Critical Problem with Resolving HTTPS ISPConfig 3 v3.0.4.6

Discussion in 'HOWTO-Related Questions' started by darinpeterson, Feb 20, 2013.

  1. darinpeterson

    darinpeterson HowtoForge Supporter

    I have a serious problem with https resolving to the wrong website. I have an existing website where I created an SSL, and I have a new site where I just created the SSL.

    When I type https://firstsite.com, it resolves to https://newsite.com.

    I am running my own name servers ns1.myserver.net, and ns2.myserver.net. The DNS records for both sites point to those name servers.

    Help please... I don't know how to fix this.

    MORE INFORMATION: I'm getting this when trying to restart Apache.

    Code:
    /etc/init.d/apache2 restart
    Restarting web server: apache2[Wed Feb 20 14:54:30 2013] [warn] _default_ VirtualHost overlap on port 443, the first has precedence
     ... waiting [Wed Feb 20 14:54:31 2013] [warn] _default_ VirtualHost overlap on port 443, the first has precedence
    
     
    Last edited: Feb 20, 2013
  2. till

    till Super Moderator

    I guess you created both sites on the same IP? Traditional SSL requires a dedicated IP address for every SSL website. When you create two websites on the same IP and enable ssl for both sites then you get SSL over SNI which is not supported by all web browsers and apache versions. See wikipedia article about SNI for details.

    So if you want to have two ssl sites that work in all browsers, you need two IP addresses and assign the first site to the first IP and the second site to the second IP. Thats always the case for ssl site, so not a limitation of ispconfig.
     
  3. darinpeterson

    darinpeterson HowtoForge Supporter

    Thank you for the prompt response

    Till,

    Thank you for the prompt response, and for setting me straight on what is needed here. I am new to SSL sites, so now I know.

    Regards,
    Darin
     
  4. darinpeterson

    darinpeterson HowtoForge Supporter

    Ok, I fixed this problem and restarted the server. I completely removed the SSL from one site, and now have only SSL on the other. The problem that I have now is that when I type https://firstsite.com, or https://newsite.com, my server resolves to the site with the SSL. I'd prefer it go to an error page when no SSL is available. Why does it resolve to the domain that has the SSL? How can I fix this?

    Thank you,
    Darin
     
  5. falko

    falko Super Moderator

    You need an IP where you only put websites that use http (port 80). Your SSL websites should either use one IP per SSL website, or if you use SNI, you should use a dedicated IP for those SNI websites.

    The problem is if you mix http and https websites on one IP, a https request for a http-only website will always go to the first configured https website (which is from another domain).
     
  6. darinpeterson

    darinpeterson HowtoForge Supporter

    Is there a document that will show me an example of what the DNS records look like for sites with SSLs?

    The reason I ask is this:

    If my web server runs on 192.168.1.145, do I have to add each new domain to the /etc/hosts file when assigning new IP addresses?

    /etc/hosts
    Code:
    127.0.0.1       localhost
    192.168.1.145   web.server.com
    
    # The following lines are desirable for IPv6 capable hosts
    ::1     ip6-localhost ip6-loopback
    fe00::0 ip6-localnet
    ff00::0 ip6-mcastprefix
    ff02::1 ip6-allnodes
    ff02::2 ip6-allrouters
    
    So I want to add a new SSL domain. Must I do the following, or is there some way to create the DNS records, so I don't have to add the domain to the /etc/hosts file?

    Code:
    127.0.0.1       localhost
    192.168.1.145   web.server.com
    192.168.1.146   new.domain.com
    
    # The following lines are desirable for IPv6 capable hosts
    ::1     ip6-localhost ip6-loopback
    fe00::0 ip6-localnet
    ff00::0 ip6-mcastprefix
    ff02::1 ip6-allnodes
    ff02::2 ip6-allrouters
    
     
    Last edited: Feb 26, 2013
  7. falko

    falko Super Moderator

    Do you use those websites only in your local network? If you want to serve them to the outside world, then the problem is that your router can forward one port to just one IP. So if you host a second website on the same port, but different IP, you cannot serve it to the outside.
     
  8. darinpeterson

    darinpeterson HowtoForge Supporter

    Can you please point me to the documentation that will show me how to setup multiple secure domains on one web server using multiple IP addresses? An example of domain records would be helpful. Any help you can provide is appreciated...

    This is not a local setup, it's intended to serve the Internet.
     
  9. till

    till Super Moderator

    ISPConfig manual: Chapter "5.4 How Do I Create An SSL Web Site?".
     
  10. darinpeterson

    darinpeterson HowtoForge Supporter

    Thank you Till... I did not have a chance to get back to this yet. The only thing missing is the DNS records. I'm going to see if I can work it out later today without a reference.
     
  11. till

    till Super Moderator

    DNS is described in the manual as well, chapter 5.12 "How Do I Create A DNS Zone?"
     
  12. darinpeterson

    darinpeterson HowtoForge Supporter

    Is there something wrong with my settings

    I think the problem is deeper than performing the individual tasks. It's an issue with a fundamental understanding of how BIND is putting things together to make them work. It's a local configuration...

    Can you please look at my settings, and see if I'm missing anything?

    Here are my settings:
    [​IMG]

    [​IMG]

    The SSL is installed on the domain, but I am not providing that image here...

    [​IMG]

    [​IMG]
     

Share This Page