ssl hosts defined under the SAME ip, in this case, 192.168.123.5

in the apache conf file, is there anyway to do an if statement?

like this:
if (website = DOMAIN-ONE.com)
{
<IfDefine SSL>
DOMAIN-ONE CONTENTS
</IfDefine>
}
else
{
<IfDefine SSL>
DOMAIN-TWO CONTENTS
</IfDefine>
}

is that possible?

please note that i've already purchases TWO separate ssl certificates for both domains, but it just won't let use it cause of the ip issue.

the only solution i can think of would be to get another NIC card, hook up another connection to the switch with ANOTHER ip like 192.168.123.10, and do it that way.

can you guys think of any other solutions?

p.s. on the current interface, i CAN'T have any ip other than the 192.168.123.5.

 

[RhythmAce]

Nobody agrees with you more than I sleips. More than likely it was a liberal arts major. ;-)

Sorry CGI101 I tend to read these things as I'm going out the door and kind of breeze over stuff just to get the gist of what's going on. To get things straight in my head are you saying that apache will recognize the ip from both eth0 and eth1 but not the virtual interface eth0:1? How does apache know which ip you want? Remeber your router is sending all https (and http)calls to the same ip.

 

[CGI101]

oh then that might be the problem, but i thought that THAT was the purpose of ip aliasing..no?

he is the problem:
my "router" or the box sending out the IPs can only send out ONE single ip, thats the 192.168.123.5.

and i thought ip aliasing basically made another ip off that, in this case, the 192.168.123.10.

but i'm guessing that i was wrong? does the external box need to send out BOTH ips for ip aliasing to work?

 

[RhythmAce]

I'm sorry. I was making a joke. I have a green personality and nobody seems to know when I'm kidding. I wanted to know if ip addressing was working. What we need to do if find out definitively, what is working and what is not. But first lets run down a checklist. Let's make two virtual interfaces, eth0:0 and eth0:1 just like you did before. Run ifconfig to see if it took. Then edit /etc/hosts and assign the following:

192.168.123.10 domain1.com
192.168.123.11 domain2.com

Some people get by without this but I like to have a host name for each ip. I also like the idea of both vhosts using virtual ip addresses. I don't know how you have apache setup for you ssl vhosts but we want to turn ssl off for the time being. We want to only see if ip based addressing works. Your containers should look like this:

<VirtualHost 192.168.123.10:80>
right now all you need is ServerName and DocumentRoot
</VirtualHost>

Do the same for 192.168.123.11 or whatever your other virtual ip is.

If it is uncommented, comment out the NameVirtualHost directive. We don't want it binding to port 80 right now. The Listen directive should be set to 'Listen *.80' Just for this time, reboot the system so you can make sure the virtual interfaces are still there after bootup. Now check to see if apache can find the two domains. Remember, we are using http at this point. If it works, Then you can setup the ssl stuff for each domain within their respective vhost containers. Listen should now say Listen 443 and the 80 in the vhost container should be changed to 443. If things still don't start working, post your httpd.conf or a link to where we can download a copy and your vhost containers. We might be overlooking something and won't really know what it is until we see it.

 

[CGI101]

lol, i'm the same, everyone always think that i'm serious when really its just a joke...

you mentioned "eth0:0 and eth0:1" serveral times....i have eth0 and eth0:1.....that doesn't make a difference, does it?

and i did what you said..it doesnt work.

here is another thing i did, and the results were sort of "unexpected"

root@host [~]# time curl

https://192.168.123.5

curl: (51) SSL: certificate subject name 'domain1.com' does not match target host name '192.168.123.5'

real 0m0.154s
user 0m0.043s
sys 0m0.007s
root@host [~]# time curl

https://192.168.123.10

curl: (51) SSL: certificate subject name 'domain2.com' does not match target host name '192.168.123.10'

real 0m0.076s
user 0m0.042s
sys 0m0.005s

so here, when i run the 2nd ip, it goes after the RIGHT ssl certificate but for some reason, apache doesn't...i guess this means that the aliasing is working?

