wesayso.net
We know what you want. We know what you need. We know where you live.
We
have said so
First Published 3-11-2009
This
document describes a basic scheme to provide several secure encrypted
web hosts on a Linux system with only one IP address and each
host having it's own domain name and certificate.
So
you want
to have several secure virtual hosts but have been told that
you can't do it without assigning an IP address to each one.
You're in the right place.
Tell me I can't do something, I dare you. :)
This
took a lot of time in testing and getting it to work in
Firefox
and IE7. If you use this scheme you owe me a bottle of tequila. I
should tell you, I drive a bright red truck, state licensed 666MTB
(Marks The Beast) so pay up, or I'll get you! :)
Russ Kisling
"^[rustek]@[wesayso]\.[net]$"
This was developed in 2008/2009 for Agleos Inc.
You can't use name based virtual hosting for secure hosts because the
certs won't work right, so you have to use IP based virtual hosts, but
each has to have it's own IP address right,,, wrong, only one can be on
port 443 but you can have as many as you want on different ports all on
the same IP address.
Using one IP address and mod-rewrite for apache2 you can set up
example.com and www.example.com to point to:
https://www.example.com:56001/
And...
example2.com and www.example2.com to
point to:
https://www.example2.com:56002/
and so on, on and on, as many
as you want, and all the certs will work without complaining.
Just to clarify, you have to goto http://example.com or
http://www.example.com
and the address will be rewritten to:
https:/www.example.com:56001/
If you goto example.com/index99.html
it will rewrite to:
https://www.example.com:56001/index99.html
So:
example.com
www.example.com
https://www.example.com:56001
Will all work and will all be secure.
But:
https://example.com
https://www.example.com
Will
fail, and will even goto the wrong page if the user grants an exception
to the bad cert. Nothings perfect, but if you do it right, that wrong
page will always be an error page explaining what they did wrong or a redirect to the page they actually wanted. (that's what we do)
The pages are always called with http and always provided https.
And did I mention it won't complain about the cert?
Your looking at an
encrypted
page setup this way right now.
Our system is:
Ubuntu (intrepid)
apache2 2.2.9-7ubuntu3 installed
apache2-mpm-prefork 2.2.9-7ubuntu3 installed
apache2-utils 2.2.9-7ubuntu3 installed
apache2.2-common 2.2.9-7ubuntu3 installed
Obviously the apache version must be able to do ssl.
apache2
mod-rewrite and mod-ssl installed
#
a2enmod rewrite
# a2enmod
ssl
Below you will find sample httpd.conf sections.
They are written
to use
IP 192.168.10.1 for example*.com and www.example*.com
Common
section:
Shows three hosts.
#####
IP Based VirtualHost
#####
Redirects http://host.xyz and http://www.host.xyz
to Secure Host
Listen 192.168.10.1:80
<VirtualHost
192.168.10.1:80>
ServerName www.yourdomain42.org
#
change this
ServerAdmin admin@yourdomain42.org
# change this also
RewriteEngine on
RewriteCond
%{HTTP_HOST}
^example\.com
RewriteRule ^(.*) https://www.example.com:56001$1 [NC,R=301,L]
RewriteCond
%{HTTP_HOST}
^www\.example\.com
RewriteRule ^(.*) https://www.example.com:56001$1 [NC,R=301,L]
RewriteCond
%{HTTP_HOST}
^example2\.com
RewriteRule ^(.*) https://www.example2.com:56002$1 [NC,R=301,L]
RewriteCond
%{HTTP_HOST}
^www\.example2\.com
RewriteRule ^(.*) https://www.example2.com:56002$1 [NC,R=301,L]
RewriteCond
%{HTTP_HOST}
^example3\.com
RewriteRule ^(.*) https://www.example3.com:56003$1 [NC,R=301,L]
RewriteCond
%{HTTP_HOST}
^www\.example3\.com
RewriteRule ^(.*) https://www.example3.com:56003$1 [NC,R=301,L]
</VirtualHost>
Individual
sections:
Each host will need a section
like this.
#####
IP Based VirtualHost
##### The actual config for the secure host.
Listen 192.168.10.1:56001
<VirtualHost 192.168.10.1:56001>
ServerName www.example.com
ServerAdmin admin@example.com
# SSL Engine Switch:
# Enable/Disable SSL for this virtual
host.
SSLEngine on
#
... The rest of your config for this host.
Options...
Order...
</VirtualHost>
The error page section:
Note:
There are several ways of doing this part, this is just one example.
##### IP Based VirtualHost
##### Redirect to error page.
Listen 192.168.10.1:443
<VirtualHost 192.168.10.1:443>
ServerName
www.yourdomain42.org
ServerAdmin admin@yourdomain42.org
# SSL Engine Switch:
# Enable/Disable SSL for this virtual
host.
SSLEngine on
#
... The rest of your config for this host.
Options...
Order...
##### Make index.html for this host your error page.
##### This host can have a self signed certificate
##### as it will never be called by the right name anyway.
</VirtualHost>