Same set of virtualhosts over https and http (with apache2 or nginx)

Question

How can I set up apache2 (or nginx, possibly) to serve the same set of virtual hosts over both HTTP and HTTPS?

The certificate part is not the problem — all virtual hosts are inside one subdomain and I use a wildcard certificate for it.

I'm thinking of using proxypass for it, but, first, it seems slightly ineffective and, second, I'm not sure whether it would be secure (i.e. so that server cannot be asked over HTTPS for some irrelevant host); and I don't (yet) see how this can be set up in apache anyway.

EDIT: Duplication of configuration parts is undesirable, i.e. it is still a last-resort solution.

score 0 · Answer 1 · answered Apr 06 '11 at 10:35

First configure apache to listen to both http and http ports using the Listen directive.

Then, set your NameVirtualHost directive(s) and Virtual Hosts. Apache Docs on Virtual Host setup

Probably what you will do is duplicate your VirtualHost sections like so:

<VirtualHost *:80>
ServerName www.domain.tld
ServerAlias domain.tld *.domain.tld
DocumentRoot /www/domain
</VirtualHost>

<VirtualHost *:443>
ServerName www.domain.tld
ServerAlias domain.tld *.domain.tld
DocumentRoot /www/domain
</VirtualHost>

Duplication is what I don't want to do, since then I'll have to make each change twice (or use a script to update second part, which I would prefer to avoid too). — HoverHell, Apr 06 '11 at 12:15

score 0 · Answer 2 · answered Apr 06 '11 at 12:38

0

Stick the Vhost config in an .inc file. and have

$ cat mysite.inc
ServerName www.domain.tld
DocumentRoot /www/domain
.....

$ cat mysite.conf
<VirtualHost *:80>
 Include conf/mysite.inc
</VirtualHost>

<VirtualHost *:443>
 SSLEngine on
 SSLCertificateFile bla
 SSLCertificateKeyFile bla
 SSLCertificateChainFile bla
 Include conf/mysite.inc
</VirtualHost>

Note that you can't have server aliases with SSL, at least not very easily. You can work around this with wildcard certificates and/or multiple CN's

answered Apr 06 '11 at 12:38

HampusLi

3,398
15
14

That's what I have now; but I need multiple virtual hosts, not one. – HoverHell Apr 06 '11 at 17:07
(I get a feeling that first of all I need help with more clearly stating what I need) – HoverHell Apr 06 '11 at 17:08

score 0 · Answer 3 · answered Apr 06 '11 at 12:54

0

<VirtualHost *:80 *:443> will work syntactically (as would <VirtualHost *:*>).

I'm assuming from your comment about having a wild-card cert and everything you're serving being in subdomains that you know that SSL and name-based virtual hosts don't always mix well.

answered Apr 06 '11 at 12:54

mdorman

121
2

Syntactically, yes; but there's also a difference in that port 443 should have SSL configured too. I suspect I can configure apache-wide SSL, but I failed to see much about that in the documentation. – HoverHell Apr 06 '11 at 16:40
“don't always mix well‘ — indeed I can't seem to possibly mix https://example.com and https://stuff.example.com on one address (which makes https://www.example.com even more appropriate). – HoverHell Apr 06 '11 at 16:43

score 0 · Accepted Answer · edited Apr 13 '17 at 12:14

After all, I've configured it on nginx with

server {
    include common_listen.conf;

in each virtual host and common_listen.conf:

listen [::]:80;
listen [::]:443 ssl;

(which seems to require nginx 0.8.x) and ssl_certificate in base config.

Using listen 443 default ssl; multiple times seems to be incorrect in nginx.

Somewhat related questions are: nginx HTTPS serving with same config as HTTP, Does Nginx need a unique ip address for every site served over HTTPS like Apache? (though in my case SNI is unnecessary).

Same set of virtualhosts over https and http (with apache2 or nginx)

4 Answers4