 

[RhythmAce]

So with ssl taken out of the picture, apache still doesn't work with ip addressing? It has to! Since multiple ssl certs will not work on the same ip, there is no sense in trying to get it to work until apache can find each of the 2 domains using only ip addressing. When you tell me it didn't work, I'm not clear on what you mean. You don't say exactly what didn't work. That is why I suggested the checklist. So,,, let's do it again. This time, we will have 3 steps. We cannot go on until the previous step works. Ready? Here we go.

1. Create a virtual interface. Did it work? [ ]Yes [ ]No

2. Create ip addressed vhosts. Did it work? [ ]Yes [ ]No

3. Enable the global ssl stuff then put the cert stuff for each domain in its own vhost container. Any luck?

To answer your question about the two virtual interfaces eth0:0 and eth0:1, It doesn't really matter. I just like both ip addressed vhosts to be using virtual ips. This way we can tell if apache is seeing them at all. For example, if your router is sending all http and https traffic to 192.168.123.5, is apache only finding the vhost with that ip? The first vhost defined becomes the default. I guess you could just as easily switch the ip of the vhosts so that the virtual ip is first to see if that makes a difference. If it still defaults to .5 we know that there is a problem with ip addressing.

 

[CGI101]

ahhh man, i found out what the problem is and i was hoping that it wouldn't be thing. unless i did something wrong, ip addressing isn't for me.

so, what i did was basically..

with all NEW apache configuration for BOTH ips still in place, instead of forwading port 80 & 443 traffic to 192.168.123.5, i changed it to 192.168.123.10 and all of a sudden both http and ssl started working for that domain.

i don't know if you read where i said this, but my outside device(router) can only push through 1 ip.

is there any hope left?

 

[RhythmAce]

Yeah I caught that earlier about the router forwarding to only 1 ip. That is normal. Usually you forward a particular protocol to a specific ip and a specific port or range of ports. You want to forward all http and https traffic to 192.168.123.5 if that is indeed eth0 on the server. You also want to forward http on port 80 and https on port 443. This is what I've been assuming from your previous posts. If I understand this last post and you are forwarding to the aliased ip and it worked both from the network point of view and apache, then we know that ip aliasing is working all around. In short, our problem is with apache resolving requests via ip addressing. Am I on the right track?

 

[CGI101]

haha, if you're thinking what i think you're thinking, then yes, you're right...(sorry for the confusing sentence

but just to make sure..
the router, is forwarding ALL port 80 and port 443 traffic to 192.168.123.5....its NOT and CANNOT forward anything to 192.168.123.10

and i don't know if this is possible but this is what needs to be done...

think of it like a "Y" cord...the server has to duplicate that one connection coming in via 192.168.123.5, and keep one as 192.168.123.5 for eth0...and change the duplicate to 192.168.123.10 for eth 0:1

in other words, whatever changes need to be made would HAVE to be inside the server.

possible?

 

[CGI101]

in other words, apache is not detecting any 192.168.123.10 connections because there isn't anything being sent/forwarded to that ip. everything is going to "192.168.123.5".

 

[hcyuan]

I could be wrong, but couldn't you just do two NameVirtualHost that listens on SSL? Create certificates for both of them and do it that way? At least...that's how I used to do it and didn't have a problem...but people here keep telling me I can't do that.

