Re: [us...@httpd] htaccess format howto question

2010-05-14 Thread Matus UHLAR - fantomas
On 13.05.10 21:08, David Banning wrote:
 I am wondering how I might do a .htaccess redirect if I want to redirect

 domain.com/index.php?id=606

 to domain.com

 I have been pouring over many apache how-to's and have not been able to  
 find an answer as yet.

I think that

RedirectMatch /index.php(?.*) /

could do that. While rewrites may wor, I prefer easier solutions.

-- 
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Chernobyl was an Windows 95 beta test site.

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Fwd: Re: [us...@httpd] Apache 2.2 slow transfers on Windows Server 2003

2010-05-14 Thread Antonio Vidal Ferrer
 Have you verified that you don't have the dns resolution turned on?

Check config files for HostnameLookups, it should be off (it is by
default but better to check)

Hope you find the solution soon

Best,

Antonio Vidal

El 13/05/2010 19:41, Cameron Altenhof-Long escribió:
 We're having a performance problem with Apache running on Windows 
 Server 2003 and have not been able to resolve it using any of the 
 previously mentioned suggestions.

 The server runs Windows Server 2003 SP2 and Apache 2.2.13. We have 
 also tested Apache 2.2.15 on Windows Server 2008 through an Amazon 
 instance with similar results.

 Our throughput tests are done with either 10MB or 100MB files using 
 'curl' running on an OSX server. On the same LAN as the Windows server 
 we can achieve file transfer rates  40MB/s, from either IIS or Apache.

 If we adjust the routing to include a cisco firewall and router in our 
 datacenter the transfer rates drop to ~7800KB/s for Apache and 
 ~9200KB/s for IIS. As a side note, transfers from Apache on an OS X 
 server are closer to ~9.8MB/s which is about as fast as we can go 
 through the 100Mbit firewall.

 Our biggest problems occur outside of the data center where we see 
 transfer rate variances of ~500KB/s from IIS versus ~185KB/s from Apache.

 Adding 'EnableSendfile off' to the Apache config actually slows things 
 down for us. The 'EnableMMAP off' and 'Win32DisableAcceptEx' options 
 don't seem to matter for us.

 Our datacenter support group keeps pointing to IIS performance as 
 confirmation that the network is stable.

 We really, really don't want to switch to IIS and it's not feasible 
 for us to swap out several Windows servers for Unix servers at this time.

 I'm open to any suggestions on things to try to see if we can bring 
 Apache perform up to something closer to what we are seeing with IIS.

 -
 The official User-To-User support forum of the Apache HTTP Server Project.
 See URL:http://httpd.apache.org/userslist.html for more info.
 To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
   from the digest: users-digest-unsubscr...@httpd.apache.org
 For additional commands, e-mail: users-h...@httpd.apache.org

 .

   


-- 
***
Antonio Vidal Ferrer Globalia Corporación Empresarial Senior System
Manager Carretera Arenal Llucmajor km 21.5 Globalia Sistemas y
Comunicaciones S.L. www.globalia-corp.com
antonio.vi...@globalia-sistemas.com 07620 Llucmajor - Islas Baleares –
España T: (0034) 971-178464 T: (0034) 971-178100 M: (0034) 647-995481
***


-- 
***
Antonio Vidal Ferrer Globalia Corporación Empresarial Senior System
Manager Carretera Arenal Llucmajor km 21.5 Globalia Sistemas y
Comunicaciones S.L. www.globalia-corp.com
antonio.vi...@globalia-sistemas.com 07620 Llucmajor - Islas Baleares –
España T: (0034) 971-178464 T: (0034) 971-178100 M: (0034) 647-995481
***


-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Re: [us...@httpd] Re: Help !!! Apache HTTP process consumes high memory usage

2010-05-14 Thread Igor Galić

- Arunkumar Janarthanan arunkumar.webad...@gmail.com wrote:

 I could see its most of them from PHP and its components.
[snip]


 
 On Fri, May 14, 2010 at 1:10 AM, Arunkumar Janarthanan 
 arunkumar.webad...@gmail.com  wrote:
 
 
 Hi,
 
 I have build an Apache instance 2.2.15 with prefork MPM and most of
 the modules as shared. I have PHP and MYSQL installed and configured
 on this machine (MYSQL client) with this every process created by
 Apache daemon consumes 280M memory almost for each call.
 
