1

I have two virtual hosts using the same certificate... yet apache returns the localhost certificate for only one of them.

openssl s_client -connect 127.0.0.1:443 -servername domainA.com -tls1_1 shows that Apache's httpd is returning the localhost.crt X.509 certificate. However, openssl s_client -connect 127.0.0.1:443 -servername fake.com -tls1_1 shows the correct domainA.crt X.509 certificate.

As far as I can tell the configuration settings should be effectively the same for each domain.

ssl.conf

Listen 443 https
[... other preincluded defaults (probably) ...]
<VirtualHost _default_:443>
[...]
SSLEngine on
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
[... other preincluded defaults (probably) ...]
</VirtualHost>

httpd.conf

[...]
ServerRoot "/etc/httpd"
Listen 80
ServerName domainA.com:80
DocumentRoot "/var/www/html"
[... other preincluded defaults (probably) ...]
<VirtualHost *:443>
  VirtualDocumentRoot /var/www/html
  ServerName domainA.com:443
  ServerAlias domainA.com

  SSLEngine on
  SSLCertificateFile /etc/httpd/conf/domainA.crt
  SSLCertificateKeyFile /etc/httpd/conf/domainA.key
  SSLCACertificateFile /etc/httpd/conf/domainA.crt
</VirtualHost>

<VirtualHost *:443>
  VirtualDocumentRoot /var/www/html
  ServerName fake.com:443
  ServerAlias fake.com

  SSLEngine on
  SSLCertificateFile /etc/httpd/conf/domainA.crt
  SSLCertificateKeyFile /etc/httpd/conf/domainA.key
  SSLCACertificateFile /etc/httpd/conf/domainA.crt
</VirtualHost>

/etc/hosts

127.0.0.1 domainA.com fake.com localhost
[...]

order doesn't matter in /etc/hosts.

How do I get Apache to use domainA.{crt,key} for domainA.com?

$ httpd -version
Server version: Apache/2.4.6 (CentOS)
Server built:   Aug  8 2019 11:41:18
1

Turns out it was the global ServerName setting... why that should have any effect, especially considering that it shouldn't be used in the first place since http doesn't have any concept of or use for a "server name" when using virtual-host settings with SNI and the HTTP host header...

Just replace ServerName domainA.com:80 with ServerName why-are-you-even-asking-for-this-apache.damn-apache.you-must-break-stuff-on-purpose.your-literally-going-out-of-the-way-to-make-things-break.why-do-you-hate-us.info:80.

Problem solved.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.