我有一个有3个networking接口的linux服务器，一个用于局域网，另一个用于广域网（IPv4和IPv6）。
到目前为止，apache被configuration为使用80上的单个虚拟主机为external.domain.com （作为ServerName ）和internal.domain.local （作为ServerAlias ）提供同一个网站。
我现在已经获得了external.domain.com的证书，并用mod_rewrite重新configuration了虚拟主机，以将HTTP请求redirect到HTTPS。 从外部访问该网站时，效果很好。
但是，由于网站是用不同的主机名访问的，所以我认为来自局域网的请求应该使用普通的HTTP。
我是否需要创build一个单独的虚拟主机，或者我可以处理一切只有一个？
这是我目前的configuration：
<VirtualHost *:80> ServerName external.domain.com RewriteEngine on ReWriteCond %{SERVER_PORT} !^443$ RewriteRule ^/(.*) https://%{HTTP_HOST}/$1 [NC,R,L] </VirtualHost> <IfModule mod_ssl.c> <VirtualHost *:443> ServerName external.domain.com ServerAlias internal.domain.local Header always add Strict-Transport-Security "max-age=15768000" DocumentRoot /data/htdocs/site1 <Directory /data/htdocs/site1> Options Indexes FollowSymLinks MultiViews AllowOverride None Require all granted </Directory> ErrorLog ${APACHE_LOG_DIR}/site1-error.log LogLevel info CustomLog ${APACHE_LOG_DIR}/site1-access.log combined ServerSignature On SSLEngine on SSLCertificateFile /etc/ssl/private/apache/external.domain.com.crt SSLCertificateKeyFile /etc/ssl/private/apache/external.domain.com.key SSLCertificateChainFile /etc/ssl/certs/COMODO_DV_SHA-256_bundle.crt SSLProtocol all -SSLv2 -SSLv3 #SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES+SHA384:ECDH+AES+SHA256:DH+AES:!RSA+AES256:!ADH:!AECDH:!MD5:!DSS:!aNULL:!eNULL:!LOW:!EXP #SSLHonorCipherOrder on SSLCipherSuite ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA SSLHonorCipherOrder on #SSLOpenSSLConfCmd DHParameters /etc/apache2/ssl/dhparams.pem <FilesMatch "\.(cgi|shtml|phtml|php)$"> SSLOptions +StdEnvVars </FilesMatch> BrowserMatch "MSIE [2-6]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0 BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown </VirtualHost> </IfModule> 谢谢
如果你有不同的接口你想performance不同，你应该定义不同的虚拟主机，并指定每个“需要”的IP地址。 计划可以这样下去，或者至less我觉得这是更简单的方法：
<VirtualHost localip:80> .... </VirtualHost> <VirtualHost extip:80> Redirect / https://external.example.com/ </VirtualHost> <VirtualHost extip:443> .... </VirtualHost>