Webuser Forums: Apache 2 and SSL

Actually, I did end up finding a solution myself. I had been trying to verify that the apache was actually handing the traffic on port 443 over to SSL and that everything was getting through my firewalls to where it needed to be.
'openssl s_client -connect localhost:443'
Proved that traffic was getting through on port 443 but apache was trying to deal with the traffic itself instead of sending it through SSL.
As it turned out the problem was a series of little things with apache itself and all my futzing with certificates was pointless. First problem was the stupidest, I was starting apache with './apachectl start' instead of './apachectl startssl', then there were also some problems with my httpd.conf.

I had to alter my 'NameVirtualHost' line to include the port 80, and make a duplicate for port 443. Finally I had to duplicate all of my 'VirtualHost' blocks to have one standard port 80 version, and one SSL configured port 443 version.

Just for fun and to make everything look a little better I put all the SSL 'VirtualHost' blocks and the extra 'NameVirtualHost' statement inside an '<IfDefine SSL></IfDefine>' block.

And hooray, SSL works! only problem now is that I've discovered that you can only have one SSL certificate per IP. So the only way to have multiple virtualhosts each with their own cert is to use IP based virtualhosting instead of the name based setup I've got now.

Here's a modified version of the relevant portion of my httpd.conf, hope this clears up any of the muck from above.

Code:


NameVirtualHost 192.168.1.2:80
<IfModule mod_ssl.c>
  SSLRandomSeed startup builtin
  SSLRandomSeed connect builtin

  NameVirtualHost 192.168.1.2:443
</IfModule>
Listen *:80
ServerName my.servername.example.com


<IfDefine SSL>
    Listen *:443

    AddType application/x-x509-ca-cert .crt
    AddType application/x-pkcs7-crl    .crl

    SSLPassPhraseDialog  builtin
    
    SSLSessionCache         dbm:/usr/local/apache2/logs/ssl_scache
    SSLSessionCacheTimeout  300

    SSLMutex  file:/usr/local/apache2/logs/ssl_mutex
    <VirtualHost 192.168.1.2:443>
        ServerAdmin admin@example.com
        DocumentRoot /usr/local/apache2/htdocs
        ServerName my.servername.example.com
        ErrorLog logs/my.servername.example.com-error_log-ssl
        TransferLog logs/my.servername.example.com-access_log-ssl
        ScriptAlias /cgi-bin/ /usr/local/apache2/cgi-bin/

        SSLEngine on
        SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
        SSLCertificateFile /usr/local/apache2/conf/ssl/www.crt
        SSLCertificateKeyFile /usr/local/apache2/conf/ssl/www.pem
        <Files ~ "\.(cgi|shtml|phtml|php3?)$">
            SSLOptions +StdEnvVars
        </Files>
        <Directory "/usr/local/apache2/cgi-bin">
            SSLOptions +StdEnvVars
        </Directory>

        SetEnvIf User-Agent ".*MSIE.*" \
                 nokeepalive ssl-unclean-shutdown \
                 downgrade-1.0 force-response-1.0
    </VirtualHost>
    
    <VirtualHost 192.168.1.2:443>
        ServerAdmin admin@example.com
        DocumentRoot /home/vhost2/public_html
        ServerName vhost2.servername.example.com
        ErrorLog logs/vhost2.servername.example.com-error_log-ssl
        TransferLog logs/vhost2.servername.example.com-access_log-ssl
        ScriptAlias /cgi-bin/ /usr/local/apache2/cgi-bin/

        SSLEngine on
        SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
        SSLCertificateFile /usr/local/apache2/conf/ssl/vhost2.crt
        SSLCertificateKeyFile /usr/local/apache2/conf/ssl/vhost2.pem
        <Files ~ "\.(cgi|shtml|phtml|php3?)$">
            SSLOptions +StdEnvVars
        </Files>
        <Directory "/usr/local/apache2/cgi-bin">
            SSLOptions +StdEnvVars
        </Directory>

        SetEnvIf User-Agent ".*MSIE.*" \
                 nokeepalive ssl-unclean-shutdown \
                 downgrade-1.0 force-response-1.0
    </VirtualHost>
    
    <VirtualHost 192.168.1.2:443>
        ServerAdmin admin@example.com
        DocumentRoot /home/vhost3/public_html
        ServerName vhost3.servername.example.com
        ErrorLog logs/vhost3.servername.example.com-error_log-ssl
        TransferLog logs/vhost3.servername.example.com-access_log-ssl
        ScriptAlias /cgi-bin/ /usr/local/apache2/cgi-bin/

        SSLEngine on
        SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
        SSLCertificateFile /usr/local/apache2/conf/ssl/vhost3.crt
        SSLCertificateKeyFile /usr/local/apache2/conf/ssl/vhost3.pem
        <Files ~ "\.(cgi|shtml|phtml|php3?)$">
            SSLOptions +StdEnvVars
        </Files>
        <Directory "/usr/local/apache2/cgi-bin">
            SSLOptions +StdEnvVars
        </Directory>

        SetEnvIf User-Agent ".*MSIE.*" \
                 nokeepalive ssl-unclean-shutdown \
                 downgrade-1.0 force-response-1.0

        Options Includes MultiViews
    </VirtualHost>
</IfDefine>


<VirtualHost 192.168.1.2:80>
    ServerAdmin admin@example.com
    DocumentRoot /usr/local/apache2/htdocs
    ServerName my.servername.example.com
    ErrorLog logs/my.servername.example.com-error_log
    TransferLog logs/my.servername.example.com-access_log
    ScriptAlias /cgi-bin/ /usr/local/apache2/cgi-bin/
    Options Includes MultiViews
</VirtualHost>

<VirtualHost 192.168.1.2:80>
    ServerAdmin admin@example.com
    DocumentRoot /home/vhost2/public_html
    ServerName vhost2.servername.example.com
    ErrorLog logs/vhost2.servername.example.com-error_log
    TransferLog logs/vhost2.servername.example.com-access_log
</VirtualHost>

<VirtualHost vhost3.servername.example.com:80>
    ServerAdmin admin@example.com
    DocumentRoot /home/vhost3/public_html
    ServerName vhost3.servername.example.com
    ErrorLog logs/vhost3.servername.example.com-error_log
    TransferLog logs/vhost3.servername.example.com-access_log
</VirtualHost>