1

I currently have the following VirtualHosts defined.

NameVirtualHost *:80
Listen *:80

<IfModule mod_ssl.c>
Listen *:443
</IfModule>

<VirtualHost *:80>
--various directives for www--
</VirtualHost>

<VirtualHost *:443>
--same directives as *:80--
SSLEngine on
SSLCertificateFile /path/to/public.crt
SSLCertificateKeyFile /path/to/private.key
SSLCACertificateFile /path/to/intermediate.crt
SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4 
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
</VirtualHost>

<VirtualHost 192.168.1.102:80>
--various directives for another subdomain--
</VirtualHost>

<VirtualHost 192.168.1.103:80>
--various directives for another subdomain--
</VirtualHost>

<VirtualHost 192.168.1.104:80>
--various directives for another subdomain--
</VirtualHost>

<VirtualHost 192.168.1.105:80>
--various directives for another subdomain--
</VirtualHost>

<VirtualHost 192.168.1.106:443>
--various directives for another subdomain--
SSLEngine on
SSLCertificateFile /path/self/signed/certificate.pem
--same ciphers and other settings as *:443--
</VirtualHost>

<VirtualHost 192.168.1.107:80>
--various directives for another subdomain--
</VirtualHost>

<VirtualHost 192.168.1.109:80>
--various directives for another subdomain--
</VirtualHost>

Right now, everything is working as expected. The main www domain *:80 and it's secured connection on *:443 works with a B rating on SSLLabs.com

The errors it gives are:

  1. This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.
  2. The server does not support Forward Secrecy with the reference browsers.

I've put custom DH Parameters after my public key, but the DH parameters still gives an error. I'm not sure how to fix the Forward Secrecy error.

After I got this far, I tried to add a new VirtualHost so that I could move my various sub-domains that are now covered by our new certificate to SSL.

I added a new VirtualHost:

<VirtualHost 192.168.1.109:443>
--Copied all directives from 192.168.1.109:80--
--Copied all SSL settings from *:443--
</VirtualHost>

The configuration seems to check out when I run configtest. Apache doesn't give me any error messages that seem relevant when I restart the service (it's always given some DNS errors, but that is okay as the IPs defined in the VirtualHosts are DMZd IPs and not public IPs). However, none of my sites respond and apache2 shows as stopped. When I delete the new VirtualHost, the server comes right back up with no problems.

What am I doing wrong with my configuration? Can anyone point me in the right direction?

1
  • Turns out the ServerName errors were the problem all along. Oct 6, 2015 at 2:43

1 Answer 1

0

The problem was apparently the ServerName errors all along. They are fine as long as there's only 1 host per IP, but adding a second IP, even though it's on a new port and therefore has a new VirtualHost name wasn't enough to keep Apache from blowing up.

I added a ServerName to each and every VirtualHost even though we haven't needed them in the past, and now the new VirtualHost installs with no problem.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .