Wednesday, April 9, 2008

Apache2: Multiple Virtual Hosts over HTTPS

Ever wanted to run multiple virtual hosts on your Apache installations under SSL, but you only have one I.P address to bind to? There are three main steps

  1. Create your own signing authority and a self signed certificate (If you haven't got one of these yet see here)
  2. Change your Apache configuration file
  3. Restart Apache

Change Apache Configuration

A summary from Rich Bowen
Copy the two files wilcard.crt and wildcard.key into a subdirectory of your Apache install, for instance I usually use the dir conf/ssl/. Now edit your config file to look similar to this, the two cert/keys MUST be the same. You also need to ensure that Listen 443 is defined somewhere in the file



1: NameVirtualHost *:443
2: <VirtualHost *:443>
3: ServerName foo1.bar.com
4: DocumentRoot /www/foo1/
5: SSLEngine on
6: SSLCertificateFile conf/ssl/wildcard.crt
7: SSLCertificateKeyFile conf/ssl/wildcard.key
8: </VirtualHost>
9:
10: <VirtualHost *:443>
11: ServerName foo2.bar.com
12: DocumentRoot /www/foo2/
13: SSLEngine on
14: SSLCertificateFile conf/ssl/wildcard.crt
15: SSLCertificateKeyFile conf/ssl/wildcard.key
16: </VirtualHost>


As a side note the first virtual host is the default one if you get an unmatched domain name, so foo3.bar.com would get served as if it was foo1.bar.com.

1 comment:

jodler303 said...

In order to get good security test results (e.g. ssllabs.com/ssltest) you should adjust the ciphers for Apache2 in /etc/apache2/mods-enabled/ssl.conf such that:

# enable only secure protocols: SSLv3 and TLSv1, but not SSLv2
SSLHonorCipherOrder On
SSLCipherSuite "EECDH+AESGCM EDH+AESGCM EECDH -RC4 EDH -CAMELLIA -SEED -DES-CBC3-SHA -DES-CBC-SHA RSA !aNULL !eNULL !LOW -3DES !MD5 !EXP !PSK !SRP DSS !RC4 -EDH-RSA-DES-CBC-SHA -EDH-RSA-DES-CBC3-SHA -ADH-DES-CBC-SHA -ADH-DES-CBC3-SHA -DES-CBC-SHA AES128-SHA kRSA -DES-CBC3-SHA"

Many ssl providers are offering more details and additional adjustments, e.g. here