Apache – Fixing Wrong Document Root Issue

apache-2.2documentroothttpssslvirtualhost

I have installed SSL on a subdomain of my site. Everything works perfectly, except this strange behavior.

If I point my browser at the following locations, these document roots are served:

http://domain.com       -> /var/www     [GOOD]
https://sub.domain.com  -> /media/sub   [GOOD]
https://domain.com      -> /media/sub   [BAD]

The last URL on that list should serve /var/www, not /media/sub. In other words, I would like to safely redirect users from https://domain.com to http://domain.com.

Here are my VirtualHosts.

domain.com

<VirtualHost *:80>
    ServerName domain.com
    DocumentRoot /var/www
</VirtualHost>

sub.domain.com

<VirtualHost *:443>
    ServerName sub.domain.com:443
    DocumentRoot /media/sub
    SSLEngine on
    SSLCertificateFile /etc/apache2/ssl/apache.crt
    SSLCertificateKeyFile /etc/apache2/ssl/apache.key
</VirtualHost>

What I've Tried

It was suggested to me that https://domain.com is serving the wrong VirtualHost because there is no *:443 VirtualHost with a ServerName of domain.com.

To fix this, I have tried doing this:

domain.com

<VirtualHost *:80>
    ServerName domain.com
    DocumentRoot /var/www
</VirtualHost>
<VirtualHost *:443>
    ServerName domain.com
    Redirect / http://domain.com/
</VirtualHost>

I feel like this should work. (It should redirect https requests to http, thus serving the correct document root.)

However, when I do this, Apache2 will not even start. It gives me this error:

[error] Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile] ((null):0)

Thanks a lot in advance for any guidance.

Best Answer

This will not work. This is not how SSL works. For you to enable SSL, you must have a SSLEngine On and the directives for server certificate and key.

Just by listening on 443 will not help.

If you are not planning to run SSL on your domain.com then ideally you should not be trying to access it over HTTPS. Is there a valid use case why your users will try access domain.com over https?

Related Topic