Something along the line of:

NameVirtualHost x.x.x.x:443

<IfDefine SSL>
  <VirtualHost x.x.x.x:443>
    DocumentRoot "/srv/[URL unfurl="true"]www/htdocs/folder1"[/URL]
    ServerName Folder1.Domain.com
    ServerAdmin Admin@Domain.com
    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl.crt/folder1.crt
    SSLCertificateKeyFile /etc/apache2/ssl.key/domain.key
  </VirtualHost>


  <VirtualHost x.x.x.x:443>
    DocumentRoot "/srv/[URL unfurl="true"]www/htdocs/folder2"[/URL]
    ServerName Folder2.Domain.com
    ServerAdmin Admin@Domain.com
    SSLEngine On
    SSLCertificateFile /etc/apache2/ssl.crt/folder2.crt
    SSLCertificateKeyFile /etc/apache2/ssl.key/domain.key
  </VirtualHost>
</IfDefine>

I could be wrong, but it won't hurt to try. The thing is...one of my Apache server is running this way currently and I don't have any problems with it. I can post up that httpd.conf if you want to see it.

 

[CGI101]

ya if you can post your conf file, thatd be VERY helpful.

also, do you only have 1 NIC on the machine? and only 1 ip coming IN?

 

[hcyuan]

Yes, only 1 NIC but multiple IP addresses. Multiple sites on one IP address as well. I posted up portions of it so that way you won't get overwhelmed and it'll protect me a little bit so you don't see all my info.

NameVirtualHost 12.29.124.49:80
NameVirtualHost 12.29.124.49:443

<VirtualHost 12.29.124.49:80 12.29.124.49:443>
ServerName axapta.valence.com
DocumentRoot DATA:\Web\Axapta

# SOURCE OBJECT: cn=Axapta-Directory,cn=axapta.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

<Directory DATA:\Web\Axapta>
Options Indexes MultiViews
AllowOverride None
Order deny,allow
Allow from all
IndexOptions FoldersFirst
</Directory>

# SOURCE OBJECT: cn=axapta.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

Alias /secure "DATA:/Web/Axapta/Secure"

# SOURCE OBJECT: cn=Secure-Directory,cn=axapta.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

<Directory DATA:/Web/Axapta/Secure>
Options Indexes Multiviews
AllowOverride None
Order deny,allow
Allow from all
AuthType Basic
AuthName Protected
require edir-user
AuthLDAPAuthoritative On
AuthLDAPDereferenceAliases never
AuthLDAPURL ldap://NWU1-US.VLNC.COM/?cn?sub?objectClass=inetOrgPerson
</Directory>

# SOURCE OBJECT: cn=axapta.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

# Virtual Office Config
</VirtualHost>

# SOURCE OBJECT: cn=it.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

<VirtualHost 12.29.124.49:80 12.29.124.49:443>
ServerName it.valence.com
DocumentRoot DATA:\Web\IT

# SOURCE OBJECT: cn=IT-Directory,cn=it.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

<Directory DATA:\Web\IT>
Options MultiViews
AllowOverride None
Order deny,allow
Allow from all
AuthType Basic
AuthName "Protected"
require edir-user
AuthLDAPAuthoritative On
AuthLDAPDereferenceAliases never
AuthLDAPURL ldap://NWU1-US.VLNC.COM/?cn?sub?objectClass=inetOrgPerson
</Directory>

# SOURCE OBJECT: cn=Updates-Directory,cn=it.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

<Directory DATA:/Web/IT/Updates>
Options Indexes Multiviews
AllowOverride None
Order deny,allow
Allow from all
</Directory>

# SOURCE OBJECT: cn=it.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

# Virtual Office Config
</VirtualHost>

# SOURCE OBJECT: cn=extranet.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

<VirtualHost 12.29.124.49:80 12.29.124.49:443>
ServerName extranet.valence.com
DocumentRoot DATA:\Web\ValenceWeb

# SOURCE OBJECT: cn=ValenceWeb-Directory,cn=extranet.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

<Directory DATA:\Web\ValenceWeb>
Options MultiViews
AllowOverride None
Order deny,allow
Allow from all
</Directory>

# SOURCE OBJECT: cn=extranet.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

Alias /warranty/restricted "DATA:/Web/ValenceWeb/warranty/restricted"

