How to host multiple SSL enabled sites on a single IP address using Apache?

In the past, only one SSL enabled website could be hosted on a single IP address and default port 443 due to the limitation of TLS negotiation. With an addition of SNI(Server Name Identification) extension to TLS, server can now host multiple SSL enables sites using VirtualHost directive.

Apache ( 2.2.12 or later ) using OpenSSL(0.9.8 or later)  incorporates SNI. Today many browsers with the latest updates support SNI too. However, there could be many users still using older version of browsers that don't support SNI. Thus,  you may run into an issue where those customers may only be able to access your default website not the others.

Apache Configuration :

    Listen 443

    NameVirtualHost *:443

    SSLStrictSNIVHostCheck off

<VirtualHost *:443>

        ServerName  website1.yourdomain.com

        DocumentRoot /usr/local/your-website1/

----

----

</VirutalHost>

<VirtualHost *:443>

        ServerName  website2.yourdomain.com

        DocumentRoot /usr/local/your-website2/

----

----

</VirutalHost>

• NameVirtualHost  apache directive is required if you want to configure name-based virtual hosts.
• If SSLStrictSNIVHostCheck is off, then the request will be handled as if the server did not have SNI support.

Note: In Ubuntu, make changes appropriately to ports.conf and sites-enabled/your-ssl-websites  configuration files. In SLES, make changes appropriately  to listen.conf and vhosts.d/your-ssl-websites configuration files.

Additional Info:

Q: How to create SSL self signed certificate?

Ans: You can follow 4 basic steps:

    Step1: Generate no pass-phrase server private key; Note you can use any name for the key and certs. I prefer to use website URL as it is easier to track.

            #openssl genrsa -out website1.yourdomain.com.key 2048

    Step2: Generate CSR(Certificate Signing Request) using server private key

           #openssl req -new -key website1.yourdomain.com.key -out website1.yourdomain.com.csr

   Step3: Generate certificate using CSR and server private key.

           #openssl x509 -req -days 730 -in website1.yourdomain.com.csr  
-signkey website1.yourdomain.com.key -out website1.yourdomain.com.crt

   Step4: Copy certs and keys to appropriate location. In Linux, you can copy private keys to /etc/ssl/private and certificates to /etc/ssl/certs/

Q: How can I view the details of a certificate?

Ans: You can use the following command 
 #openssl x509 -in website1.yourdomain.com.crt -text

You can see that Certificate contains the reference to the issuer, the public key of the owner of this certificate, the dates of validity of this certificate and the signature of the certificate to ensure this certificate hasn't been tampered with. The certificate does not contain the private key as it should never be transmitted in any form whatsoever. This certificate has all the elements to send an encrypted message to the owner (using the public key) or to verify a message signed by the author of this certificate.

Q: How can I deploy SSL key and certificate in Apache?

Ans: You can follow 2 basic steps:

  Step1: Update VirtualHost configuration with the information of  SSL key and certificate you created.

    <VirtualHost *:443>

        ServerName  website1.yourdomain.com

        DocumentRoot /usr/local/your-website1/   
        SSLCertificateFile    /etc/ssl/certs/website1.yourdomain.com.crt
        SSLCertificateKeyFile /etc/ssl/private/website1.yourdomain.com.key

   </VirutalHost>

  Step2: Reload apache

         #service apache2 reload

Q: How SSL works?

Ans: 
Read notes from Symantec.com , tldp.org and luxsci.com

Basic steps (reference: tldp.org):

1. A browser requests a secure page (usually https://).
2. The web server sends its public key with its certificate. Note: Usually Certificate is signed with a private key of trusted Certificate Authority (e.g Verisign, Thwate, GoDaddy,etc). You can self sign a cert as demonstrated above if you don't want to pay for CSR. 
3. All the browser comes installed with public key of all trusted Certificate Authority. The browser uses the public key to verify that the certificate was issued by a trusted root CA and certificate is still valid and that the certificate is related to the site contacted. If certificate is not signed by trusted CA, browser will complain that "Site's certificate is not trusted!".
4. The browser then uses web server's public key to encrypt a random symmetric encryption key and sends it to the server with the encrypted URL required as well as other encrypted http data.
5. The web server decrypts the symmetric encryption key using its private key and uses the symmetric key to decrypt the URL and http data.
6. The web server sends back the requested html document and http data encrypted with the symmetric key.
7. The browser decrypts the http data and html document using the symmetric key and displays the information.

Reference:

http://svn.apache.org/viewvc?revision=776281&view=revision

http://en.wikipedia.org/wiki/Server_Name_Indication

Apache2.2: Defining Virtual Hosts, Re-direction and LDAP authentication uncovered

I usually put references at the bottom of the article. But this time I want to put it in the beginning of the article. If you are Apache beginner, trust me you want to go through these references before you start doing anything.

References:
Apache Directives: http://httpd.apache.org/docs/2.2/mod/directive-dict.html#Context
Name-Based Virtual Hosts: http://httpd.apache.org/docs/2.2/vhosts/name-based.html
LDAP directory for authentication: http://httpd.apache.org/docs/2.3/mod/mod_authnz_ldap.html
LDAP and Active Directory Terminologies: http://rapidtechguide.blogspot.com/2011/07/directories-terminology-active.html


Practice Scenario:

Windows Server
Web Server: Apache2.2
IP add: 192.168.1.10
Port: 80
Websites hosted:
www1.test.org
www.mytest.org
www.urtest.org
www.ourtest.org
www.everyonetest.org
www.lovetest.org


Before you start testing your apache setup make sure that DNS is configured properly, hosts file is configured properly.

