According to the Apache documentation, it is not possible to use Name-Based Virtual Hosting to identify different SSL virtual hosts, unless you use Apache 2.2.12 or later web server, built with 0.9.8j or later OpenSSL.

Is that the case?

http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts2

“It is possible, but only if using a 2.2.12 or later web server, built with 0.9.8j or later OpenSSL. This is because it requires a feature that only the most recent revisions of the SSL specification added, called Server Name Indication (SNI).

The reason is that the SSL protocol is a separate layer which encapsulates the HTTP protocol. So the SSL session is a separate transaction, that takes place before the HTTP session has begun. The server receives an SSL request on IP address X and port Y (usually 443). Since the SSL request did not contain any Host: field, the server had no way to decide which SSL virtual host to use. Usually, it just used the first one it found which matched the port and IP address specified.”

My openssl.conf has “subjectAltName=${ENV::SAN}” in the [ usr_crt ] section, and I set the environment variable (eg “export SAN=’DNS:‘”) before running the openssl commands to create the certificate.

1 NameVirtualHost 84.200.208.192:80
2 NameVirtualHost 84.200.208.192:443
3
4
5 ServerName suretodie.de
6 ServerAlias http://www.suretodie.de
7 ServerAdmin admin@suretodie.de
8 DocumentRoot /var/www/web1/web/
9
10
11 SuexecUserGroup web1 web1
12 PHP_Fix_Pathinfo_Enable 1
13
14 Options +ExecCGI
15 AllowOverride All
16 AddHandler fcgid-script .php
17 FCGIWrapper /var/www/php-fcgi-scripts/web1/php-fcgi-starter .php
18 Order allow,deny
19 Allow from all
20
21
22
23 # ErrorLog /var/log/apache2/error.log
24 # CustomLog /var/log/apache2/access.log combined
25 ServerSignature Off
26
27 SSLEngine On
28 SSLCertificateFile /etc/apache2/ssl/suretodie.crt
29 SSLCertificateKeyFile /etc/apache2/ssl/suretodie.key
30
31
32
33 #Redirects
34 # Not SSL, redirect to https://qmail.suretodie.de
35
36 ServerName qmail.suretodie.de
37 Redirect / https://qmail.suretodie.de/
38
39
40
41 ServerName webmail.suretodie.de
42 Redirect / https://webmail.suretodie.de/
43
44
45
46
47 ServerName qmail.suretodie.de
48 ServerAdmin admin@suretodie.de
49 DocumentRoot /var/www/web1/qmailad/
50
51
52 SuexecUserGroup web1 web1
53 PHP_Fix_Pathinfo_Enable 1
54
55 Options +ExecCGI
56 AllowOverride All
57 AddHandler fcgid-script .php
58 FCGIWrapper /var/www/php-fcgi-scripts/web1/php-fcgi-starter .php
59 Order allow,deny
60 Allow from all
61
62
63
64 # ErrorLog /var/log/apache2/error.log
65 # CustomLog /var/log/apache2/access.log combined
66 ServerSignature Off
67
68
69
70 ServerName webmail.suretodie.de
71 ServerAdmin admin@suretodie.de
72 DocumentRoot /var/www/web1/webmail/
73
74
75 SuexecUserGroup web1 web1
76 PHP_Fix_Pathinfo_Enable 1
77
78 Options +ExecCGI
79 AllowOverride All
80 AddHandler fcgid-script .php
81 FCGIWrapper /var/www/php-fcgi-scripts/web1/php-fcgi-starter .php
82 Order allow,deny
83 Allow from all
84
85
86
87 # ErrorLog /var/log/apache2/error.log
88 # CustomLog /var/log/apache2/access.log combined
89 ServerSignature Off
90

“I configured my sites-enabled conf like yours, direkt SSL is working fine, but if I go to http://www.domain.com or xyz.domain.com I see a bad request (400) and a redirect to https://domain.com regardless what subdomain I used. (so the redirect is not working and http://www.domain.com didn’t work too) only the direkt SSL will work like https://test.domain.com the wildcard certificate works well with the direkt SSL connection, so it have to be the config :hmm: I’m not sure if the fcgi config have to be on every VirtualHost”

greets hackbard

I checked it with deleted cache in IE and Firefox, the same as before. With the IE nothing is shown, no error, no redirect, no index :hmm:
In firefox the same as belwo shows up.

I don’t get whats wrong :hmm:

my second domain shows the same error in FF, “go to https://suretodie.de”

:hmm:²