 I am running on RHEL 5 with 5 Gig of memory when load increases on
 server it takes down the machine. Also I could see each library
 getting called thrice makes the HTTPD daemon heavy weight.
 
 Please advice how could I trim down the memory consumption by each
 process.
 
[snip]


Looking at my Fedora config, I see that the default MaxRequestsPerChild is 4000
which can be considered a pretty good value for running PHP.

That would've been my first shot (if on RHEL 5 that value is higher, or 0, 
consider
changing it: http://httpd.apache.org/docs/2.2/mpm.html )

Next off is that you should consider running PHP accelerated. See: 
http://pecl.php.net/APC

Also, your application is also a good candidate for memory consumption.
Take a look at my writeup on that topic: 
http://blag.esotericsystems.at/2010/01/php-memory-abuse/


 Best Regards,
 Arun J

So long,
-- 
Igor Galić

Tel: +43 (0) 699 122 96 338
Fax: +43(0) 1 91 333 41
Mail: i.ga...@brainsware.org
URL: http://brainsware.org/

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Re: [us...@httpd] Apache http reverse-proxy configuration

2010-05-14 Thread Igor Galić

- Claudia dosSantos claudia.dossan...@ricoh-europe.com wrote:

 Hi,
 
 I'm trying to configure a reverse proxy for Gerrit code review.
 
 The configuration in httpd.conf file is:
 
 
 #
 # Reverse Proxy for Gerrit
 #
 LoadModule proxy_module modules/mod_proxy.so
 LoadModule proxy_http_module modules/mod_proxy_http.so
 
 LoadModule proxy_html_module modules/mod_proxy_html/mod_proxy_html.so
 LoadModule xml2enc_module modules/mod_proxy_html/mod_xml2enc.so
 
 ProxyRequests Off

ProxyRequests Off is the default: 
http://httpd.apache.org/docs/2.2/mod/mod_proxy.html#proxyrequests


 ProxyPass /r/ http://172.17.27.186:8081/r/

You appear to be missing the Reverse Path:

ProxyPassReverse /r/ http://172.17.27.186:8081/r/

 ProxyPreserveHost On
 
 Proxy *
 Order deny,allow
 Allow from all
 /Proxy

This is usually the default too...

 Location /r/ 
 AuthType Basic
 AuthName Gerrit Review Server
 AuthUserFile passwd
 Require valid-user
 /Location

If you're trying to get authentication to work correctly, I suggest to read
http://www.apachetutor.org/admin/reverseproxies about reverse proxies in general
and then to adapt your setup to something like this


ProxyPass /r/ http://172.17.27.186:8081/r/
Location /r/ 
  AuthStuffHere
  ProxyPassReverse /
/Location

 
 And the configuration in gerrit.conf file is:
 
 ...
 
 [httpd]
 listenUrl = proxy-http://172.17.27.186:8081/r/
 
 
 
 
 When i try to access http://localhost/r/ the authentication required
 window shows up, but after authentification i get this message:
 
 Service Temporarily Unavailable...
 
 When i try to access http://172.17.27.186:8082/r/ i get another error:
 
 HTTP ERROR 403
 
 Problem accessing /r/login/mine. Reason: Forbidden
 
 It seems that the reverse proxy doesn't work properly.
 It's weird because i have already Nexus Server with reverse proxy in
 another Server and it works just fine...
 
 
 
 If anyone knows what's wrong let me know please.
 
 
 regards,
 
 Santos


So long,
-- 
Igor Galić

Tel: +43 (0) 699 122 96 338
Fax: +43(0) 1 91 333 41
Mail: i.ga...@brainsware.org
URL: http://brainsware.org/

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Re: [us...@httpd] Trusting another server's certificate

2010-05-14 Thread Igor Galić

- Bruno Melloni bruno.mell...@chickasaw.net wrote:

 I successfully setup Apache Web Server, mod_ssl and mod_jk so that
 Apache acts as the load balancer for a cluster of Tomcat(based)
 servers - using self-signed certificates.  This means that I created
 Apache's certificates with openssl and Tomcat's with Java's keytool.

