Apache 2.4 with self-signed certificates always redirect to the default virtual host

Question

I've been trying to make work virtual hosts with self-signed certificates with Apache 2.4. I've tried many setup combinations but no matter what, every virtual host I try in Firefox goes straight to the default one (after clearing the cache). The only error message I get is in Apache error.log (none of the subdomain virtual host logs have error messages):

[Mon Jun 17 19:32:48.866641 2019] [ssl:debug] [pid 3084] ssl_engine_kernel.c(2122): [client 192.168.1.100:57956] AH02044: No matching SSL virtual host for servername subdomain.7d.net found (using default/first virtual host)

The current setup is an IP-based virtual hosting (one physical IP address used by the default host and many virtual IP addresses used to many virtual hosts, one-to-one). Before that Apache was using a name-based virtual hosting with just one physical IP address with the same behavior.

Every virtual host is using its own self-signed certificate, before that all virtual hosts were using a single one. No error message has been reported because of an SSL certificate. Every certificate match for its corresponding name. OpenSSL 1.1.0 was used to generate the certificates.

Besides the self-signed certificate Apache is using the Starfield Class 2 Certificate Authority.

There's no DNS server installed, there's just a /etc/hosts file, every IP address and hostname is working perfectly fine.

Apache 2.4.25 is running on Debian GNU/Linux «Stretch».

ports.conf (I tried putting Listed 443 directive outside the condition blocks, but the behavior was the same).

# If you just change the port or add more ports here, you will likely also
# have to change the VirtualHost statement in
# /etc/apache2/sites-enabled/000-default.conf

Listen 80

<IfModule ssl_module>
    Listen 443
</IfModule>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

001-default-ssl.conf

<IfModule mod_ssl.c>
    #<VirtualHost 192.168.1.201:443>
    <VirtualHost *:443>
        ServerAdmin webmaster@localhost
        ServerName triplecero.7d.net
        #ServerAlias www.7d.net

        DocumentRoot /var/www/html

        LogLevel info ssl:debug

        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined

        Include conf-available/serve-cgi-bin.conf

        SSLEngine On

        SSLCertificateFile /etc/ssl/localcerts/triplecero.7d.net.crt
        SSLCertificateKeyFile /etc/ssl/localcerts/triplecero.7d.net.key

        SSLCACertificateFile /etc/ssl/certs/Starfield_Class_2_CA.pem

        SSLVerifyClient optional
        SSLVerifyDepth  10

        SSLOptions +FakeBasicAuth +ExportCertData +StrictRequire
        <FilesMatch "\.(cgi|shtml|phtml|php)$">
                SSLOptions +StdEnvVars
        </FilesMatch>
        <Directory /usr/lib/cgi-bin>
                SSLOptions +StdEnvVars
        </Directory>

         BrowserMatch "MSIE [2-6]" \
                nokeepalive ssl-unclean-shutdown \
                downgrade-1.0 force-response-1.0

    </VirtualHost>
</IfModule>

subdomain.conf

<VirtualHost 192.168.1.210:433>
#<VirtualHost subdomain.7d.net:433>
    ServerName subdomain.7d.net
    DocumentRoot "/var/www/subdomain"
    DirectoryIndex index.php

    LogLevel info ssl:debug

    CustomLog ${APACHE_LOG_DIR}/subdomain-access.log combined
    ErrorLog ${APACHE_LOG_DIR}/subdomain-error.log

    SSLEngine On

    SSLCertificateFile "/etc/ssl/localcerts/subdomain.7d.net.crt"
    SSLCertificateKeyFile "/etc/ssl/localcerts/subdomain.7d.net.key"

    SSLCACertificateFile "/etc/ssl/certs/Starfield_Class_2_CA.pem"

    SSLVerifyClient optional
    SSLVerifyDepth 10

    <Directory "/var/www/subdomain">
        Redirect "http://subdomain.7d.net" "https://subdomain.7d.net"
        Require all granted
        AllowOverride All
    </Directory>
</VirtualHost>

Apache2 status:

triplecero:~# apache2ctl -S
VirtualHost configuration:
192.168.1.210:433      subdomain.7d.net (/etc/apache2/sites-enabled/grupoglobaleyr.conf:3)

[ many others VirtualHosts ommitted ]

*:80                   triplecero.7d.net (/etc/apache2/sites-enabled/000-default.conf:2)
*:443                  is a NameVirtualHost
         default server triplecero.7d.net (/etc/apache2/sites-enabled/001-default-ssl.conf:3)
         port 443 namevhost triplecero.7d.net (/etc/apache2/sites-enabled/001-default-ssl.conf:3)
         port 443 namevhost triplecero.7d.net (/etc/apache2/sites-enabled/002-default-tls.conf:2)
ServerRoot: "/etc/apache2"
Main DocumentRoot: "/var/www/html"
Main ErrorLog: "/var/log/apache2/error.log"
Mutex default: dir="/var/run/apache2/" mechanism=default
Mutex mpm-accept: using_defaults
Mutex fcgid-pipe: using_defaults
Mutex watchdog-callback: using_defaults
Mutex rewrite-map: using_defaults
Mutex ssl-stapling-refresh: using_defaults
Mutex gnutls-cache: using_defaults
Mutex gnutls-ocsp: using_defaults
Mutex fcgid-proctbl: using_defaults
Mutex ssl-stapling: using_defaults
Mutex proxy: using_defaults
Mutex ssl-cache: using_defaults
PidFile: "/var/run/apache2/apache2.pid"
Define: DUMP_VHOSTS
Define: DUMP_RUN_CFG
User: name="www-data" id=33
Group: name="www-data" id=33
triplecero:~#

