0

I have an Apache service running on an Ubuntu server with two completely different websites i.e. different domains.

They each have a separate VirtualHost configuration and, until recently, only one of them was served over HTTPS.

This morning when I introduced a new SSL certificate for the second site and altered the VirtualHost configuration accordingly (listen on port 443 instead, point it to the cert files etc.), instead of serving the second site as expected, it served the original HTTPS site instead.

If someone could help me out I'd greatly appreciate it.

Here's the (sanitised) VirtualHost files:

First site - the one that keeps doing the overriding

<VirtualHost *:443>

ServerAdmin webmaster@localhost
ServerName www.first-site.com
ServerAlias some similar names
DocumentRoot /var/www/first-site.com/

ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined

#SSL config
SSLEngine on
SSLProtocol -All +TLSv1.2
SSLCertificateFile /etc/apache2/ssl/first-site/firstsite-certificate.crt
SSLCertificateKeyFile /etc/apache2/ssl/first-site/firstsite.key
SSLCertificateChainFile /etc/apache2/ssl/first-site/firstsitechain.crt

.....More site-specific rules.....

Second site - the one that keeps getting overridden

<VirtualHost *:443>
ServerAdmin webmaster@localhost
ServerName second-site.com
ServerAlias some similar names
DocumentRoot /var/www/secondsite/htdocs
ErrorLog /var/log/apache2/secondsite-error.log
CustomLog /var/log/apache2/secondsite-access.log combined

SSLEngine on
SSLProtocol -All +TLSv1.2
SSLCertificateFile /etc/apache2/ssl/secondsite/secondsite.crt
SSLCertificateKeyFile /etc/apache2/ssl/secondsite/secondsite.key
SSLCertificateChainFile /etc/apache2/ssl/secondsite/secondsitechain.crt

.....More site-specific rules.....

I had a look in the logs but this isn't popping up. Perhaps that's just my grep-fu though...

Anyone experienced something similar? Need more info?

2

Keyword: SNI (Server Name Indication)

Looks like either your server or your client is missing SNI support, see

https://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

To test whether your server is returning SNI header information you may try

openssl s_client -servername www.SERVERNAME.com -tlsextdebug -connect www.YOURSERVER.com:443 2>/dev/null | grep "server name"

see https://serverfault.com/questions/506177/how-can-i-detect-if-a-server-is-using-sni-for-https

You may also try such SSL Server Test https://www.ssllabs.com/ssltest/ The "Handshake Simulation" should give you something like this for older clients:

Android 2.3.7 No SNI Incorrect certificate because this client doesn't support SNI

but matching certificates for the newer clients.

BTW here somebody had a similar problem https://serverfault.com/questions/510132/apache-sni-namevhosts-always-route-to-first-virtualhost-entry

  • Makes sense. It's definitely not the client and the openssl version is 1.0.2 so SNI should be enabled by default in that so it must be how Apache was setup. Leaving this open for now just in case though. – I_GNU_it_all_along Oct 18 '16 at 11:57
  • From the link you sent I tried setting the SSLStrictSNIVHostCheck directive to both off and on and testing but no joy. The fact that I receive the following when restarting Apache says to me that the server does actually support it though: Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support – I_GNU_it_all_along Oct 18 '16 at 12:26
  • I've added some lines to check the server without having your local clients involved. – rudimeier Oct 18 '16 at 13:18
  • Thanks for that, taking a look now. Chances are I'm just going to migrate one of the sites to another server though. Can't really run the risk of older clients being served the other site. – I_GNU_it_all_along Oct 18 '16 at 13:25
  • Cheers for the help buddy. I'm surprised at the whole "just wait it out" approach on there but it does sound like some sort of server caching issue as the asker suggested in the case of your final edit. I've at the very least got a couple of solutions I can now go back to my boss with anyway. Much appreciated. – I_GNU_it_all_along Oct 18 '16 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.