Ssl – How to combine two SSL-enabled servers in one Apache instance

apache-2.2ruby-on-railssslssl-certificatevirtualhost

I have two different sites, foo.com and bar.com, each running on a different (virtual) machine. Each has an SSL-enabled Ruby-on-Rails site running as follows:

# foo.com:/etc/apache2/sites-availables/foo.com.conf:

<VirtualHost *:80>
    ServerName foo.com
    ServerAlias www.foo.com
    DocumentRoot /var/www/apps/foo.com/current/public
</VirtualHost>

<VirtualHost *:443>
    ServerName foo.com
    ServerAlias www.foo.com
    DocumentRoot /var/www/apps/foo.com/current/public

    SSLEngine On
    SSLCertificateKeyFile /etc/apache2/ssl/foo.com.key
    SSLCertificateFile /etc/apache2/ssl/WWW.FOO.COM.crt
    SSLCertificateChainFile /etc/apache2/ssl/Apache_Plesk_Install.txt
</VirtualHost>

(Replace "foo.com" with "bar.com" as appropriate.)

I am in the process of merging the two code-bases in order to ease ease between users of foo.com and bar.com. Eventually they will both reside on the same server (foo.com) and both domain names will point to the same IP. The single server will be perfectly capable of handling the traffic from both sites — they only get on order of a few dozen unique users each day, with peak load in the hundreds or low thousands.

The following is my proposed checklist of things to do for the merge. My question is: what am I forgetting?

  1. copy the private key, certificate, and certificate chain file from bar.com:/etc/apache2/ssl/* to foo.com:/etc/apache2/ssl/bar.com/*
  2. copy the bar.com site configuration from bar.com:/etc/apache2/sites-available/bar.com.conf to foo.com:/etc/apache2/sites-available/bar.com/conf and edit the SSL configuration as per the previous point
  3. (possibly change the foo.com SSL configuration to look more like the new bar.com ones)
  4. restart Apache on foo.com
  5. change the bar.com name listing to an alias to foo.com

Will that work? Will users get the right certificates or will they see certificate warnings?

Best Answer

both domain names will point to the same IP

If you want to avoid certificate warnings with 2 different sites sharing the same IP:port, you will need to use a SAN/UCC certificate that supports multiple/alternate names in one cert.

Take a look at this thread:

Apache SSL VirtualHosts on a single IP using UCC/SAN certificate

If ordering a SAN/UCC cert is not an option, you will need to use multiple IP addresses.

Related Topic