I have an apache installation with some name-based vhosts and a SSL certficate with CN=
maindomain.com and DNS Alternative Names for the all the vhosts (sub)domains.
However, this setup gives warnings in the logs in the form:
[Fri Jan 03 16:52:38 2014] [warn] RSA server certificate CommonName (CN) `maindomain.com' does NOT match server name!? [Fri Jan 03 16:52:38 2014] [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
While working, I should say that Name-based SSL vhosts are irrelevant because the certificate is for all vhosts. Furthermore I would say the CN matches the main ServerName. Is there any way to fix this and clear the logs?
Distilled configuration is as follows:
Servername maindomain.com <VirtualHost *:80> ServerName www.maindomain.com DocumentRoot /var/www/www.maindomain.com/public_html/ </VirtualHost> <VirtualHost *:443> ServerName www.maindomain.com Include ssl.vhost.conf DocumentRoot /var/www/www.maindomain.com/public_html/ </VirtualHost> <VirtualHost *:80> ServerName altdomain.com DocumentRoot /var/www/altdomain.com/public_html/ </VirtualHost> <VirtualHost *:443> ServerName altdomain.com Include ssl.vhost.conf DocumentRoot /var/www/altdomain.com/public_html/ </VirtualHost> # More vhosts in the same way, sometimes tld's sometimes subdomains
ssl.vhost.conf as follows:
SSLEngine ON SSLProtocol all -SSLv2 SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM SSLCertificateFile /etc/certificates/maindomain.com.crt SSLCertificateKeyFile /etc/certificates/maindomain.com.key SSLCertificateChainFile /etc/certificates/ca-intermediate.crt SSLCACertificateFile /etc/certificates/ca.crt