# SOURCE OBJECT: cn=restricted-Directory,cn=extranet.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

<Directory DATA:/Web/ValenceWeb/warranty/restricted>
Options Indexes Multiviews
AllowOverride None
Order deny,allow
Allow from all
AuthType Basic
AuthName Protected
require edir-user
AuthLDAPAuthoritative On
AuthLDAPDereferenceAliases never
AuthLDAPURL ldap://NWU1-US.VLNC.COM/?cn?sub?objectClass=inetOrgPerson
</Directory>

# SOURCE OBJECT: cn=extranet.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

Alias /survey/admin "DATA:/Web/ValenceWeb/Survey/Admin"

# SOURCE OBJECT: cn=Admin-Directory,cn=extranet.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

<Directory DATA:/Web/ValenceWeb/Survey/Admin>
Options Indexes Multiviews
AllowOverride None
Order deny,allow
Allow from all
AuthType Basic
AuthName "Protected"
require edir-user
AuthLDAPAuthoritative On
AuthLDAPDereferenceAliases never
AuthLDAPURL ldap://NWU1-US.VLNC.COM/?cn?sub?objectClass=inetOrgPerson
</Directory>

# SOURCE OBJECT: cn=extranet.valence.com,cn=NWU1-US,cn=NetWare Group,cn=Apache Group,o=henderson

# Virtual Office Config
</VirtualHost>

Hum...I just noticed that I'm not using SSL on those...but LDAP authentication instead...let me do a test on my server and see if it'll do multiple SSL on one IP. Will post back later.

 

[hcyuan]

Argh~! They were right. It uses the certificate of the first VirtualHost that was defined. I lose.

I should've read sleipnir's post...stupid me. Stupid n00b I am~!

Okay, so reading some more of the posts...I was just curious...what kind of router do you have? What kind of environment? Is this a home router on a home network?

 

[RhythmAce]

CGI101, post your httpd.conf and if you vhosts are in a different file, post that too. I need to do some studying of your setup bfore I rip my last hair out.

 

[CGI101]

HAHAHA...appreciate the help guys

here is what you asked for:

#   Logging:
#   The home of the dedicated SSL protocol logfile. Errors are
#   additionally duplicated in the general error log file.  Put
#   this somewhere where it cannot be used for symlink attacks on
#   a real server (i.e. somewhere where only root can write).
#   Log levels are (ascending order: higher ones include lower ones):
#   none, error, warn, info, trace, debug.
SSLLog      /usr/local/apache/logs/ssl_engine_log
SSLLogLevel info

</IfModule>

<IfDefine SSL>

##
## SSL Virtual Host Context
##


</IfDefine>


NameVirtualHost 192.168.123.5:80
NameVirtualHost 192.168.123.10:80
#Listen 192.168.123.10:80



ErrorDocument 400 /400.shtml
ErrorDocument 401 /401.shtml
ErrorDocument 403 /403.shtml
ErrorDocument 404 /404.shtml
ErrorDocument 500 /500.shtml
ScriptAlias /cgi-sys/ /usr/local/cpanel/cgi-sys/
Alias /sys_cpanel/ /usr/local/cpanel/sys_cpanel/
Alias /java-sys/ /usr/local/cpanel/java-sys/
Alias /img-sys/ /usr/local/cpanel/img-sys/
Alias /akopia/ /usr/local/cpanel/3rdparty/interchange/share/akopia/
Alias /neo-images/ /usr/local/cpanel/base/neomail/neo-images/
ScriptAliasMatch ^/cpanel/(.*) /usr/local/cpanel/cgi-sys/redirect.cgi
ScriptAlias /cpanel /usr/local/cpanel/cgi-sys/redirect.cgi
ScriptAlias /whm /usr/local/cpanel/cgi-sys/whmredirect.cgi
ScriptAlias /securewhm /usr/local/cpanel/cgi-sys/swhmredirect.cgi
ScriptAlias /webmail /usr/local/cpanel/cgi-sys/wredirect.cgi
ScriptAliasMatch ^/webmail/(.*) /usr/local/cpanel/cgi-sys/wredirect.cgi
ScriptAliasMatch ^/kpanel/(.*) /usr/local/cpanel/cgi-sys/redirect.cgi
ScriptAlias /controlpanel /usr/local/cpanel/cgi-sys/redirect.cgi
ScriptAlias /securecontrolpanel /usr/local/cpanel/cgi-sys/sredirect.cgi
Alias /mailman/archives/ /usr/local/cpanel/3rdparty/mailman/archives/public/
ScriptAlias /mailman/ /usr/local/cpanel/3rdparty/mailman/cgi-bin/
Alias /pipermail/ /usr/local/cpanel/3rdparty/mailman/archives/public/
Alias /interchange/ /usr/local/cpanel/3rdparty/interchange/share/interchange/
Alias /interchange-5/ /usr/local/cpanel/3rdparty/interchange/share/interchange-5/

