Solved

SSL and virtual hosts

Posted on 2004-09-13
2
168 Views
Last Modified: 2010-07-27
We have a server running Apache that is home to about a dozen sites. All of the sites are configured to use the same IP via name-based hosting (NameVirtualHost) in the httpd.conf file.

Recently, one of the sites wanted to accept credit cards online. I purchased and installed a server certificate for the domain and modified httpd.conf to add a <virtualhost> entry for the domain under the "Listen 443" directive. I can now access the site via HTTPS, but I can also access it via HTTP, which kinda negates the whole reason for enabling SSL.

I now realize that maybe I should set up a subdomain (e.g. secure.domain.com) to handle HTTPS requests only. What's the best way to do it? I already have an unused IP address I can dedicate to the subdomain, but I'm not sure a) how to configure the DNS table and b) how to configure httpd.conf so that it associates the existing (shared) IP with HTTP requests on the domain and associates the new (dedicated) IP address with HTTPS requests on the domain.

Cheers,

-db
0
Comment
Question by:dbinteractive
2 Comments
 

Author Comment

by:dbinteractive
ID: 12049648
In order to conserve IP addresses, I think I can continue to operate the site as I have been, but add PHP to the pages that should be accessed only via HTTPS to check the request method. If the browser isn't requesting the page via HTTPS, then I can redirect to the same page with HTTPS.

Is that "cheating" or an efficient use of IPs?

-db
0
 
LVL 15

Accepted Solution

by:
periwinkle earned 125 total points
ID: 12050802
You should use a unique IP address for each domain which will be used for SSL requests.

As far as being able to access a site by either http://www.somedomain.com or https://www.somedomain.com, you could add a Redirect or rewrite rule to prevent the access from the non-secure version.  On the other hand, SSL does add overhead to the server, and not all requests will need to be secured.  Usually, the parts that do are handled by a web application (PHP, Perl/CGI, etc.).  There, you can check to see if the page is being accessed securely and handle (and/or Redirect appropriately).
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction As you’re probably aware the HTTP protocol offers basic / weak authentication, which in combination with the relevant configuration on your web server, provides the ability to password protect all or part of your host.  If you were not…
It is possible to boost certain documents at query time in Solr. Query time boosting can be a powerful resource for finding the most relevant and "best" content. Of course the more information you index, the more fields you will be able to use for y…
Along with being a a promotional video for my three-day Annielytics Dashboard Seminor, this Micro Tutorial is an intro to Google Analytics API data.
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question