SNI拿错证书

Question

我得到了以下设置

Listen 443
NameVirtualHost *:443
    <virtualhost *:443>
    Servername  1.domain.com
    DocumentRoot /1
    SSLEngine on
    SSLVerifyClient none
    SSLCertificateFile /etc/apache/1.cer
    SSLCertificateKeyFile /etc/apache/1.key
    SSLCertificateChainFile /etc/apache/1.crt
    </virtualhost>

    <virtualhost *:443>
    Servername  2.domain.com
    DocumentRoot /2
    SSLEngine on
    SSLVerifyClient none
    SSLCertificateFile /etc/apache/2.cer
    SSLCertificateKeyFile /etc/apache/2.key
    SSLCertificateChainFile /etc/apache/2.crt
    </virtualhost>

出于某种原因，SNI 从网站 2 上的 1.domain.com 获取证书，导致出现不安全的连接警告页面。有人知道为什么吗？我正在使用 apache Apache/2.2.15 (Unix) 和 OpenSSL 1.0.1e-fips

Answer 1

我已经设法让它工作了，显然 apache 要求 namevirtualhost 出现在 /etc/httpd/conf.d/ssl.conf 文件中而不是 httpd.conf

SNI拿错证书

SNI takes wrong certificate

apache

certificate

sni