First off: The recommended way to connect Tomcat and httpd these days is
via mod_proxy_ajp/mod_proxy_balancer.

Next, for your sanity's sake, I do not recommend the use of keytool.
Tomcat understands a number of formats:
http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html#Prepare%20the%20Certificate%20Keystore

 Two of my applications communicate with each other via HTTPS, and the
 servers must trust each other.  For the Tomcat server to trust the
 Apache server all I need to do is import the Apache certificate into
 the keystore (and/or cacerts).  
 
 How do I make Apache trust the Tomcat server so that app-to-app HTTPS
 calls work?  Or do I even need to?

Exactly the same way:
http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslproxycacertificatefile

 Thanks

Bye,
-- 
Igor Galić

Tel: +43 (0) 699 122 96 338
Fax: +43(0) 1 91 333 41
Mail: i.ga...@brainsware.org
URL: http://brainsware.org/

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Re: [us...@httpd] Apache 2.2 slow transfers on Windows Server 2003

2010-05-14 Thread Cameron Altenhof-Long
Thanks for the suggestion. I checked config files for HostnameLookups 
but didn't find anything.


To further validate my observations, I set up a new Windows 2003 
instance on Amazon, loaded WAMP (Apache 2.2.11), enabled IIS and also 
loaded the Abyss Web Server. Apache was significantly slower than the 
other two and the existing suggestions to change 'EnableMMAP' and 
'EnableSendfile' didn't help.


-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
 from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Re: [us...@httpd] Apache strange(?) DNS problem

2010-05-14 Thread Matija Levec

Just for the record...Initial problem was(n't) resolved. I reinstalled server with CentOS 4.8 and stock httpd-2.0.52-41.ent.7.centos4 which works as it should.Regards,Matija "Matija Levec" matija.le...@astec.si 13.5.2010 17:40 That's exactly what I would expect.But with Apache 2.0.63 (and also stock 2.2.3) on CentOS 5.4 I have problems described earlier - for a host in /etc/hosts Apache queries DNS while other programs (e.g. ping) correctly use resolver. Config and tests were recheked by my co-worker who confirmed the results. I can't find any reasonable explanation at the moment...Matija Eric Covener cove...@gmail.com 13.5.2010 16:30 On Thu, May 13, 2010 at 10:02 AM, Matija Levec matija.le...@astec.si wrote: I can confirm that almost exactly the same config also works on Apache 2.0.59 on CentOS 4.8 .On the exact same system? Apache just calls into the resolver.-- Eric Covenercove...@gmail.com -The official User-To-User support forum of the Apache HTTP Server Project.See URL:http://httpd.apache.org/userslist.html for more info.To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org  " from the digest: users-digest-unsubscr...@httpd.apache.org For additional commands, e-mail: users-h...@httpd.apache.org 


smime.p7s
Description: S/MIME Cryptographic Signature


Re: [us...@httpd] Apache 2.2 slow transfers on Windows Server 2003

2010-05-14 Thread Eric Covener
On Fri, May 14, 2010 at 9:42 AM, Cameron Altenhof-Long
came...@metagear.com wrote:
 Thanks for the suggestion. I checked config files for HostnameLookups but
 didn't find anything.

 To further validate my observations, I set up a new Windows 2003 instance on
 Amazon, loaded WAMP (Apache 2.2.11), enabled IIS and also loaded the Abyss
 Web Server. Apache was significantly slower than the other two and the
 existing suggestions to change 'EnableMMAP' and 'EnableSendfile' didn't
 help.

two things worth trying: bump sendbuffersize or disable delayed acks in Windows?

