13

I have a Debian server which is running a number of client sites. Most of these are not running SSL so accessing by HTTP is fine.

I have one customer with an SSL certificate and accessing their site via HTTPS is fine too.

The problem comes if you try to access one of the other sites with HTTPS you get directed to the other site that has the SSL certificate.

For instance, lets say we have the following sites on the server:

alpha.net
bravo.net
charlie.net (SSL)
delta.net

So as you can see, charlie is the only one with SSL, and irrespective of if you go to http charlie.net or https charlie.net, it works fine.

http to all the other sites is fine, but if you were to go to https alpha.net, it will initially come up with an Invalid Certificate error and let you continue but whilst it has alpha.net in the address bar, its actually showing the charlie.net site in the browser.

I have researched SNI and how if any other sites have SSL I'll need to put them all on specific IP addresses (something else I need to try to work out how to do as I have no idea) but I am not sure why this is happening or how I resolve it.

Has anyone else encountered this before and how did you get around it?

Many thanks,

Rob

Rob
  • 135
  • 1
  • 6
  • I've researched this further still and I have found out that its because the only apache site configuration file including 443 is charlie.net. As this is the only one to include it, even if you try going to https and one of the other domains you go to charlie.net because its the only one with https. So that makes perfect sense. What I don't know how to do now is to setup 443 and give it an https instruction to redirect to http because there is no certificate. So if anyone know's how to do that I would appreciate it. – Rob Oct 02 '13 at 08:07
  • 1
    joon noticed the same problem on Webmasters SE: [“https://” refers to random site, “http://” is broken, but “http://www” works](http://webmasters.stackexchange.com/q/55685/17633) – unor Dec 02 '13 at 00:55

2 Answers2

2

This does not have anything to do with SNI, as you currently only have one HTTPS server. What happens, as you've stated in your comment, is that the alpha.net domain resolves to your server's IP. Your Apache server is set up to listen for requests on port 443 on this IP, and to serve the contents of charlie.net to these requests. (And the certificate error means that the browser noticed the discrepancy between the certificate's alleged domain name and the domain name used for the request.)

Redirecting from HTTPS to HTTP is probably more trouble that it's worth, since you would need valid certificates for each domain, lest you present your users with another security warning. This would entail creating virtual hosts for alpha.net:443 and so on, on an SNI capable server (i.e., later versions of Apache 2.2+ with openssl), and adding a redirection like so:

RewriteEngine On 
RewriteCond %{HTTPS} on 
RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI}

Probably the easiest course for your problem is to use a different IP for charlie.net. With this setup, there would be no way for alpha.net (and so on) to display the contents of another site.

louije
  • 101
  • 1
  • 4
1

If you have multiple IPs on your server, use a unique one for the SSL site, all non-SSL sites share another IP.

Since SSL doesn't care what is the domain you are visiting, it only cares if the current domain is approved from the list of domains(Common Name) it gets from the Ip address.

Shiji.J
  • 1,561
  • 2
  • 17
  • 31