<Location /whm-server-status>
    SetHandler server-status
    Order deny,allow
    Deny from all
    Allow from 127.0.0.1
</Location>
ExtendedStatus On

<VirtualHost 192.168.123.5>
ServerAlias domain-1.com
ServerAdmin webmaster@domain-1.com
DocumentRoot /home/domain-1-username/public_html
ServerName [URL unfurl="true"]www.domain-1.com[/URL]
#CustomLog /usr/local/apache/domlogs/domain-1.com combined

User domain-1-username
Group domain-1-username

</VirtualHost>

<IfDefine SSL>
<VirtualHost 192.168.123.5:443>
ServerAdmin webmaster@domain-1.com
DocumentRoot /home/domain-1-username/public_html
BytesLog domlogs/domain-1.com-bytes_log
ServerName domain-1.com
UserDir public_html
ScriptAlias /cgi-bin/ /home/domain-1-username/public_html/cgi-bin/

SSLEnable
SSLCertificateFile /usr/share/ssl/certs/domain-1.com.crt
SSLCertificateKeyFile /usr/share/ssl/private/domain-1.com.key
SSLCACertificateFile /usr/share/ssl/certs/domain-1.com.cabundle
SSLLogFile /usr/local/apache/domlogs/domain-1.com-ssl_data_log
CustomLog /usr/local/apache/domlogs/domain-1.com-ssl_log combined
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
</VirtualHost>
</IfDefine>

<VirtualHost 192.168.123.10>
ServerAlias domain-2.com
ServerAdmin webmaster@domain-2.com
DocumentRoot /home/domain-2-username/public_html
BytesLog domlogs/domain-2.com-bytes_log
ServerName [URL unfurl="true"]www.domain-2.com[/URL]
CustomLog /usr/local/apache/domlogs/domain-2.com combined
ScriptAlias /cgi-bin/ /home/domain-2-username/public_html/cgi-bin/
</VirtualHost>

<IfDefine SSL>
<VirtualHost 192.168.123.10:443>
ServerAdmin webmaster@domain-2.com
DocumentRoot /home/domain-2-username/public_html
BytesLog domlogs/domain-2.com-bytes_log
ServerName domain-2.com
UserDir public_html
ScriptAlias /cgi-bin/ /home/domain-2-username/public_html/cgi-bin/

SSLEnable
SSLCertificateFile /usr/share/ssl/certs/domain-2.com.crt
SSLCertificateKeyFile /usr/share/ssl/private/domain-2.com.key
SSLCACertificateFile /usr/share/ssl/certs/domain-2.com.cabundle
SSLLogFile /usr/local/apache/domlogs/domain-2.com-ssl_data_log
CustomLog /usr/local/apache/domlogs/domain-2.com-ssl_log combined
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
</VirtualHost>
</IfDefine>

 

[CGI101]

note that THAT configuration works fine when i bring in the 192.168.123.10 through a 2nd NIC.

 

[RhythmAce]

It could be very possible that the NIC called eth0 doesn't like the ip aliasing thing. Have you tried this setup on the second NIC instead? Just something to gnaw on whilst I ponder your dilemma.