-- 
Eric Covener
cove...@gmail.com

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Re: [us...@httpd] Apache strange(?) DNS problem

2010-05-14 Thread Eric Covener
On Fri, May 14, 2010 at 9:47 AM, Matija Levec matija.le...@astec.si wrote:
 Just for the record...

 Initial problem was(n't) resolved. I reinstalled server with CentOS 4.8 and
 stock httpd-2.0.52-41.ent.7.centos4 which works as it should.

does installing nscd maybe re-break you?

-- 
Eric Covener
cove...@gmail.com

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Re: [us...@httpd] mod_speling issues

2010-05-14 Thread Donovan Brooke

Donovan Brooke wrote:

O.K., for others who may run into this, it
appears to be that this was fixed in 2.2.9

http://www.apache.org/dist/httpd/CHANGES_2.2

(do a page search for 'mod_speling')

Looks like I'm in need for an upgrade.

Donovan




Hmmm, the upgrade to 2.2.9 did not fix it. :-(

I have no ideas from here.

Donovan



--
D Brooke

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
 from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



[us...@httpd] Mod_dbd using Oracle Instant Client not sending correct Connection String on Solaris ignoring most http.conf values

2010-05-14 Thread Kevin Castellow
I am using Apache with mod-dbd and the Oracle Instant client.  I am not
seeing the correct connection string values sent to Oracle from Apache
despite the values in my TNS file and httpd.conf.

My Apache version is below:
Server version: Apache/2.2.15 (Unix)
Server built:   May 12 2010 13:54:22

My Oracle Instant Client is:
Version 11.2.0.1.0 for 32-bit Solaris Sparc.
I have the instant client full version, with sdk, and sqlplus.  I used the
sqlplus to assist in testing.

My OS is:
SunOS testldsdev02b 5.10 Generic_118833-36 sun4v sparc SUNW,Sun-Fire-T1000


Description:
I built the apr and apr-util to activate the apr_dbd_oracle.so.  This build
completed with no errors.
I have the instant client installed in a directory that is inside of my
apache home.
$apache_home/oracle/instantclient_11_2/


My HTTPD.CONF snippet looks like this:

# mod_dbd configuration
DBDriver oracle
DBDParams user=dcbdev2 pass=dcbdev2
dbname=test.company.netserver=asglssora02-vip


DBDMin  4
DBDKeep 8
DBDMax  20
DBDExptime 300

Directory /opt/app/apache2/htdocs/test

  # core authentication and mod_auth_basic configuration
  # for mod_authn_dbd
  AuthType Basic
  AuthName My Server
  AuthBasicProvider dbd

  # core authorization configuration
  Require valid-user

  # mod_authn_dbd SQL query to authenticate a user
  AuthDBDUserPWQuery Select BASIC_PASSWORD from BASE where USER_ID=%s
/Directory


My TNSNAMES file has these values: (I don't believe this file is used for
Apache connectivity but I put it there in case it is.)
TEST =
  (DESCRIPTION =
(ADDRESS_LIST =
  (ADDRESS = (PROTOCOL = TCP)(HOST = asglssora02-vip)(PORT = 1521))
 #(FAILOVER = YES)
)
(CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = test.company.net))
  )


From SNOOP I see this being sent from the Apache server to the oracle
listener.

Connect Data:
(DESCRIPTION=(CONNECT_DATA=(SERVICE_NAME=)(CID=(PROGRAM=httpd)(HOST=testldsdev02b)(USER=daemon)))(ADDRESS=(PROTOCOL=TCP)(HOST=172.16.235.13)(PORT=1521)))

That is copied and pasted right from the capture file.

The problems are there is not a SERVICE_NAME value, the user name is the
name of the process starting Apache and not the database user.
The only value that is correct is the host ip address but I'm not sure how
it got that value but not the other values.

How do I populate the value of the service name and user properly?


