← Back to team overview

enterprise-support team mailing list archive

Re: [Question #233966]: Clients cannot connect with SSL enabled in Apache2. Seems to be related to either Name Virtual hosts or SNI in Ubuntu 12.04

 

Question #233966 on apache2 in Ubuntu changed:
https://answers.launchpad.net/ubuntu/+source/apache2/+question/233966

    Status: Answered => Open

AD is still having a problem:
- You have to use Name Virtual Hosts to distinguish the requested site
by hostname.

I do not want to distinguish the requested site by hostname.  I don't
care if the request is for site5.company.com, site.othercompany.com, or
foo.bar.  All requests should get the same content.  The only thing I
want to distinguish is the port.  If the request is over port 443, they
need SSL.

- The sections MUST contain a ServerName line, which SHOULD match the CN
of the certificate.

If I am understanding the information from http://httpd.apache.org/docs/2.2/vhosts/details.html, ServerName is not required, but it should be set to avoid DNS lookups:  
    The default ServerName is deduced from the server's IP address
    ...
    ServerName should always be set for each vhost. Otherwise A DNS lookup is required for each vhost

I also don't think it should be required here because I am using the _default_ wildcard:
    Any vhost that includes the magic _default_ wildcard is given the same ServerName as the main_server

Keep in mind, this configuration works for me without errors for most
clients.  It works in Ubuntu 10.04.  It even works in Ubuntu 12.04 if I
comment out the SSLxxx directives and go to
http://site5.company.com:443.  This doesn't seem to be an issue with
Apache failing to select the vhost, it seems to be an issue with SSL in
Ubuntu 12.04.

I have also posted this to the users@httpd mailing list to get
clarification on the correct way to configure this: http://mail-
archives.apache.org/mod_mbox/httpd-users/201308.mbox/thread

-- 
You received this question notification because you are a member of
Ubuntu Server/Client Support Team, which is an answer contact for
apache2 in Ubuntu.