Re: Apache sends wrong certificate
Frank van Beek <[email protected]>
| Newsgroups | gmane.comp.apache.mod-ssl.user |
|---|---|
| Message-ID | <[email protected]> |
Hi Ron, R. DuFresne wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > I'm sure this has been answered, but in case it has not; > > You can not virtualize https to more then one hostsite, you have to have > real IP addresses for https. Thanks for your reply. I understand your confusion. In my post I masked out the first two numbers of the IP-addresses. But we do have 4 VirtualHosts on 4 different IP-addresses. As it turned out (see a previous post), our problem was caused by a misconfigured reverse DNS. Frank. WAXTRAPP BV van Diemenstraat 366 1013CR Amsterdam The Netherlands Phone: +31 (0)20 672 2308 Fax: +31 (0)20 672 2488 http://www.waxtrapp.com > Thanks, > > Ron DuFresne > > On Wed, 24 May 2006, Frank van Beek wrote: > >> Hi all, >> >> This morning we migrated 4 of our websites to a new server. Each of >> these websites uses a certificate for https connections. We've got >> only one Apache instance running with 4 virtual hosts on 4 different >> IP-addresses. >> >> This worked fine on the old server. But since the move this morning >> Apache sends the certificate for the first VirtualHost to all 4 >> IP-addresses. Two of these sites need an additional >> SSLCertificateChainFile, and this file is send *correctly* depending >> on the IP-address. So Apache does see 4 different VirtualHosts, but >> somehow ignores the individual SSLCertificateFiles. >> >> Here is the relevant part of httpd.conf for these 4 hosts: >> >> ----- >> Listen xxx.xxx.198.62:443 >> NameVirtualHost xxx.xxx.198.62:443 >> >> <VirtualHost xxx.xxx.198.62:443> >> SSLEngine On >> SSLCertificateChainFile chain1 >> SSLCertificateFile crt1 >> SSLCertificateKeyFile key1 >> </VirtualHost> >> >> Listen xxx.xxx.198.61:443 >> NameVirtualHost xxx.xxx.198.61:443 >> >> <VirtualHost xxx.xxx.198.61:443> >> SSLEngine On >> SSLCertificateChainFile chain2 >> SSLCertificateFile crt2 >> SSLCertificateKeyFile key2 >> </VirtualHost> >> >> Listen xxx.xxx.198.63:443 >> NameVirtualHost xxx.xxx.198.63:443 >> >> <VirtualHost xxx.xxx.198.63:443> >> SSLEngine On >> SSLCertificateFile crt3 >> SSLCertificateKeyFile key3 >> </VirtualHost> >> >> Listen xxx.xxx.198.64:443 >> NameVirtualHost xxx.xxx.198.64:443 >> >> <VirtualHost xxx.xxx.198.64:443> >> SSLEngine On >> SSLCertificateFile crt4 >> SSLCertificateKeyFile key4 >> </VirtualHost> >> ----- >> >> The old server is still up and running. I've upgraded Apache on that >> system to the same version (2.0.58) and copied httpd.conf to that >> machine. The above configuration somehow works correctly there. >> >> I've been trying to debug this using "openssl s_client -state >> -connect" and I do see some relevant differences, but I've been unable >> to interpret them. >> >> I know this report lacks a lot of possibly relevant details. But I >> didn't want to send the whole httpd.conf and all of the terminal >> output to this list. >> >> Is there an obvious mistake in my configuration? Or have I stumbled on >> a bug in Apache 2.0.58? >> >> Met groet, >> >> Frank. >> > > - -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > admin & senior security consultant: sysinfo.com > http://sysinfo.com > Key fingerprint = 9401 4B13 B918 164C 647A E838 B2DF AFCC 94B0 6629 > > ...We waste time looking for the perfect lover > instead of creating the perfect love. > > -Tom Robbins <Still Life With Woodpecker> > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.2.2 (GNU/Linux) > > iD8DBQFEe4tVst+vzJSwZikRAq+sAJ4mHff+nYpHLXBgfoQdFIYVBMRhYgCgw29G > ZcxkcdgHNKCofvRN3Hc5miA= > =BwdU > -----END PGP SIGNATURE----- > ______________________________________________________________________ > Apache Interface to OpenSSL (mod_ssl) www.modssl.org > User Support Mailing List [email protected] > Automated List Manager [email protected] > > ______________________________________________________________________ Apache Interface to OpenSSL (mod_ssl) www.modssl.org User Support Mailing List [email protected] Automated List Manager [email protected]