Additionally here is the error log on startup from on log level error
[Fri May 14 10:50:19 2010] [notice] Apache/2.2.15 (Unix) mod_ssl/2.2.15
OpenSSL/
0.9.7d DAV/2 configured -- resuming normal operations
[Fri May 14 10:50:19 2010] [info] Server built: May 12 2010 13:54:22
[Fri May 14 10:50:19 2010] [debug] worker.c(1757): AcceptMutex: pthread
(default: pthread)
[Fri May 14 10:50:19 2010] [error] (20014)Internal error: DBD: Can't connect
to oracle
[Fri May 14 10:50:19 2010] [error] (20014)Internal error: DBD: failed to
initialise
[Fri May 14 10:50:19 2010] [crit] (20014)Internal error: DBD: child init
failed!
[Fri May 14 10:50:19 2010] [error] (20014)Internal error: DBD: Can't connect
to oracle



Regards,
Kevin
http://kevincastellow.workintel.com


Re: [us...@httpd] Mod_dbd using Oracle Instant Client not sending correct Connection String on Solaris ignoring most http.conf values

2010-05-14 Thread Jeff Trawick
On Fri, May 14, 2010 at 11:44 AM, Kevin Castellow
kev.castel...@gmail.com wrote:
 I am using Apache with mod-dbd and the Oracle Instant client.  I am not
 seeing the correct connection string values sent to Oracle from Apache
 despite the values in my TNS file and httpd.conf.

 My HTTPD.CONF snippet looks like this:

 # mod_dbd configuration
 DBDriver oracle
 DBDParams user=dcbdev2 pass=dcbdev2 dbname=test.company.net
 server=asglssora02-vip
...
 The problems are there is not a SERVICE_NAME value, the user name is the
 name of the process starting Apache and not the database user.
 The only value that is correct is the host ip address but I'm not sure how
 it got that value but not the other values.

 How do I populate the value of the service name and user properly?

If you want to experiment, try adding #define CAN_DO_LOGIN to the
top of apr_dbd_oracle.c in APR-Util and rebuilding.

The user and pass are specified on an earlier DB call when that is
defined.  Also, the dbname will never be provided unless CAN_DO_LOGIN
is defined.

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



[us...@httpd] Reverse Proxy Configuration

2010-05-14 Thread John Iliffe
I am attempting to connect the HTTP port of our mail server through
Apache so that Inet users can connect by browser to get their mail.  

If I give the full path to the mail server login screen in the config
file:

 ProxyPass /mail http://192.168.1.12:8080/email

the browser hangs and I get the following log entry:

 file does not exist: [document root]/email referer .

which is logical because the mail server on port 8080 does not share the
Apache document structure.

If I drop the path info, everything seems to work OK except that the
entry point to the email server provides options that I don't want to
offer the users.  (Like account administration!)

My full config entry that I am trying to use is:

ProxyRequests off
ProxyPass /mail/* !
ProxyPass /mail http://192.168.1.12:8080/email
ProxyPassReverse /mail http://192.168.1.12:8080/email

and I put this inside the VirtualHost container for the web site.

I think I have not interpreted the documentation properly but I don't
see where.

Regards,

John




-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



[us...@httpd] ssl certifikate mismatch

2010-05-14 Thread Reinhard Vicinus

Hi,

is the following behaviour of apache 2.2.15 (debian unstable) a feature 
or a bug?


Listen 10.0.0.1:81
VirtualHost 10.0.0.1:81
  SSLEngine on
  SSLCertificateFile /etc/apache2/conf/aaa.crt
  SSLCertificateKeyFile /etc/apache2/conf/aaa.key

  ServerName aaa
/VirtualHost

Listen 10.0.0.2:81
VirtualHost 10.0.0.2:81
  SSLEngine on
  SSLCertificateFile /etc/apache2/conf/bbb.crt
  SSLCertificateKeyFile /etc/apache2/conf/bbb.key

  ServerName aaa
/VirtualHost


 curl https://bbb:81
 SSL: certificate subject name 'aaa' does not match target host name 'bbb'

 curl https://10.0.0.2:81
 SSL: certificate subject name 'aaa' does not match target host name 
'10.0.0.2'


if i remove or change the ServerName directive so that they differ then 
it works as expected and certificate bbb is returned. If i switch the 
order of the virtual host configuration certificate bbb is also used if 
i query 10.0.0.1:81.


