![使用虚拟主机证书](https://linux22.com/image/700019/%E4%BD%BF%E7%94%A8%E8%99%9A%E6%8B%9F%E4%B8%BB%E6%9C%BA%E8%AF%81%E4%B9%A6.png)
我正在尝试在基于名称的虚拟主机中启用 SSL。从文档中我了解到,SNI 不需要明确启用,如果服务器和客户端都符合最低要求,它会自动发生,我认为它们确实如此:
- Apache/2.4.25(Win32)
- OpenSSL/1.0.2k
- Firefox/51.0.1 (x64)
我已将配置精简到最低限度:
Listen 80
LoadModule ssl_module modules/mod_ssl.so
<VirtualHost *:80>
ServerName localhost
DocumentRoot "D:/Servidores/Apache/htdocs"
</VirtualHost>
Listen 443
SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
SSLProxyCipherSuite HIGH:MEDIUM:!MD5:!RC4
SSLHonorCipherOrder on
SSLProtocol all -SSLv3
SSLProxyProtocol all -SSLv3
SSLPassPhraseDialog builtin
SSLSessionCacheTimeout 300
<VirtualHost _default_:443>
ServerName localhost
DocumentRoot "D:/Servidores/Apache/htdocs"
SSLEngine on
SSLCertificateFile "D:/DOS/Apache24/conf/server.crt"
SSLCertificateKeyFile "D:/DOS/Apache24/conf/server.key"
</VirtualHost>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
<VirtualHost *:80>
ServerName tmp
DocumentRoot "D:/tmp"
</VirtualHost>
<VirtualHost *:443>
ServerName tmp
DocumentRoot "D:/tmp"
SSLCertificateFile "D:/Servidores/Apache/certificados/tmp.crt"
SSLCertificateKeyFile "D:/Servidores/Apache/certificados/tmp.key"
</VirtualHost>
C:\>httpd -f conf/prueba-test.conf
然而,当我尝试加载时,我总是获取来自(针对主机)https://tmp/
的证书,而不是(针对主机)的证书。<VirtualHost _default_:443>
localhost
ServerName tmp
tmp
以下是记录的内容:
[Fri Mar 03 14:11:57.360237 2017] [ssl:warn] [pid 11684:tid 668] AH01906: tmp:80:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Fri Mar 03 14:11:57.361240 2017] [ssl:warn] [pid 11684:tid 668] AH01906: localhost:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Fri Mar 03 14:11:57.433220 2017] [ssl:warn] [pid 11684:tid 668] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]
[Fri Mar 03 14:11:57.433220 2017] [ssl:warn] [pid 11684:tid 668] AH01906: tmp:80:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Fri Mar 03 14:11:57.434223 2017] [ssl:warn] [pid 11684:tid 668] AH01906: localhost:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Fri Mar 03 14:11:57.436228 2017] [mpm_winnt:notice] [pid 11684:tid 668] AH00455: Apache/2.4.25 (Win32) OpenSSL/1.0.2k configured -- resuming normal operations
[Fri Mar 03 14:11:57.436228 2017] [mpm_winnt:notice] [pid 11684:tid 668] AH00456: Apache Lounge VC14 Server built: Dec 17 2016 10:42:52
[Fri Mar 03 14:11:57.436228 2017] [core:notice] [pid 11684:tid 668] AH00094: Command line: 'httpd -d D:/DOS/Apache24 -f conf/prueba-ssl.conf'
[Fri Mar 03 14:11:57.444250 2017] [mpm_winnt:notice] [pid 11684:tid 668] AH00418: Parent: Created child process 15380
[Fri Mar 03 14:11:57.910024 2017] [ssl:warn] [pid 15380:tid 648] AH01906: localhost:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Fri Mar 03 14:11:57.988164 2017] [ssl:warn] [pid 15380:tid 648] AH01873: Init: Session Cache is not configured [hint: SSLSessionCache]
[Fri Mar 03 14:11:57.988164 2017] [ssl:warn] [pid 15380:tid 648] AH01906: localhost:443:0 server certificate is a CA certificate (BasicConstraints: CA == TRUE !?)
[Fri Mar 03 14:11:57.988164 2017] [mpm_winnt:notice] [pid 15380:tid 648] AH00354: Child: Starting 64 worker threads.
可能存在什么问题?
答案1
这可能与配置顺序有关。尝试将<VirtualHost _default_:443>
配置移至文件底部,然后重新加载/重新启动 apache。
答案2
最终,这只是一个愚蠢的错误。我的辅助虚拟主机中缺少这个:
SSLEngine on
由于这是启用 SSL 的指令,我在这样的主机中根本没有 SSL(既没有 SNI,也没有常规)。
(该指令在我的所有基于 IP 的虚拟主机中已经存在多年,但是当我开始使用 SNI 时,有人设法从我正在测试的主机中将其删除。)