STEP1:
File: C:\Windows\System32\drivers\etc\hosts
192.168.1.10 www1.test.org
192.168.1.10 www.mytest.org
192.168.1.10 www.urtest.org
192.168.1.10 www.ourtest.org
192.168.1.10 www.everyonetest.org
192.168.1.10 www.lovetest.org

#everyonetest.org and lovetest.org are alias of ourtest.org

STEP2:
Configure DNS server to point those domains 'mytest.org, urtest.org, ourtest.org,everyonetest.org,lovetest.org' to 192.168.1.10. You can contact your DNS administrator

STEP3:
Say Apache2.2 is installed in C: drive
C:\apache

and you are publishing your web contents at C:\website
C:\website\mytest
C:\website\urtest
C:\website\ourtest

STEP4:
C:\apache\conf\httpd.conf# Change this to Listen on specific IP addresses as shown below to
# prevent Apache from glomming onto all bound IP addresses.
Listen 192.168.1.10:80

#uncomment these for LDAP authentication support
LoadModule authnz_ldap_module modules/mod_authnz_ldap.so
LoadModule ldap_module modules/mod_ldap.so

ServerName www1.test.org

#
# DirectoryIndex: sets the file that Apache will serve if a directory
# is requested.
#
<IfModule dir_module>
DirectoryIndex index.htm index.html index.shtml index.html.var index.php index.pl default.html default.htm
</IfModule>

#Set LogLevel to debug if you are configuring Apache for first time so that you can collect enough logging information for troubleshooting purpose
LogLevel debug

<IfModule mime_module>
#Uncomment this line to have shtml MIME support
AddType text/html .shtml
</IfModule>

# Uncomment following line to add Virtual hosts in different file
Include conf/extra/httpd-vhosts.confSTEP5:
C:\conf\extra\httpd-vhosts.conf#
# Use name-based virtual hosting.
#
NameVirtualHost 192.168.1.10:80#Regular Virtual Host Configuration Example# WWW.MYTEST.ORG BEGIN
# mytest.org is published at C:/website/mytest

<VirtualHost 192.168.1.10:80>
ServerName www.mytest.org
DocumentRoot C:/website/mytest

<Directory C:/website/mytest>
AllowOverride None
Order deny,allow
Allow from all
</Directory>

ErrorLog "logs/www.mytest.org-error.log"
CustomLog "logs/www.mytest.org-access.log" common

ErrorDocument 401 /unauth.shtml
ErrorDocument 403 /forbid.shtml
ErrorDocument 404 /notfound.shtml
ErrorDocument 500 /error.shtml
</VirtualHost>

# WWW.MYTEST.ORG END#Re-Direction Configuration Example
# WWW.URTEST.ORG BEGIN
# urtest.org is simply re-directed to www.wikipedia.org

<VirtualHost 192.168.1.10:80>
ServerName www.urtest.org
Redirect permanent / https://www.wikipedia.org
</VirtualHost>

# WWW.URTEST.ORG END


#LDAP Authentication Configuration Example
# WWW.OURTEST.ORG BEGIN
# ourtest.org is published at C:/website/ourtest
# LDAP authentication is required to access the conents of C:/website/ourtest

<VirtualHost 192.168.1.10:80>
ServerName www.ourtest.org
ServerAlias everyonetest.org lovetest.org
DocumentRoot C:/website/mytest

<Directory C:/website/mytest>
AllowOverride None
Order deny,allow
Allow from all

AuthType Basic
AuthBasicProvider ldap
AuthzLDAPAuthoritative on

AuthLDAPBindDN "cn=ldapuser,ou=\"Super Accounts\",DC=ad,DC=test,DC=org"
AuthLDAPBindPassword ipassword

AuthName "Only for registered users"

AuthLDAPURL "ldap://ldap.test.org:389/ou=students,ou=toefl,dc=ad,dc=test,dc=org?name"

#Syntax for AuthLDAPRUL ldap://host:port/basedn?attribute?scope?filter

#For more info refer to page 3 of https://www.ietf.org/rfc/rfc2255.txt

require valid-user
</Directory>

ErrorLog "logs/www.mytest.org-error.log"
CustomLog "logs/www.mytest.org-access.log" common

ErrorDocument 401 /unauth.shtml
ErrorDocument 403 /forbid.shtml
ErrorDocument 404 /notfound.shtml
ErrorDocument 500 /error.shtml
</VirtualHost>

# WWW.OURTEST.ORG END
Some other tips:
I would prefer to use Internet Explorer(IE) for testing webpages as lots of users are using IE. In IE go to Tools--> Internet Options and Check 'Delete Browsing History on Exit". Sometimes Internet Browser displays webpages from it's temp files, so even if your apache/web server is stopped you might see webpages working (I have seen it and it took me quite a time to get around with it). Or sometimes if you make some content changes, your browser may not reflect those changes. So, while perfoming apache setup and testing 'Delete Browsing History' really helps. Close the browser. Re-open the browser and see if you got ur desired output.
Sometime you might have to flush local DNS cache. If you have to you can use following command
> ipconfig /flushdns

Good Luck!!!

Additional References:
http://www.yolinux.com/TUTORIALS/LinuxTutorialApacheAddingLoginSiteProtection.html

Also read per-User web directories documentation from Apache
http://httpd.apache.org/docs/2.0/howto/public_html.html