Join Log in
Score:0
avatar Server

Apache VirtualHost not loading correct certificate

ke flag
JoeSlav

We are running into issues with this seemingly simple configuration on Apache 2.4. We can't seem to obtain the correct certificate while using the Virtual Host site2.net. We always get site1.net's certificate. Here's our apacectl -S:

VirtualHost configuration:
*:446                  is a NameVirtualHost
         default server site1.net (/opt/rh/httpd24/root/etc/httpd/sites-enable/site1.conf:3)
         port 446 namevhost site1.net (/opt/rh/httpd24/root/etc/httpd/sites-enable/site1.conf:3)
         port 446 namevhost site2.net (/opt/rh/httpd24/root/etc/httpd/sites-enable/site2.conf:3)
*:444                  other.net (/opt/rh/httpd24/root/etc/httpd/sites-enable/other.conf:2)

Here's the VH configurations:

$ cat /opt/rh/httpd24/root/etc/httpd/sites-enable/site1.conf
<VirtualHost *:446>
    ServerName site1.net
    DocumentRoot /www/site1
    <Directory /www/site1>
        AllowOverride All
        Require all granted
    </Directory>
    SSLEngine on
    SSLCertificateKeyFile /opt/rh/httpd24/root/etc/httpd/conf/certs/site1.key
    SSLCertificateFile /opt/rh/httpd24/root/etc/httpd/conf/certs/site1.pem
</VirtualHost>

$ cat /opt/rh/httpd24/root/etc/httpd/sites-enable/site2.conf
<VirtualHost *:446>
    ServerName site2.net
    DocumentRoot "/www/site1/xyz"
    <Directory "/www/site1/xyz">
         AllowOverride All
         Require all granted
         Options -Indexes
    </Directory>
    SSLCertificateKeyFile /opt/rh/httpd24/root/etc/httpd/conf/certs/site2.key
    SSLCertificateFile /opt/rh/httpd24/root/etc/httpd/conf/certs/site2.pem
</VirtualHost>

The conf file /opt/rh/httpd24/root/etc/httpd/conf.d/ssl.conf has not VirtualHost defined. If we swap the certs and have the first Virtual Host loading the second certificate we see it correctly (i.e. there is no issue with the certificate itself).

We are testing with openssl s_client -connect myip:446 -servername site2.net

Why are we getting this strange behavior? Thanks a lot!

50
0 + 0
cn flag
Bob
That appears to suggest that SNI is not working/used. That may be an issue in the Apache configuration, the openssl cli tool and/or both. Does a different test, for example with `curl –resolve site2.net:446:myip https://site2.net:446/` show the same behaviour ?
0
Reply
ke flag
JoeSlav
Same behavior with curl, thanks!
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.