apache: настройка ssl для вирт. хоста

[rmn]

есть несколько виртуальных хостов (name based), нужно на один ходить по https.

Код: Выделить всё

db1# cat extra/httpd-ssl.conf

Listen 443

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

SSLPassPhraseDialog  exec:/usr/local/etc/apache22/echo

SSLSessionCache        "shmcb:/var/run/ssl_scache(512000)"
SSLSessionCacheTimeout  300

SSLMutex  "file:/var/run/ssl_mutex"

################################################################################################

<VirtualHost *:443>
        DocumentRoot "/usr/local/www/host1.site.org"
        ServerName host1.site.org:443
        ServerAdmin postmaster@site.org
        ErrorLog "/var/log/host1.site.org-ssl-error.log"
        TransferLog "/var/log/host1.site.org-ssl-access.log"

        <Directory "/usr/local/www/host1.site.org">
                Options -Indexes FollowSymLinks
                AllowOverride None
                Order allow,deny
                Allow from all
        </Directory>

        SSLEngine on
        SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
        SSLCertificateFile "/usr/local/etc/apache22/server.crt"
        SSLCertificateKeyFile "/usr/local/etc/apache22/server.key"
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>

        BrowserMatch ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0 force-response-1.0
        CustomLog "/var/log/httpd-ssl_request.log" "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
</VirtualHost>

работает норм. Но, если заходить на https://IP или https://host2.site.org, показывает контент с https://host1.site.org

Как побороть? Нужно чтобы был доступен https://host1.site.org, а на все остальные варианты https://* выдавалась какая-нибудь ошибка.

[Хостинг HostFood.ru]

Тарифы на хостинг в России, от 12 рублей: https://www.host-food.ru/tariffs/hosting/
Тарифы на виртуальные сервера (VPS/VDS/KVM) в РФ, от 189 руб.: https://www.host-food.ru/tariffs/virtualny-server-vps/
Выделенные сервера, Россия, Москва, от 2000 рублей (HP Proliant G5, Intel Xeon E5430 (2.66GHz, Quad-Core, 12Mb), 8Gb RAM, 2x300Gb SAS HDD, P400i, 512Mb, BBU):
https://www.host-food.ru/tariffs/vydelennyi-server-ds/
Недорогие домены в популярных зонах: https://www.host-food.ru/domains/

[hizel]

http://httpd.apache.org/docs/2.0/vhosts ... ml#default

[rmn]

http://httpd.apache.org/docs/2.0/vhosts ... ml#default

добавляю в httpd-ssl.conf:

Код: Выделить всё

<VirtualHost *:443>
        DocumentRoot "/usr/local/www/apache22/data"
</VirtualHost>

получаю в логах:

Код: Выделить всё

[Thu Jan 20 23:30:55 2011] [warn] _default_ VirtualHost overlap on port 443, the first has precedence

добавляю в httpd-ssl.conf:

Код: Выделить всё

<VirtualHost *:*>
        DocumentRoot "/usr/local/www/apache22/data"
</VirtualHost>

получаю в логах:

Код: Выделить всё

[Thu Jan 20 23:31:21 2011] [warn] _default_ VirtualHost overlap on port 80, the first has precedence

в первом случае получаю отлуп на все вирт. хосты по https (включая нужный host1.site.org).
во втором - редиректит на первый вирт. хост, описанный в httpd-vhosts.conf

[terminus]

Вы в курсе, что при использовании SSL апача не видит HOST в http запросе потому, что сессия зашифрована?
Поэтому нельзя использовать SSL + виртуальные хосты. Для каждого кому нужен SSL должен быть свой отдельный IP.

http://httpd.apache.org/docs/2.0/ssl/ss ... ml#vhosts2

Why is it not possible to use Name-Based Virtual Hosting to identify different SSL virtual hosts?

Name-Based Virtual Hosting is a very popular method of identifying different virtual hosts. It allows you to use the same IP address and the same port number for many different sites. When people move on to SSL, it seems natural to assume that the same method can be used to have lots of different SSL virtual hosts on the same server.

It comes as rather a shock to learn that it is impossible.

The reason is that the SSL protocol is a separate layer which encapsulates the HTTP protocol. So the SSL session is a separate transaction, that takes place before the HTTP session has begun. The server receives an SSL request on IP address X and port Y (usually 443). Since the SSL request does not contain any Host: field, the server has no way to decide which SSL virtual host to use. Usually, it will just use the first one it finds, which matches the port and IP address specified.

You can, of course, use Name-Based Virtual Hosting to identify many non-SSL virtual hosts (all on port 80, for example) and then have a single SSL virtual host (on port 443). But if you do this, you must make sure to put the non-SSL port number on the NameVirtualHost directive, e.g.

NameVirtualHost 192.168.1.1:80

Other workaround solutions include:

Using separate IP addresses for different SSL hosts. Using different port numbers for different SSL hosts.