Virtual hosts and wildcard SSL certificate

External Since: Oct 28, 2004 Posts: 2

Hi all,

I want to set up dynamic virtual hosts with Apache 2.0. I'll be using
mod_rewrite, because the document root will be something like:

/data/www/projects/customer1/site2/htdocs

where customer1 and site2 come from the URL like
http://site2.customer1.eyefi.nl/. Because we want to use HTTPS, I
created a certificate. I made the CN=*.eyefi.nl, because I know that
you can't do hostnamed-based selection of the SSL certificate.

When I request a page from Apache, Mozilla Firefox tells me "The
connection to site2.customer1.eyefi.nl has terminated unexpectedly.
Some data may have been transferred." The ssl_error.log file contains:

[Thu Oct 28 16:09:20 2004] [warn] RSA server certificate CommonName
(CN) `*.eyefi.nl' does NOT match server name!?

Checking with openssl gives me:

$ openssl s_client -connect site2.customer1.eyefi.nl:443 -showcerts
CONNECTED(00000003) 1931:error:140770FC:SSL
routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:475:

$ openssl s_client -connect dude.eyefi.nl:443 -showcerts -debug
CONNECTED(00000003)
write to 080AD358 [080ADBF8] (148 bytes => 148 (0x94))
0000 - 80 92 01 03 01 00 69 00-00 00 20 00 00 39 00 00 ......i... ..9..
0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............
0020 - 00 00 33 00 00 32 00 00-2f 00 00 07 05 00 80 03 ..3..2../.......
0030 - 00 80 00 00 66 00 00 05-00 00 04 01 00 80 08 00 ....f...........
0040 - 80 00 00 63 00 00 62 00-00 61 00 00 15 00 00 12 ...c..b..a......
0050 - 00 00 09 06 00 40 00 00-65 00 00 64 00 00 60 00 .....@..e..d..`.
0060 - 00 14 00 00 11 00 00 08-00 00 06 04 00 80 00 00 ................
0070 - 03 02 00 80 f7 3e aa 27-e1 fd 5e 84 0a 94 be 65 .....>.'..^....e
0080 - 12 42 b8 75 df 5f a6 3b-bc 26 70 70 24 9b 27 74 .B.u._.;.&pp$.'t
0090 - e4 c2 1a b3 ....
read from 080AD358 [080B3158] (7 bytes => 7 (0x7))
0000 - 3c 3f 78 6d 6c 20 76 <?xml v

1933:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown
protocol:s23_clnt.c:475:

It seems that Apache isn't doing any SSL on port 443, because if I go
to http://site2.customer1.eyefi.nl:443/ I get proper HTML.

I've tried googling, but I can't seem to find the answer. Please help!

Sybren
--
The problem with the world is stupidity. Not saying there should be a
capital punishment for stupidity, but why don't we just take the
safety labels off of everything and let the problem solve itself?

External Since: Nov 03, 2003 Posts: 2907

On 2004-10-28, Sybren Stuvel <sybrenUSE DeleteThis @YOURthirdtower.imagination.com> wrote:
> created a certificate. I made the CN=*.eyefi.nl, because I know that

The CN is the domain name, no placeholder allowed. So eyefi.nl.
Davide

--
I think that when they use NT for controlling their weapons, any place
far away from strategic objects might exactly be the place where the first
strikes hit.
--Georg