Why does apache httpd tell me that my name-based virtualhosts only works with SNI enabled browers (RFC 4366)
Posted
by
Arlukin
on Server Fault
See other posts from Server Fault
or by Arlukin
Published on 2012-10-03T20:58:26Z
Indexed on
2012/10/03
21:41 UTC
Read the original article
Hit count: 235
Why does apache give me this error message in my logs? Is it a false positive?
[warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
I have recently upgraded from Centos 5.7 to 6.3, and by that to a newer httpd version. I have always made my ssl virtualhost configurations like below. Where all domains that share the same certificate (mostly/always wildcard certs) share the same ip. But never got this error message before (or have I, maybe I haven't looked to enough in my logs?) From what I have learned this should work without SNI (Server Name Indication)
Here is relevant parts of my httpd.conf file. Without this VirtualHost I don't get the error message.
NameVirtualHost 10.101.0.135:443
<VirtualHost 10.101.0.135:443>
ServerName sub1.domain.com
SSLEngine on
SSLProtocol -all +SSLv3 +TLSv1
SSLCipherSuite ALL:!aNull:!EDH:!DH:!ADH:!eNull:!LOW:!EXP:RC4+RSA+SHA1:+HIGH:+MEDIUM
SSLCertificateFile /opt/RootLive/etc/ssl/ssl.crt/wild.fareoffice.com.crt
SSLCertificateKeyFile /opt/RootLive/etc/ssl/ssl.key/wild.fareoffice.com.key
SSLCertificateChainFile /opt/RootLive/etc/ssl/ca/geotrust-ca.pem
</VirtualHost>
<VirtualHost 10.101.0.135:443>
ServerName sub2.domain.com
SSLEngine on
SSLProtocol -all +SSLv3 +TLSv1
SSLCipherSuite ALL:!aNull:!EDH:!DH:!ADH:!eNull:!LOW:!EXP:RC4+RSA+SHA1:+HIGH:+MEDIUM
SSLCertificateFile /opt/RootLive/etc/ssl/ssl.crt/wild.fareoffice.com.crt
SSLCertificateKeyFile /opt/RootLive/etc/ssl/ssl.key/wild.fareoffice.com.key
SSLCertificateChainFile /opt/RootLive/etc/ssl/ca/geotrust-ca.pem
</VirtualHost>
© Server Fault or respective owner