?
Solved

SSL and virtual hosts

Posted on 2004-09-13
2
Medium Priority
?
172 Views
Last Modified: 2010-07-27
We have a server running Apache that is home to about a dozen sites. All of the sites are configured to use the same IP via name-based hosting (NameVirtualHost) in the httpd.conf file.

Recently, one of the sites wanted to accept credit cards online. I purchased and installed a server certificate for the domain and modified httpd.conf to add a <virtualhost> entry for the domain under the "Listen 443" directive. I can now access the site via HTTPS, but I can also access it via HTTP, which kinda negates the whole reason for enabling SSL.

I now realize that maybe I should set up a subdomain (e.g. secure.domain.com) to handle HTTPS requests only. What's the best way to do it? I already have an unused IP address I can dedicate to the subdomain, but I'm not sure a) how to configure the DNS table and b) how to configure httpd.conf so that it associates the existing (shared) IP with HTTP requests on the domain and associates the new (dedicated) IP address with HTTPS requests on the domain.

Cheers,

-db
0
Comment
Question by:dbinteractive
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 

Author Comment

by:dbinteractive
ID: 12049648
In order to conserve IP addresses, I think I can continue to operate the site as I have been, but add PHP to the pages that should be accessed only via HTTPS to check the request method. If the browser isn't requesting the page via HTTPS, then I can redirect to the same page with HTTPS.

Is that "cheating" or an efficient use of IPs?

-db
0
 
LVL 15

Accepted Solution

by:
periwinkle earned 375 total points
ID: 12050802
You should use a unique IP address for each domain which will be used for SSL requests.

As far as being able to access a site by either http://www.somedomain.com or https://www.somedomain.com, you could add a Redirect or rewrite rule to prevent the access from the non-secure version.  On the other hand, SSL does add overhead to the server, and not all requests will need to be secured.  Usually, the parts that do are handled by a web application (PHP, Perl/CGI, etc.).  There, you can check to see if the page is being accessed securely and handle (and/or Redirect appropriately).
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

As Wikipedia explains 'robots.txt' as -- the robot exclusion standard, also known as the Robots Exclusion Protocol or robots.txt protocol, is a convention to prevent cooperating web spiders and other web robots from accessing all or part of a websit…
If you've heard about htaccess and it sounds like it does what you want, but you're not sure how it works... well, you're in the right place. Read on. Some Basics #1. It's a file and its filename is .htaccess (yes, with a dot in the front). #…
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
Sometimes it takes a new vantage point, apart from our everyday security practices, to truly see our Active Directory (AD) vulnerabilities. We get used to implementing the same techniques and checking the same areas for a breach. This pattern can re…
Suggested Courses

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question