apache - 多个 SSL 证书 Apache2

Question

secure.dynaccount.com(Thawte 证书) http://certlogik.com/sslchecker/secure.dynaccount.com/

api.dynaccount.com(自签名) http://certlogik.com/sslchecker/api.dynaccount.com/

httpd.conf

# Thawte certified
<VirtualHost 88.198.55.138:443>
    ServerName secure.dynaccount.com
    DocumentRoot /var/www/dynaccount.com

    SSLEngine on
    SSLCertificateKeyFile /var/ini/ssl/secure.dynaccount.com/private.key
    SSLCertificateFile /var/ini/ssl/secure.dynaccount.com/public.crt
    SSLCertificateChainFile /var/ini/ssl/secure.dynaccount.com/intermediate.crt
    SSLVerifyDepth 1
    SetEnvIf User-Agent ".*MSIE.*" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
</VirtualHost>

# self-signed
<VirtualHost 88.198.55.154:443>
    ServerName api.dynaccount.com
    DocumentRoot /var/www/dynaccount.com

    SSLEngine on
    SSLCertificateKeyFile /var/ini/ssl/api.dynaccount.com/private.key
    SSLCertificateFile /var/ini/ssl/api.dynaccount.com/public.crt
    SSLVerifyDepth 0
    SetEnvIf User-Agent ".*MSIE.*" \
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP
</VirtualHost>

Answer 1

你读过 Apache HTTP 文档了吗？

http://httpd.apache.org/docs/2.0/vhosts/name-based.html

Name-based virtual hosting cannot be used with SSL secure servers because of the nature of the SSL protocol.

每个 IP 可以有一个 SSL 主机。

原因？

SSL 连接参数是为每个虚拟主机设置的，但必须在 httpd 读取主机 HTTP header 之前协商。

这给人一种感觉，不是吗？

更新:

将 SSLCACertificateFile 更改为 SSLCertificateChainFile 并根据 docs 提供正确的文件格式或完全禁用客户端证书验证