Apache HTTPS 重定向证书错误

Question

我们有两个域(gis4business.co.uk 和 gis4business.com)指向使用 apache 托管的同一个网站。我们为整个站点使用 SSL，并为 *.gis4business.co.uk 提供通配符 SSL 证书。

默认的 apache conf 文件 (000-default.conf) 有一个配置为从 http 重定向到 https 的虚拟主机，如下所示:

<VirtualHost *:80>
   ...
   Redirect permanent "/" "https://www.gis4business.co.uk/"
</VirtualHost>

然后我们有一个默认的 SSL 配置文件 (default-ssl.conf)，其中配置了一个虚拟主机，如下所示:

<VirtualHost _default_:443>
    ServerName gis4business.co.uk
    ServerAlias *.gis4business.co.uk www.gis4business.co.uk *gis4business.com www.gis4business.com gis4business.com
    ...
    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/certificate.crt
    SSLCertificateKeyFile /etc/ssl/private/privatekey.key
    SSLCertificateChainFile /etc/ssl/certs/ca_certificate.crt
</VirtualHost>

对于以下 url，此配置按预期工作:

• > http://www.gis4business.co.uk
• > http://www.gis4business.com
• > https://www.gis4business.co.uk

但是，url https://www.gis4business.com导致证书警告(Firefox 中的 SSL_ERROR_BAD_CERT_DOMAIN 和 Chrome 中的 ERR_CERT_COMMON_NAME_INVALID)。

它显然提示 SSL 证书与域 (gis4business.com) 不匹配，所以我假设我们需要一个从 gis4business.com 到 gis4business.co.uk 的 HTTPS 重定向。我们尝试了各种配置，但未能成功实现重定向。

我们已经尝试过:

1) 在 000-default.conf 文件的顶部添加另一个虚拟主机 (*:443)，如下所示:

<VirtualHost *:443> 
    ServerName gis4business.co.uk
    ServerAlias *.gis4business.co.uk www.gis4business.co.uk *gis4business.com www.gis4business.com gis4business.com
    Redirect permanent "/" "https://www.gis4business.co.uk/"
    ...
    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/certificate.crt
    SSLCertificateKeyFile /etc/ssl/private/privatekey.key
    SSLCertificateChainFile /etc/ssl/certs/ca_certificate.crt 
</VirtualHost>

2) 将另一个虚拟主机 (default:443) 添加到 default-ssl.conf 文件的顶部，如下所示:

<VirtualHost _default_:443>
    ServerName gis4business.co.uk
    ServerAlias *.gis4business.co.uk www.gis4business.co.uk *gis4business.com www.gis4business.com gis4business.com
    Redirect permanent "/" "https://www.gis4business.co.uk/"
    ...
    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/certificate.crt
    SSLCertificateKeyFile /etc/ssl/private/privatekey.key
    SSLCertificateChainFile /etc/ssl/certs/ca_certificate.crt
</VirtualHost>

如果可以在没有证书错误的情况下将 https 从一个域重定向到另一个域，那么使其工作的正确配置是什么？

Answer 1

让我们看看 redirect指令工作

The Redirect directive maps an old URL into a new one by asking the client to refetch the resource at the new location.

第一个请求由 apache 处理生成一个 30x 自动重定向浏览器到新 URL 的响应

           browser                       SERVER             SSL  cert
https://www.gis4business.com       -->  redirect     *.gis4business.co.uk
           302-redirect            <-- 
https://www.gis4business.co.uk/    -->  process      *.gis4business.co.uk

第一个请求是从 https://www.gis4business.com 使用颁发给 *.gis4business.co.uk 的证书提供的，因此它被认为是无效的因此

要修复它，您需要使用颁发给 www.gis4business.com 或 *.gis4business.com 的证书。定义一个新的虚拟主机或请求一个包含两个主机名的新证书。