Solved

SSL and virtual hosts

Posted on 2004-09-13
2
171 Views
Last Modified: 2010-07-27
We have a server running Apache that is home to about a dozen sites. All of the sites are configured to use the same IP via name-based hosting (NameVirtualHost) in the httpd.conf file.

Recently, one of the sites wanted to accept credit cards online. I purchased and installed a server certificate for the domain and modified httpd.conf to add a <virtualhost> entry for the domain under the "Listen 443" directive. I can now access the site via HTTPS, but I can also access it via HTTP, which kinda negates the whole reason for enabling SSL.

I now realize that maybe I should set up a subdomain (e.g. secure.domain.com) to handle HTTPS requests only. What's the best way to do it? I already have an unused IP address I can dedicate to the subdomain, but I'm not sure a) how to configure the DNS table and b) how to configure httpd.conf so that it associates the existing (shared) IP with HTTP requests on the domain and associates the new (dedicated) IP address with HTTPS requests on the domain.

Cheers,

-db
0
Comment
Question by:dbinteractive
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 

Author Comment

by:dbinteractive
ID: 12049648
In order to conserve IP addresses, I think I can continue to operate the site as I have been, but add PHP to the pages that should be accessed only via HTTPS to check the request method. If the browser isn't requesting the page via HTTPS, then I can redirect to the same page with HTTPS.

Is that "cheating" or an efficient use of IPs?

-db
0
 
LVL 15

Accepted Solution

by:
periwinkle earned 125 total points
ID: 12050802
You should use a unique IP address for each domain which will be used for SSL requests.

As far as being able to access a site by either http://www.somedomain.com or https://www.somedomain.com, you could add a Redirect or rewrite rule to prevent the access from the non-secure version.  On the other hand, SSL does add overhead to the server, and not all requests will need to be secured.  Usually, the parts that do are handled by a web application (PHP, Perl/CGI, etc.).  There, you can check to see if the page is being accessed securely and handle (and/or Redirect appropriately).
0

Featured Post

Create the perfect environment for any meeting

You might have a modern environment with all sorts of high-tech equipment, but what makes it worthwhile is how you seamlessly bring together the presentation with audio, video and lighting. The ATEN Control System provides integrated control and system automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If your site has a few sections that need to be secure when data is transmitted between the server and local computer, such as a /order/ section for ordering or /customer/ which contains customer data, etc it would of course be recommended to secure…
If you are a web developer, you would be aware of the <iframe> tag in HTML. The <iframe> stands for inline frame and is used to embed another document within the current HTML document. The embedded document could be even another website.
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…
If you’ve ever visited a web page and noticed a cool font that you really liked the look of, but couldn’t figure out which font it was so that you could use it for your own work, then this video is for you! In this Micro Tutorial, you'll learn yo…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question