From: Mads Toftum
No, there is not configuration directive, because for technical
- bootstrapping reasons, a directive not possible at all. Instead
- use ``CFLAGS='-DEAPI_MM_CORE_PATH="/path/to/wherever/"'
- ./configure ...
'' when building Apache or use option
- -d
when starting httpd
.
Cryptographic software needs a source of unpredictable data @@ -687,6 +676,7 @@ browsers complain that they cannot verify the server certificate?
Name-Based Virtual Hosting is a very popular method of identifying + different virtual = hosts. It allows you to use the same IP address and + the same port number for many different sites. When people move on to + SSL, it seems natural to assume that the same method can be used to have + lots of different SSL virtual hosts on the same server.
+ +It comes as rather a shock to learn that it is impossible.
+ +The reason is that the SSL protocol is a separate layer which + encapsulates the HTTP protocol. So the problem is that the SSL session + is a separate transaction that takes place before the HTTP session even + starts. Therefore all the server receives is an SSL request on IP + address X and port Y (usually 443). Since the SSL request does not + contain any Host: field, the server has no way to decide which SSL + virtual host to use. Usually, it will just use the first one it finds + that matches the port and IP address.
+ +You can, of course, use Name-Based Virtual Hosting to identify many + non-SSL virtual hosts (all on port 80, for example) and then you can + have no more than 1 SSL virtual host (on port 443). But if you do this, + you must make sure to put the non-SSL port number on the NameVirtualHost + directive, e.g.
+ +NameVirtualHost 192.168.1.1:80
Other workaround solutions are:
Use separate IP addresses for different SSL hosts. + Use different port numbers for different SSL hosts.
No, there is not configuration directive, because for technical
- bootstrapping reasons, a directive not possible at all. Instead
- use ``CFLAGS='-DEAPI_MM_CORE_PATH="/path/to/wherever/"'
- ./configure ...
'' when building Apache or use option
- -d
when starting httpd
.
Cryptographic software needs a source of unpredictable data @@ -683,6 +672,7 @@ browsers complain that they cannot verify the server certificate?
Name-Based Virtual Hosting is a very popular method of identifying + different virtual = hosts. It allows you to use the same IP address and + the same port number for many different sites. When people move on to + SSL, it seems natural to assume that the same method can be used to have + lots of different SSL virtual hosts on the same server.
+ +It comes as rather a shock to learn that it is impossible.
+ +The reason is that the SSL protocol is a separate layer which + encapsulates the HTTP protocol. So the problem is that the SSL session + is a separate transaction that takes place before the HTTP session even + starts. Therefore all the server receives is an SSL request on IP + address X and port Y (usually 443). Since the SSL request does not + contain any Host: field, the server has no way to decide which SSL + virtual host to use. Usually, it will just use the first one it finds + that matches the port and IP address.
+ +You can, of course, use Name-Based Virtual Hosting to identify many + non-SSL virtual hosts (all on port 80, for example) and then you can + have no more than 1 SSL virtual host (on port 443). But if you do this, + you must make sure to put the non-SSL port number on the NameVirtualHost + directive, e.g.
+ +NameVirtualHost 192.168.1.1:80
+ +Other workaround solutions are:
+ +Use separate IP addresses for different SSL hosts. + Use different port numbers for different SSL hosts.
+