Ssl – NTLM Authorization using Apache NameBased VirtualHosts over SSL

I have a development environment that is fronted via an Apache server. This apache server requires SSL and Centrify-enabled NTLM authentication/authorization with the AD backend, using group access to view the webpages. There will be multiple projects using this environment, so I want to set up Virtual Hosting, which will allow each project to modify their own virtual host with any specific apache modules. The web files will live in /var/www/project1 ; /var/www/project2 ; etc..

I already have the DNS configured properly to point *.domain to the apache server, as well as a wildcard SSL certificate that had the altDNSName field set with *.domain.

The problem is the NTLM authentication piece:

If I point my browser to https://hostname.fqdn/project1/index.html, the NTLM authorization processes exactly as I want. I believe this runs off my default virtual host.

If I instead point my browser to https://project1.domain/index.html, the Apache error logs complain that "User failed NTLM authentication for /index.html. Error: Logon failure.

<VirtualHost ipaddress:443>
    Servername "hostname.fqdn"
    DocumentRoot "/var/www/"

    SSLEngine on
    SSLCertificateFile  /path/to/cert.crt
    SSLCertificateKeyFile   /path/to/cert.key
</VirtualHost>

<VirtualHost ipaddress:443>
    ServerName "project1.domain"
    DocumentRoot "/var/www/project1"

    SSLEngine on
    SSLCertificateFile  /path/to/cert.crt
    SSLCertificateKeyFile   /path/to/cert.key
</VirtualHost>

<Directory "/var/www">
    Options Indexes FollowSymLinks

    SSLRequireSSL

    AllowOverride None

    Order allow,deny
    Allow from all
</Directory>

<Directory "/var/www/project1">
    AuthType CENTRIFYDC

    EnableBasicAuth     false
    EnableKerberosAuth  false
    EnableNtlmAuth      true

    Require group       required_ad_group
</Directory>

I have attempted this with both IE and Firefox, making sure *.domain was in my Local Intranet zone for IE and that the network.automatic-ntlm-auth.trusted-uris and network.negotiate-auth.trusted-uris settings are properly set in Firefox.

I have narrowed it down to the NTLM problem, because if I remove the Centrify directives, the Name-Based Virtual Host works as I would expect. I have tried placing the Directory tag within each Virtual Host, I have also tried using a Location tag, but I have not been able to make any headway.