subdomain-error.log

[Tue Jun 18 00:05:46.274025 2019] [ssl:info] [pid 3050] AH01914: Configuring server subdomain.7d.net:443 for SSL protocol
[Tue Jun 18 00:05:46.274415 2019] [ssl:debug] [pid 3050] ssl_engine_init.c(1756): AH02209: CA certificate: OU=Starfield Class 2 Certification Authority,O=Starfield Technologies\\, Inc.,C=US
[Tue Jun 18 00:05:46.274481 2019] [ssl:debug] [pid 3050] ssl_engine_init.c(413): AH01893: Configuring TLS extension handling
[Tue Jun 18 00:05:46.340584 2019] [ssl:debug] [pid 3050] ssl_util_ssl.c(443): AH02412: [subdomain.7d.net:443] Cert matches for name 'subdomain.7d.net' [subject: emailAddress=triplecerogmail.com,CN=subdomain.7d.net,OU=Development,O=ZZZ Corp.,L=Skycity,ST=Highstate,C=XX / issuer: emailAddress=triplecerogmail.com,CN=subdomain.7d.net,OU=Development,O=ZZZ Corp.,L=Skycity,ST=Highstate,C=XX / serial: B06BB41BBE840955 / notbefore: Jun 16 22:00:11 2019 GMT / notafter: Jun 15 22:00:11 2020 GMT]
[Tue Jun 18 00:05:46.340606 2019] [ssl:info] [pid 3050] AH02568: Certificate and private key subdomain.7d.net:443:0 configured from /etc/ssl/localcerts/subdomain.7d.net.crt and /etc/ssl/localcerts/subdomain.7d.net.key

Answer 1

The cause of the redirection was a wrong logical port (433 instead 443) set in the VirtualHost directive (actually, in every virtual host).

The 433 port never has been declared in the Apache ports.conf file, so none virtual host was found causing a redirection to the default SSL virtual host.

Thanks to @Freddy for spotting the "little big" mistake.

Answer 2

"(none of the subdomain virtual host logs have error messages)"

That was (should have been) your clue. :) There are several (conf) files in play here. I'm guessing you've (basically) omitted the extra/httpd-vhosts.conf. Which defines all/any of your virtual hosts.

version 2.4 has become more modular than it's predecessors. So most of the old methods either don't work, or have been moved.

apache24/httpd.conf holds global configuration, and the primary host/IP stuff.

apache24/extra/httpd-vhosts.conf common Virtual Host definitions.

# PRIMARY (default) Vhost
# Everything is on a SECURE socket. Redirect accordingly

<VirtualHost *:80>
    ServerName main-domain.vhost
    Redirect permanent / https://main-domain.vhost/
</VirtualHost>
# another Vhost on same IP but with different name
<VirtualHost *:80>
    ServerName another-domain.vhost
    Redirect permanent / https://another-domain.vhost/
</VirtualHost>

...

####################################################################
#NameVirtualHost *:443
####################################################################
# MAIN Vhost
<VirtualHost *:443>
    ServerAdmin me@localhost
    DocumentRoot "/usr/local/www/data"
    ServerName main-domain.vhost
    ServerAlias www.main-domain.vhost

SSLEngine on
SSLCertificateFile "/usr/local/etc/letsencrypt/live/main-domain.vhost/cert.pem"
SSLCertificateKeyFile "/usr/local/etc/letsencrypt/live/main-domain.vhost/privkey.pem"
SSLCertificateChainFile "/usr/local/etc/letsencrypt/live/main-domain.vhost/fullchain.pem"
# HSTS (mod_headers is required) (15768000 seconds = 6 months)
# HSTS (mod_headers is required) (7884000 seconds = 3 months)
    Header always set Strict-Transport-Security "max-age=15768000"

...

</VirtualHost>

# We now need to include our INDIVIDUAL/ADDITIONAL (V) hosts
# We do so thusly

# They all run on a SSL
Include etc/apache24/extra/hosts/another-domain.vhost.conf

# NOTE above, the .conf files live in a SUBdirectory of the "extra" folder (hosts)

OK Now we go on to the individual Vhosts .conf files

apache24/extra/hosts/*.conf

apache24/extra/hosts/another-domain.vhost.conf

# # # # # # # # # # # # # # # # # # # # # # # #
# # #   another-domain.vhost
# # # # # # # # # # # # # # # # # # # # # # # #
<VirtualHost *:443>
    ServerAdmin me@localhost
    DocumentRoot "/usr/local/www/another-domain.vhost"
    ServerName another-domain.vhost
    ServerAlias www.another-domain.vhost


SSLEngine on
SSLCertificateFile "/usr/local/etc/letsencrypt/live/another-domain.vhost/cert.pem"
SSLCertificateKeyFile "/usr/local/etc/letsencrypt/live/another-domain.vhost/privkey.pem"
SSLCertificateChainFile "/usr/local/etc/letsencrypt/live/another-domain.vhost/fullchain.pem"
# HSTS (mod_headers is required) (15768000 seconds = 6 months)
# HSTS (mod_headers is required) (7884000 seconds = 3 months)
    Header always set Strict-Transport-Security "max-age=15768000"

...

</VirtualHost>

That's all the pertinent info required in your file(s) to satisfy apache(2.4). As you can see I'm 1) using "letsencrypt" as my cert provider, and 2) I'm sharing examples from one of my BSD boxes. But that only changes the root of the Apache install path. Everything from apache24 (including the folder apache24 should be identical. So if you follow along, you should be set.

That doesn't guarantee your Certs will pass muster. But that's for a different thread. :)

HTH