Apache always loads the same vhost

Question

I have the following vhosts. However the vhosts always seem to resolve to app.home when using https, the only way to make it load cloud.home is by removing app.home from the vhosts. Whichs leads me to believe that it ignores the ServerName setting.

app.home.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>
   ServerName app.home
  ProxyPreserveHost On
  ProxyRequests off
  ProxyPass /api/websocket ws://localhost:8123/api/websocket disablereuse=on keepalive=on
  ProxyPassReverse /api/websocket ws://localhost:8123/api/websocket disablereuse=on
  ProxyPass / http://localhost:8123/ disablereuse=on keepalive=on
  ProxyPassReverse / http://localhost:8123/ disablereuse=on#`

  RewriteEngine on
  RewriteCond %{HTTP:Upgrade} =websocket [NC]
  RewriteRule /(.*)  ws://localhost:8123/$1 [P,L]
  RewriteCond %{HTTP:Upgrade} !=websocket [NC]
  RewriteRule /(.*)  http://localhost:8123/$1 [P,L]

SSLCertificateFile /etc/letsencrypt/live/app.home/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/app.home/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

cloud.home.conf

<IfModule mod_ssl.c>
<VirtualHost *:443>
    ServerName cloud.home
    DocumentRoot "/var/www/cloud"

        <Directory />
                Options FollowSymLinks
                AllowOverride None
        </Directory>
        <Directory /var/www/cloud/>
                Options Indexes FollowSymLinks MultiViews
                AllowOverride All
                Order allow,deny
                allow from all
        </Directory>

        ErrorLog ${APACHE_LOG_DIR}/cloud.home.log

        # Possible values include: debug, info, notice, warn, error, crit,
        # alert, emerg.
        LogLevel warn

        CustomLog ${APACHE_LOG_DIR}/cloud.home.access.log combined

SSLCertificateFile /etc/letsencrypt/live/cloud.home/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/cloud.home/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>
</IfModule>

Answer 1

Apache receives an encrypted connection on port 443. It then negotiates the certificate with the client's browser. But at this point, it has not read the requested domain yet. It must negotiate the certificate first to decrypt the payload.

So Apache will always use the first VirtualHost it finds that matches port 443. It gets the certificate from this one.

To fix that, you have to:

• setup a second IP for your second domain. So Apache will be configured to say domain1 == IP1, domain2 == IP2.
• Use a different port for the second domain, like :444. But this is not convenient since it is not the default.
• Use SNI. Do some research on this, too long for an explication here.