Home / server / Questions / 256250
Accepted
HoverHell
Asked: 2011-04-07 00:25:23 +0800 CST

Same set of virtualhosts over https and http (with apache2 or nginx)

  • 772

How can I set up apache2 (or nginx, possibly) to serve the same set of virtual hosts over both HTTP and HTTPS?

The certificate part is not the problem — all virtual hosts are inside one subdomain and I use a wildcard certificate for it.

I'm thinking of using proxypass for it, but, first, it seems slightly ineffective and, second, I'm not sure whether it would be secure (i.e. so that server cannot be asked over HTTPS for some irrelevant host); and I don't (yet) see how this can be set up in apache anyway.

EDIT: Duplication of configuration parts is undesirable, i.e. it is still a last-resort solution.

debian apache-2.2 ssl

4 Answers

  1. First configure apache to listen to both http and http ports using the Listen directive.

    Then, set your NameVirtualHost directive(s) and Virtual Hosts. Apache Docs on Virtual Host setup

    Probably what you will do is duplicate your VirtualHost sections like so:

    <VirtualHost *:80>
ServerName www.domain.tld
ServerAlias domain.tld *.domain.tld
DocumentRoot /www/domain
</VirtualHost>

<VirtualHost *:443>
ServerName www.domain.tld
ServerAlias domain.tld *.domain.tld
DocumentRoot /www/domain
</VirtualHost>
    • 0

  2. Stick the Vhost config in an .inc file. and have

    $ cat mysite.inc
ServerName www.domain.tld
DocumentRoot /www/domain
.....

$ cat mysite.conf
<VirtualHost *:80>
 Include conf/mysite.inc
</VirtualHost>

<VirtualHost *:443>
 SSLEngine on
 SSLCertificateFile bla
 SSLCertificateKeyFile bla
 SSLCertificateChainFile bla
 Include conf/mysite.inc
</VirtualHost>

    Note that you can't have server aliases with SSL, at least not very easily. You can work around this with wildcard certificates and/or multiple CN's

    • 0

  3. <VirtualHost *:80 *:443> will work syntactically (as would <VirtualHost *:*>).

    I'm assuming from your comment about having a wild-card cert and everything you're serving being in subdomains that you know that SSL and name-based virtual hosts don't always mix well.

    • 0
  4. Best Answer

    After all, I've configured it on nginx with

    server {
    include common_listen.conf;

    in each virtual host and common_listen.conf:

    listen [::]:80;
listen [::]:443 ssl;

    (which seems to require nginx 0.8.x) and ssl_certificate in base config.

    Using listen 443 default ssl; multiple times seems to be incorrect in nginx.

    Somewhat related questions are: nginx HTTPS serving with same config as HTTP, Does Nginx need a unique ip address for every site served over HTTPS like Apache? (though in my case SNI is unnecessary).

    • 0