I have an problem with Apache and multiple SSL certificates. In case if i config it only for one domain, everithing works fine, but when i add another one as virtualhost it returns an error:
VirtualHost domain1.cz:443 overlaps with VirtualHost domain2.sk:443, the first has precedence, perhaps you need a NameVirtualHost directive
[Wed Nov 07 16:14:49 2012] [warn] NameVirtualHost *:443 has no VirtualHosts
I tried many combinations of virtualhosts configuration methods, but result are still very similar - First domain is correctly secured and second (domain2.sk) recive certificate from first one.
Please, can you help me with this kind of certificate configuration?
NameVirtualHost *:443
ServerName domain1.cz
DocumentRoot /var/www/www.domain1.cz/htdocs/
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile /etc/apache2/ssl/domain1.cz/ssl.crt
SSLCertificateKeyFile /etc/apache2/ssl/domain1.cz/ssl.key
SSLCertificateChainFile /etc/apache2/ssl/sub.class1.server.ca.pem
SSLCACertificateFile /etc/apache2/ssl/ca.pem
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
CustomLog /var/www/www.domain1.cz/logs/ssl-access.log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
LogLevel warn
ErrorLog /var/www/www.domain1.cz/logs/ssl-error.log
ServerName domain2.sk
DocumentRoot /var/www/www.domain2.sk/htdocs/
SSLEngine on
SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
SSLCertificateFile /etc/apache2/ssl/domain2.sk/ssl.crt
SSLCertificateKeyFile /etc/apache2/ssl/domain2.sk/ssl.key
SSLCertificateChainFile /etc/apache2/ssl/sub.class1.server.ca.pem
SSLCACertificateFile /etc/apache2/ssl/ca.pem
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
CustomLog /var/www/www.domain2.sk/logs/ssl-access.log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
LogLevel warn
ErrorLog /var/www/www.domain2.sk/logs/ssl-error.log
Answer
Each IP address/port can only serve one SSL certificate. In order to get more than one SSL to work, you'll either need another IP address (recommended) or bind the second SSL certificate to another port on your IP (functional, but a pain for your site visitors b/c the port has to be included in the URL). Check with your host, most of them make additional IP's available affordably.
This thread has more info.
Edit: I can't grammar.
No comments:
Post a Comment