SSL and VirtualHosts

[mufka]

I have installed SSL on my Apache 1.3.20. I am using virtual hosts. I want to use SSL on only one of the virtual hosts. can I get it to do that? I don't want all of the other virtual hosts and the default to respond to https requests.

 

[RhythmAce]

If you have SSL working globally, you can turn it off for the vhosts you don't want it for by adding the "SSLEngine off" directive in their respective containers. Otherwise you can cut and paste all the SSL stuff from the example virtual host container in httpd.conf and comment out the global definitions in "Main".

 

[ifincham]

Hi,

Assuming its mod_ssl you are using (vs Apache-ssl) and you have that and openssl installed, then for Apache you'd need global directives in httpd.conf like :

<IfDefine HAVE_SSL>
LoadModule ssl_module         modules/libssl.so
</IfDefine>
<IfDefine HAVE_SSL>
AddModule mod_ssl.c
</IfDefine>
<IfDefine HAVE_SSL>
Listen 443
</IfDefine>

Then you need to just have :

SSLEngine on
SSLCertificateFile /etc/httpd/conf/ssl.crt/server.crt
SSLCertificateKeyFile /etc/httpd/conf/ssl.key/server.key

...in your virtual host container. You have to have created the certificate files first of course.

Regards

 

[mufka]

I don't think its right yet. If I go to

https://secure.site.com,

it works as planned. But if I go to

https://notsecure.site.com,

the page for the secure site shows up. So it seems that if I go to https for any hostname that points to the server, I get the secure site. All of the plain http virtual hosts work ok.

 

[ifincham]

Hi,

Actually, I just remembered that you can't use ssl with name based virtual hosts - only with IP based virtual hosts. The reason is that apache looks at the protocol (https vs http or whatever) first and acts on the https before it gets to the stage of looking at the 'http' headers on which it discriminates between virtual hosts. So, you are going to be stuck with needed separate IP addresses for any vhost that needs SSL, i.e. using IP based virtual hosts.

Regards

 

[bingoldsby]

I've been following this for a few days knowing that I was going to want to do the same thing. I found a web site that explains how to set up Apache for Windows as a secure server. They begin by installing another instance of Apache or, as they refer to it, another Daemon which listens on the secure port and serves the secure pages.

Is this an alternative and/or a workable solution to this problem - that of having only one IP address and needing to secure only one or two pages??

I'm hoping to help myself get clear on some of this.

Thanks, Brian

 

[bingoldsby]

On a continuing note: In the above reply/query, the web site I mentioned suggests installing a second copy of apache. When I try to do that, (with 1.3.22 that is) I get two install options: &quot;repair the existing installation&quot; and &quot;remove the existing installation.&quot; How is it possible to install two Apache &quot;daemons&quot; in this case?

Thanks, Brian