 

[CGI101]

well, they are both the exact same type of nic....so i highly doubt that THATS the problem.
besides, i'm not near the server right now so i wouldn't be able to try that.

 

[RhythmAce]

Ok, I looked it over and am convinced that this is evidence of the twisted mind of a mad man. ;-) I will work my way from the top down.

1. Didn't you hear sleipnir214 say you can't use name based addressing with ssl? Furthermore did you not hear me agree? Different thread? Oh, never mind. Any how there are those who will use name based addressing with a single cert. They know that this will produce a warning but that doesn't matter to them, they just want the protection. To make a long story short and without going into why we need to use ip based addressing, you'll have to trust me ang get rid of those lines where you use the NameVitualHost directive.

2. You can use the Listen directive however to bind to those addresses and/or ports.

3. Change User and Group back to apache or nobody or delete these two lines altogether. You do not want to use a real user name here because that would be a security risk. Apache and nobody have very limited access to the system. Moreover they don't have a login shell or password. The apache (httpd) daemon only have access to its own webspace which is defined in httpd.conf. This has nothing to do with the system level owner of those directories.

4. The UserDir directive is defined in the global section of httpd.conf and doesn't do much good here since apache will already have found it by this point.

5. You should add the port to the ip of the http vhosts also. For example <VirtualHost 192.168.123.5:80> This will not conflict with <VirtualHost 192.168.123.5:443> because they are on different ports. Apache sees them as two completely different addresses.

6. If you have ServerName defined in httpd.conf, comment it out. In the case of named vhosts this is ignored but is not the case with ip addressing.

I hope this get things straightened out, but I don't want you to give up on this. This is not something new we are trying here. It has been done. I have one quick question for you though. If both ssl sites work with two different NICs, why can't you do that? I know you said that's not an option in the beginning but maybe a workaround would be easier for that then what we are trying to do here. Anyway, we won't give up on you so don't go and get wobbly on us.

 

[RhythmAce]

I am sorry CGI101, I am so sorry. I reread this entire thread one post at a time to see where we weren't connecting. According to everything I know, what I was telling you should have worked. It was when you would say "It dind't work" that the confusion started. I will try to explain myself from the beginning. First, you pointed out that you wanted to add a second ssl vhost but knew that couldn't be done with one ip. We were cool and communicatin' at this point. I suggested 'ip aliasing' as a way around this and here is were communications got a little shaky. I was thinking that you were saying that apache wasn't working with ip based addressing. From later posts I see that apache actually was seeing the ip addressing because if the router forwarded to an aliased ip, apache would serve the correct vhost. The problem was that iit would default to the vhost's ip the was pointed to by the router. Everything at this point is working exactly as it should. Now let's consider some options. In a perfect world we would be able to go to our isp and ask for more static ip addresses and they would give them to us, or let us have them for a nominal fee. Some isps will let you have up to 5. Then you would point to those ips from your dns servers. If that is not an option, then we are stuck with private ip addresses. These are the ones that start with 192.168... The problem with these are that they can not be seen from the internet. That means that every request that comes into your router will get forwarded to the ip address you have assigned to that port. You can tell apache to Listen to all (*) addresses but the only one it will hear anything on is the one the router is sending it to. There are a few things you can do at this point. One is to use regular name based addressing with very simple vhost containers. Then in a .htaccess file use a rewite rule to force a redirect to an ssl enabled container. Another option would be bassically the same in that you have both types of vhosts but to get to the https site, they need to go through a link on you http site. This link would uses the ip address such as

https://192.168.123.5.

This will take you to the correct ssl vhost. You may have to turn the UseCononicalNames back on so it will be forcet to get the domain name from ServerName rather that the request header. The other ways are to setup a reverse proxy or internal dns server but the setup on these doesn't seem to be worth the effort for two domains. Sorry again for all the confusion.