Apache 2.4 ssl.conf的虚拟主机之一加载了错误的证书

Question

This ssl.conf file is included in Apache2.conf on a Ubuntu 16.04 LTS server, running Apache 2.4.

I made certificates with acme.sh from Letsencrypt which work flawlessly.

But after I added VirtualHost Domain4, it appeared that Domain4 uses the certificate from Domain1 as in the message of the (invalid for Domain4) certificate check when browsing to https://www.domain4.com , it shows up that it is meant for www.domain1.com.

All other ssl domains/ virtual hosts in this config file remain working normally.

I tried changing

<VirtualHost www.domainX.com:443>

to

<VirtualHost *:443>

for all virtual hosts, but that screwed up everything an none of the virtual hosts were working, so I reverted to this version.

What am I doing wrong ?

Here my ssl.conf (hostnames anonymized):

<IfModule mod_ssl.c>
Listen 443

NameVirtualHost *:443

        #    This enables optimized SSL connection renegotiation handling when SSL
        #    directives are used in per-directory context.
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                SSLOptions +StdEnvVars
        </Directory>



<VirtualHost www.domain1.com:443>
    ServerName www.domain1.com
        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn
                SSLEngine on
        ServerAdmin webmaster@domain1.com
        DocumentRoot /var/www/html/extra/www.domain1.com
        SSLCertificateFile  /root/.acme.sh/www.domain1.com/www.domain1.com.cer
        SSLCertificateKeyFile /root/.acme.sh/www.domain1.com/www.domain1.com.key
                SSLCertificateChainFile /root/.acme.sh/www.domain1.com/fullchain.cer
</VirtualHost>

<VirtualHost www.domain2.com:443>
        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn
                SSLEngine on
                ServerName www.domain2.com
        ErrorLog ${APACHE_LOG_DIR}/error-domain2.log
        CustomLog ${APACHE_LOG_DIR}/domain2.log combined
        ServerAdmin webmaster@domain1.com
#       ErrorDocument 404 /404.php
        DocumentRoot /var/www/html/extra/domain2.com
        SSLCertificateFile  /root/.acme.sh/www.domain2.com/www.domain2.com.cer
        SSLCertificateKeyFile /root/.acme.sh/www.domain2.com/www.domain2.com.key
    SSLCertificateChainFile /root/.acme.sh/www.domain2.com/fullchain.cer
</VirtualHost>

<VirtualHost www.domain3.com:443>
                # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
                # error, crit, alert, emerg.
                # It is also possible to configure the loglevel for particular
                # modules, e.g.
                #LogLevel info ssl:warn
                SSLEngine on
                ServerName www.domain3.com
                ErrorLog ${APACHE_LOG_DIR}/domain3-error.log
                CustomLog ${APACHE_LOG_DIR}/domain3.log combined
                ServerAdmin info@domain3.com
                ErrorDocument 404 /404.php
                DocumentRoot /var/www/html/extra/www.domain3.com
                SSLCertificateFile      /root/.acme.sh/www.domain3.com/www.domain3.com.cer
                SSLCertificateKeyFile /root/.acme.sh/www.domain3.com/www.domain3.com.key
                SSLCertificateChainFile /root/.acme.sh/www.domain3.com/fullchain.cer
</VirtualHost>


<VirtualHost www.domain4.com:443>
                # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
                # error, crit, alert, emerg.
                # It is also possible to configure the loglevel for particular
                # modules, e.g.
                #LogLevel info ssl:warn
#                SSLEngine on
                ServerName www.domain4.com
                ErrorLog ${APACHE_LOG_DIR}/domain4-error.log
                CustomLog ${APACHE_LOG_DIR}/domain4.log combined
                ServerAdmin info@domain4.com
                ErrorDocument 404 /404.php
                DocumentRoot /var/www/html/extra/www.domain4.com
                SSLCertificateFile      /root/.acme.sh/www.domain4.com/www.domain4.com.cer
                SSLCertificateKeyFile /root/.acme.sh/www.domain4.com/www.domain4.com.key
                SSLCertificateChainFile /root/.acme.sh/www.domain4.com/fullchain.cer
</VirtualHost>



<VirtualHost domain5.com:443>
                # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
                # error, crit, alert, emerg.
                # It is also possible to configure the loglevel for particular
                # modules, e.g.
                #LogLevel info ssl:warn

Include whitelist.conf

    SSLEngine on
    ServerName domain5.com

    ErrorLog ${APACHE_LOG_DIR}/domain5.com.error.log
    CustomLog ${APACHE_LOG_DIR}/domain5.com.access.log combined
   ServerAdmin webmaster@domain1.com
    DocumentRoot /var/www/html/extra/domain5.com
<Directory /var/www/html/extra/domain5.com>
    ErrorDocument 404 /index.php
</Directory>

    SSLCertificateFile    /root/.acme.sh/domain5.com/domain5.com.cer
    SSLCertificateKeyFile /root/.acme.sh/domain5.com/domain5.com.key
    SSLCertificateChainFile /root/.acme.sh/domain5.com/fullchain.cer
</VirtualHost>



<VirtualHost domain6.com:443>
        # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
        # error, crit, alert, emerg.
        # It is also possible to configure the loglevel for particular
        # modules, e.g.
        #LogLevel info ssl:warn
Include whitelist.conf
    SSLEngine on
    ServerName domain6.com

RewriteCond %{HTTPS} off
RewriteRule (.*) https://%{SERVER_NAME}/$1 [R,L]

#    CustomLog /var/log/apache2/secure_access.log combined
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        ServerAdmin webmaster@domain1.com
        DocumentRoot /var/www/html

<Directory /var/www/html/>
    ErrorDocument 404 /extra/apache/404.php
    ErrorDocument 403 /extra/apache/index.php
    ErrorDocument 401 /extra/apache/401.html
</Directory>

        SSLCertificateFile  /etc/apache2/ssl/domain6.com/domain6.com.cer
        SSLCertificateKeyFile /etc/apache2/ssl/domain6.com/domain6.com.key
                SSLCertificateChainFile /root/.acme.sh/domain6.com/fullchain.cer
</VirtualHost>



</IfModule>

Answer 1

I just had the same issue. In my case my vhosts were backend vhosts proxied to by a corresponding set of frontend vhosts. When I pointed my browser directly to the backend vhosts then I got the issue described above for one vhost. When I talked to the frontend vhosts then the correspoding vhost reported SSL proxy errors.

The cause was that all the ServerNames in the backend hosts were set to the public/frontend FQHNs; the one that was working was only working because it happened to be alphabetically the first and was therefore the default vhost. When I changed the backend ServerNames to be the backend FQHNs then it all worked as I wanted.

Summary: check that all your ServerNames are correct for their context (frontend/backend).