Other site served on a multisite Apache server when 2nd SSL certificate introduced

Question

I have an Apache service running on an Ubuntu server with two completely different websites i.e. different domains.

They each have a separate VirtualHost configuration and, until recently, only one of them was served over HTTPS.

This morning when I introduced a new SSL certificate for the second site and altered the VirtualHost configuration accordingly (listen on port 443 instead, point it to the cert files etc.), instead of serving the second site as expected, it served the original HTTPS site instead.

If someone could help me out I'd greatly appreciate it.

Here's the (sanitised) VirtualHost files:

First site - the one that keeps doing the overriding

<VirtualHost *:443>

ServerAdmin webmaster@localhost
ServerName www.first-site.com
ServerAlias some similar names
DocumentRoot /var/www/first-site.com/

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

#SSL config
SSLEngine on
SSLProtocol -All +TLSv1.2
SSLCertificateFile /etc/apache2/ssl/first-site/firstsite-certificate.crt
SSLCertificateKeyFile /etc/apache2/ssl/first-site/firstsite.key
SSLCertificateChainFile /etc/apache2/ssl/first-site/firstsitechain.crt

.....More site-specific rules.....

Second site - the one that keeps getting overridden

<VirtualHost *:443>
ServerAdmin webmaster@localhost
ServerName second-site.com
ServerAlias some similar names
DocumentRoot /var/www/secondsite/htdocs
ErrorLog /var/log/apache2/secondsite-error.log
CustomLog /var/log/apache2/secondsite-access.log combined

SSLEngine on
SSLProtocol -All +TLSv1.2
SSLCertificateFile /etc/apache2/ssl/secondsite/secondsite.crt
SSLCertificateKeyFile /etc/apache2/ssl/secondsite/secondsite.key
SSLCertificateChainFile /etc/apache2/ssl/secondsite/secondsitechain.crt

.....More site-specific rules.....

I had a look in the logs but this isn't popping up. Perhaps that's just my grep-fu though...

Anyone experienced something similar? Need more info?

Answer 1

Keyword: SNI (Server Name Indication)

Looks like either your server or your client is missing SNI support, see

https://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

To test whether your server is returning SNI header information you may try

openssl s_client -servername www.SERVERNAME.com -tlsextdebug -connect www.YOURSERVER.com:443 2>/dev/null | grep "server name"

see https://serverfault.com/questions/506177/how-can-i-detect-if-a-server-is-using-sni-for-https

You may also try such SSL Server Test https://www.ssllabs.com/ssltest/ The "Handshake Simulation" should give you something like this for older clients:

Android 2.3.7 No SNI Incorrect certificate because this client doesn't support SNI

but matching certificates for the newer clients.

BTW here somebody had a similar problem https://serverfault.com/questions/510132/apache-sni-namevhosts-always-route-to-first-virtualhost-entry