Thanks in advance
Reinhard

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
 from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Re: [us...@httpd] ssl certifikate mismatch

2010-05-14 Thread Eric Covener
On Fri, May 14, 2010 at 4:51 PM, Reinhard Vicinus r.vici...@metaways.de wrote:
 Hi,

 is the following behaviour of apache 2.2.15 (debian unstable) a feature or a
 bug?

 Listen 10.0.0.1:81
 VirtualHost 10.0.0.1:81
  SSLEngine on
  SSLCertificateFile /etc/apache2/conf/aaa.crt
  SSLCertificateKeyFile /etc/apache2/conf/aaa.key

  ServerName aaa
 /VirtualHost

 Listen 10.0.0.2:81
 VirtualHost 10.0.0.2:81
  SSLEngine on
  SSLCertificateFile /etc/apache2/conf/bbb.crt
  SSLCertificateKeyFile /etc/apache2/conf/bbb.key

  ServerName aaa
 /VirtualHost


 curl https://bbb:81
  SSL: certificate subject name 'aaa' does not match target host name 'bbb'

 curl https://10.0.0.2:81
  SSL: certificate subject name 'aaa' does not match target host name
 '10.0.0.2'

 if i remove or change the ServerName directive so that they differ then it
 works as expected and certificate bbb is returned. If i switch the order of
 the virtual host configuration certificate bbb is also used if i query
 10.0.0.1:81.


SNI finds the right name-based vhost based on the normal name-based
mechanisms (ServerName/ServerAlias), then uses the cert it finds there
-- it doesn't find the right vhost by looking at your certificates.

-- 
Eric Covener
cove...@gmail.com

-
The official User-To-User support forum of the Apache HTTP Server Project.
See URL:http://httpd.apache.org/userslist.html for more info.
To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
  from the digest: users-digest-unsubscr...@httpd.apache.org
For additional commands, e-mail: users-h...@httpd.apache.org



Re: [us...@httpd] ssl certifikate mismatch

2010-05-14 Thread Kevin Castellow
From my experience the configuration file is a top down processing.  If you
repeat a setting multiple times it will usually take the last setting.
In this example it wouldn't surprise me if you repeat the setting of virtual
server with the same value, it returns an error trying to match the
certificate name on the second certificate.

If the virtual server name is not used the reverse DNS lookup finds the
appropriate name equivalent to the ip address.

Kevin
http://kevincastellow.workintel.com





On Fri, May 14, 2010 at 4:51 PM, Reinhard Vicinus r.vici...@metaways.dewrote:

 Hi,

 is the following behaviour of apache 2.2.15 (debian unstable) a feature or
 a bug?

 Listen 10.0.0.1:81
 VirtualHost 10.0.0.1:81
  SSLEngine on
  SSLCertificateFile /etc/apache2/conf/aaa.crt
  SSLCertificateKeyFile /etc/apache2/conf/aaa.key

  ServerName aaa
 /VirtualHost

 Listen 10.0.0.2:81
 VirtualHost 10.0.0.2:81
  SSLEngine on
  SSLCertificateFile /etc/apache2/conf/bbb.crt
  SSLCertificateKeyFile /etc/apache2/conf/bbb.key

  ServerName aaa
 /VirtualHost


  curl https://bbb:81
  SSL: certificate subject name 'aaa' does not match target host name 'bbb'

  curl https://10.0.0.2:81
  SSL: certificate subject name 'aaa' does not match target host name
 '10.0.0.2'

 if i remove or change the ServerName directive so that they differ then it
 works as expected and certificate bbb is returned. If i switch the order of
 the virtual host configuration certificate bbb is also used if i query
 10.0.0.1:81.

 Thanks in advance
 Reinhard


 -
 The official User-To-User support forum of the Apache HTTP Server Project.
 See URL:http://httpd.apache.org/userslist.html for more info.
 To unsubscribe, e-mail: users-unsubscr...@httpd.apache.org
 from the digest: users-digest-unsubscr...@httpd.apache.org
 For additional commands, e-mail: users-h...@httpd.apache.org