在Ubuntu上使用SNI的多个SSL

Question

• Apache/2.4.7 (Ubuntu)
• Ubuntu 14.04

I'm trying to run multiple ssl on the same ip. When I type in the first domain it redirects to the second domain.

I'm probably missing one little thing somewhere, if you could help me out that would be awesome.

I followed the DO tutorial without changing the ports.conf file (as I'm under the impression NameVirtualHost is no longer in use).

I have two .conf files in my sites-enabled directory and i've tried merging them but get the same result.

Output from apachectl -S is:

*:443 is a NameVirtualHost
 default server domain2.com (/etc/apache2/sites-enabled/domain2.com.conf:19)
 port 443 namevhost domain2.com (/etc/apache2/sites-enabled/domain2.com.conf:19)
 port 443 namevhost www.domain1.com (/etc/apache2/sites-enabled/domain1.com.conf:19)
     alias domain1.com
     wild alias *.domain1.com

Here is my ports.conf (should be default Ubuntu):

Listen 80

<IfModule ssl_module>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

I've tried switching from mod_ssl to mod_gnutls (with updated conf file) and get the same result.

Domain 1 .conf file in sites-enabled:

<VirtualHost *:80>
    ServerName domain1.com
    ServerAlias www.domain1.com *.domain1.com 
    DocumentRoot /git/domain1.com/public/
    ServerAdmin webmaster@domain1.com

    <Directory /git/domain1.com/public/>
        Options +Indexes +FollowSymLinks -MultiViews
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog /var/log/apache2/error_domain1.com.log
</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>

        ServerAdmin webmaster@domain1.com
        ServerName domain1.com
        DocumentRoot /git/domain1.com/public/

        #   SSL Engine Switch:
        #   Enable/Disable SSL for this virtual host.
        SSLEngine on

        #   A self-signed (snakeoil) certificate can be created by installing
        #   the ssl-cert package. See
        #   /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
        #   If both key and certificate are stored in the same file, only the
        #   SSLCertificateFile directive is needed.
        SSLCertificateFile /git/domain1.com/apache/ssl/apache.crt
        SSLCertificateKeyFile /git/domain1.com/apache/ssl/apache.key

    <Directory /git/domain1.com/public/>
        Options +Indexes +FollowSymLinks -MultiViews
        AllowOverride All
        Require all granted
    </Directory>

</VirtualHost>

</IfModule>

Domain 2 conf:

<VirtualHost *:80>
    ServerName domain2.com
    ServerAlias www.domain2.com *.domain2.com domain2.ca *.domain2.ca
    DocumentRoot /git/domain2.com/public/
    ServerAdmin webmaster@domain2.com

    <Directory /git/domain2.com/public/>
        Options +Indexes +FollowSymLinks -MultiViews
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog /var/log/apache2/error_domain2.com.log
</VirtualHost>

<IfModule mod_ssl.c>
<VirtualHost *:443>

        ServerAdmin webmaster@domain2.com
        ServerName domain2.com
        DocumentRoot /git/domain2.com/public/

        #   SSL Engine Switch:
        #   Enable/Disable SSL for this virtual host.
        SSLEngine on

        #   A self-signed (snakeoil) certificate can be created by installing
        #   the ssl-cert package. See
        #   /usr/share/doc/apache2.2-common/README.Debian.gz for more info.
        #   If both key and certificate are stored in the same file, only the
        #   SSLCertificateFile directive is needed.
        SSLCertificateFile /git/domain2.com/apache/ssl/apache.crt
        SSLCertificateKeyFile /git/domain2.com/apache/ssl/apache.key

    <Directory /git/domain2.com/public/>
        Options +Indexes +FollowSymLinks -MultiViews
        AllowOverride All
        Require all granted
    </Directory>
    ErrorLog /var/log/apache2/error_domain2.com.log

</VirtualHost>

</IfModule>

Answer 1

*:443 is a NameVirtualHost
 default server domain2.com (/etc/apache2/sites-enabled/domain2.com.conf:19)
 port 443 namevhost domain2.com (/etc/apache2/sites-enabled/domain2.com.conf:19)
 port 443 namevhost www.domain1.com (/etc/apache2/sites-enabled/domain1.com.conf:19)
     alias domain1.com
     wild alias *.domain1.com

Since the default server is domain2.com, the HTTPS requests that come from a non-SNI supported browser will probably be redirected to domain2.com, even you are intended to access www.domain1.com.

And one more possibility you may investigate on, if you are sure that the client is supporting SNI, then check whether the installed OpenSSL is supporting TLS and your Apache is built with that OpenSSL version. Both server side and client side prerequisites must be fulfilled in order to make a name-based Apache Virtual Host to handle requests correctly.

Update 1

You may see an error log like Init: Name-based SSL virtual hosts require an OpenSSL version with support for TLS extensions (RFC 6066 - Server Name Indication / SNI), but the currently used library version (%s) is lacking this feature in your error log when you started your server.

Update 2

And also, although the result of apachectl -S

  port 443 namevhost www.domain1.com (/etc/apache2/sites-enabled/domain1.com.conf:19)
     alias domain1.com
     wild alias *.domain1.com

is showing *.domain1.com or domain1.com will be handled as www.domain1.com, in your domain1.conf

<VirtualHost *:443>

        ServerAdmin webmaster@domain1.com
        ServerName domain1.com

is not defining any alias for this virtual host, so I am wondering whether this virtual host will handle requests like what you assumed.