I recently became the new admin of a old system that everybody approaches with the "don't touch it or it might break" mentality. Now I am being told to "touch it, and don't break it!"
Task: What I am supposed to do: Remove a domain name www.domain1.com from the server and replace it with www.domain2.com.
Background:
www.domain1.com uses a SSL Certificate to host a SOAP and a protected data retrieval site.
The server is long out of date. It is a Fedora 4 server with Apache 2.2.0, tomcat 5.5.7 and openssl 0.9.7f.
I am trying to: Set up www.domain2.com on the server with an SSL certificate to allow our Business relations to access the SOAP from www.domain2.com/SOAP. We will move our other websites over then as well.
Path One: I was looking to set up the two domains on the same IP address(1.1.1.1). To make it easy. However that doesn't look so easy or safe(see References at bottom). I found out that I don't have new enough versions of Apache or openssl to do this.
Path Two: I decided to see what I would have to do to update them, this led to finding out that yum and apt-get are no longer have mirrors for FC4. I found versions online that I could install manually. I don't want to go that route because I doubt I could reverse the changes. I don't like putting my hopes in a silver bullet that could also kill me if I miss.
I have:
- I have an SSL certificate for www.domain2.com.
- www.domain2.com is pointed at the same IP as www.domain1.com (1.1.1.1).
- I have three more IP addresses assigned to my server that I can use (1.1.1.2, 1.1.1.3 and 1.1.1.4).
Since the path I was heading down doesn't look feasible, I was thinking I could set up the www.domain2.com on 1.1.1.2. With a new install of Apache that then could also link to tomcat to give access to the SOAP.
Questions:
- Can I set up domain2 on the current version of Apache with IP 1.1.1.2 with its certificate or do I need to install another version of Apache to run side by side?
- How would I configure the httpd-ssl.conf file if it is in the same Apache?
The current httpd-ssl.conf (Comments removed):
Listen 443
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
SSLPassPhraseDialog builtin
SSLSessionCache shmcb:/usr/local/apache-2.2.0/logs/ssl_scache(512000)
SSLSessionCacheTimeout 300
SSLMutex file:/usr/local/apache-2.2.0/logs/ssl_mutex
##
## SSL Virtual Host Context
##
<VirtualHost *:443>
ServerName domain1.com
ServerAdmin webmaster@www.domain1.com
DocumentRoot /www/www.domain.com
ErrorLog logs/sslerror_log
CustomLog logs/ssl_request_log \
"%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
TransferLog logs/ssltransfer_log
JkMount /domain1app1/* ajp13
JkMount /domain1app2/* ajp13
JkMount /SOAPdomain1app3/* ajp13
JkMount /InformationRetrevaldoamin1app4/* ajp13
SSLEngine on
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /usr/local/apache-2.2.0/conf/domain1.crt
SSLCertificateKeyFile /usr/local/apache-2.2.0/conf/domain1.key
SSLCertificateChainFile /usr/local/apache-2.2.0/conf/intermediate.crt
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
</VirtualHost>
Does anybody have any suggestions as to how to proceed? I am looking for the littlest change that is "undo able" in case I mess it up. My tool box is pretty small when it comes to these types of things. Any help would be greatly appreciated! If you have a way to go about this that I haven't thought of, please let me know. :) Oh and my boss would like me to get the ssl certificate in on Saturday during a 4 hour maintenance window. If it isn't possible I can delay till the next one.
Thanks in Advance!
Edited for readability.
References:
Multiple SSL domains on the same IP address and same port?
