I currently have the following VirtualHosts defined.
NameVirtualHost *:80
Listen *:80
<IfModule mod_ssl.c>
Listen *:443
</IfModule>
<VirtualHost *:80>
--various directives for www--
</VirtualHost>
<VirtualHost *:443>
--same directives as *:80--
SSLEngine on
SSLCertificateFile /path/to/public.crt
SSLCertificateKeyFile /path/to/private.key
SSLCACertificateFile /path/to/intermediate.crt
SSLCipherSuite ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4
SSLProtocol All -SSLv2 -SSLv3
SSLHonorCipherOrder On
</VirtualHost>
<VirtualHost 192.168.1.102:80>
--various directives for another subdomain--
</VirtualHost>
<VirtualHost 192.168.1.103:80>
--various directives for another subdomain--
</VirtualHost>
<VirtualHost 192.168.1.104:80>
--various directives for another subdomain--
</VirtualHost>
<VirtualHost 192.168.1.105:80>
--various directives for another subdomain--
</VirtualHost>
<VirtualHost 192.168.1.106:443>
--various directives for another subdomain--
SSLEngine on
SSLCertificateFile /path/self/signed/certificate.pem
--same ciphers and other settings as *:443--
</VirtualHost>
<VirtualHost 192.168.1.107:80>
--various directives for another subdomain--
</VirtualHost>
<VirtualHost 192.168.1.109:80>
--various directives for another subdomain--
</VirtualHost>
Right now, everything is working as expected. The main www domain *:80 and it's secured connection on *:443 works with a B rating on SSLLabs.com
The errors it gives are:
- This server supports weak Diffie-Hellman (DH) key exchange parameters. Grade capped to B.
- The server does not support Forward Secrecy with the reference browsers.
I've put custom DH Parameters after my public key, but the DH parameters still gives an error. I'm not sure how to fix the Forward Secrecy error.
After I got this far, I tried to add a new VirtualHost so that I could move my various sub-domains that are now covered by our new certificate to SSL.
I added a new VirtualHost:
<VirtualHost 192.168.1.109:443>
--Copied all directives from 192.168.1.109:80--
--Copied all SSL settings from *:443--
</VirtualHost>
The configuration seems to check out when I run configtest. Apache doesn't give me any error messages that seem relevant when I restart the service (it's always given some DNS errors, but that is okay as the IPs defined in the VirtualHosts are DMZd IPs and not public IPs). However, none of my sites respond and apache2 shows as stopped. When I delete the new VirtualHost, the server comes right back up with no problems.
What am I doing wrong with my configuration? Can anyone point me in the right direction?