Re: Multiple virtual hosts with SSL in HTTP Server

[Nathan Andelin <nandelin@xxxxxxxxx>]

Still on 7.3 here. I’m not at a terminal to check the TR level at the moment. 

Nathan Andelin 


> On Apr 2, 2021, at 12:46 PM, Pete Helgren <pete@xxxxxxxxxx> wrote:
>
> Thanks Nathan.  That didn't make a change but it was worth a try.  What version of IBM i are you on (7.4 TR2 here)
>
> Pete Helgren
> www.petesworkshop.com
> GIAC Secure Software Programmer-Java
> AWS Certified Cloud Practitioner
> Twitter - Sys_i_Geek  IBM_i_Geek
>
> > On 4/1/2021 5:25 PM, Nathan Andelin wrote:
> > Pete,
> >
> > My HTTP configuration is very similar to yours; hosting multiple SSL sites.
> > Except:
> >
> > I use an IP address assigned by my ISP rather than * on the VirtualHost
> > directive.
> > I don't use the SSLServerCert, nor the ProxyPreserveHost directives.
> >
> > I don't know if it will make a difference, but thought it might be worth a
> > try.
> >
> > Nathan.
> >
> >
> >
> >
> >
> > > On Thu, Apr 1, 2021 at 2:01 PM Pete Helgren <pete@xxxxxxxxxx> wrote:
> > >
> > > OK...got most of what I needed working on the HTTP server  once I
> > > updated PHP, so I added back my SSL certs through DCM.   I have 6
> > > vhosts, 3 of which use SSL.  These all worked on my 7.2 box. I grabbed
> > > the http.conf files because it worked so well and I didn't want to lose
> > > the config that worked.  It no longer does.
> > >
> > > What I discovered a few years back that if you want to use SSL in
> > > virtual host configurations, the secret was using these directives (in
> > > my reverse proxy):
> > >
> > > <VirtualHost *:443>
> > > ServerName www.website.com
> > > ServerAlias website.com
> > >
> > > SSLEngine On
> > > SSLAppName QIBM_HTTP_SERVER_WEBSITE  (From SSL config and assigning
> > > certificate to application)
> > > SSLProtocolDisable SSLv2 SSLv3
> > > SSLServerCert "website" (Actual name of certificate label in DCM)
> > >
> > > ProxyPreserveHost on
> > >
> > > ProxyPass / http://10.0.10.206:5080/
> > > ProxyPassReverse / http://10.0.10.206:5080/
> > >
> > > </VirtualHost>
> > >
> > > So, I have three of these and they have identical formats except for the
> > > names and the proxy redirects.  So, the SSL is fine on website 1.  I get
> > > a "Your connection is not private" error on website 2 because it picks
> > > up the cert from website 1.  Website 3 is fine.
> > >
> > > So, I thought maybe there is something wrong with the certificate.  So I
> > > swapped website 1 and 2 in the listing order. Now the original 2nd
> > > website is listed first.  Now the "website 2" that is the first vhost
> > > entry is fine but number 1 is in error, complaining this time the
> > > certificate for website 2 (listed first now) is incorrect.  It doesn't
> > > seem to be honoring the SSLAppName or SSLServerCert on the second vhost.
> > > Website 3 is still fine.
> > >
> > > It is only those two SSL virtual hosts that have this issue. AND, they
> > > were working before.  The third website works fine regardless of the
> > > order the virtual host entries are in.  Weirder still, even if I get the
> > > error on the cert on the website, I can go to https://www.ssllabs.com
> > > and test the certificate and it returns the correct certificate for the
> > > correct website and an "A" rating.
> > >
> > > Anyone seen this before?  I am stumped.....
> > >
> > > --
> > > Pete Helgren
> > > www.petesworkshop.com
> > > GIAC Secure Software Programmer-Java
> > > AWS Certified Cloud Practitioner
> > > Twitter - Sys_i_Geek  IBM_i_Geek
> > >
> > > --
> > > This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> > > list
> > > To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
> > > To subscribe, unsubscribe, or change list options,
> > > visit: https://lists.midrange.com/mailman/listinfo/web400
> > > or email: WEB400-request@xxxxxxxxxxxxxxxxxx
> > > Before posting, please take a moment to review the archives
> > > at https://archive.midrange.com/web400.
> -- 
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
> To post a message email: WEB400@xxxxxxxxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/web400.