用sslparsing多个基于apache名称的虚拟主机

我在httpd-ssl.conf中有以下configuration

NameVirtualHost *:8443 <VirtualHost _default_:8443> ServerName sub.domain1.com ServerAlias sub2.domain1.com SSLEngine on SSLCertificateFile "/path/to/file.crt" SSLCertificateKeyFile "/path/to/file.key" SSLCertificateChainFile "/path/to/chainFile.crt" # some other settings... </VirtualHost> <VirtualHost _default_:8443> ServerName www.domain1.com ServerAlias domain1.com SSLEngine on SSLCertificateFile "/path/to/file.crt" SSLCertificateKeyFile "/path/to/file.key" SSLCertificateChainFile "/path/to/chainFile.crt" Redirect permanent / http://www.domain1.com/ </VirtualHost> <VirtualHost _default_:8443> ServerName www.domain2.com ServerAlias domain2.com SSLEngine on SSLCertificateFile "/path/to/file.crt" SSLCertificateKeyFile "/path/to/file.key" SSLCertificateChainFile "/path/to/chainFile.crt" Redirect permanent / http://www.domain2.com/ </VirtualHost> 

当我进入浏览器的url，如https://www.domain2.com/resource-under-sub.domain1.com ，它实际上去的pathhttps://sub.domain1.com/resource-under-sub.domain1.com而不是redirect到http://www.domain2.com 。 我的设置有什么问题？

对@Nic对SNI的回应：

我检查了我的Apache，并从https://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI它看起来SNI从日志消息启用： Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366) 。 我也使用Firefox 56，它应该支持https://www.kinamo.be/en/support/faq/which-browsers-support-server-name-indication-sni 。 但是，当我去第二个虚拟主机的url，它仍然带我到第一个默认的虚拟主机。

• 我可以在Nginx服务器模块中使用SSL证书和密钥文件中的variables吗？
• 让我们来encryptionapache上的SSL安装错误
• Httpd mod_rewriteconfiguration和虚拟主机交互
• 显示第一个虚拟服务器的网站
• 一个IP Apache2上的多个域和子域

这个https://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI和这个https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslprotocolbuild议Apache 2.4（我正在运行），那默认设置支持TLSv1和SNI。 在我的错误和ssl日志中，它不显示我的请求到第二个虚拟主机的任何logging，虽然它为其他主机，例如No matching SSL virtual host for servername other.domain1.com found (using default/first virtual host)并且这些使用SSLv3从消息OpenSSL: Loop: SSLv3 read client hello A看到OpenSSL: Loop: SSLv3 read client hello A 不过，我也可以从ssl请求日志中看到，TLSv1正在用于某些资源： TLSv1 AES128-SHA "GET /javax.faces.resource/theme.css.seam...

我需要在configurationSSLProtocol +TLSv1明确指定使用SSLProtocol +TLSv1吗？

谢谢

回复@ dave_thompson_085：

谢谢，我尝试了以下configuration，并清除了浏览器caching：

 NameVirtualHost _default_:8443 # Default virtual host and catch all <VirtualHost _default_:8443> ServerName www.domain1.com ServerAlias www.domain1.com SSLEngine on SSLProtocol all -SSLv3 SSLCertificateFile "/path/to/file.crt" SSLCertificateKeyFile "/path/to/file.key" SSLCertificateChainFile "/path/to/chainFile.crt" # I want to redirect the https to http Redirect permanent / http://www.domain1.com/ </VirtualHost> # This is the only virtual host name that should handle the ssl <VirtualHost _default_:8443> ServerName sub.domain1.com ServerAlias sub2.domain1.com SSLEngine on SSLCertificateFile "/path/to/file.crt" SSLCertificateKeyFile "/path/to/file.key" SSLCertificateChainFile "/path/to/chainFile.crt" # some other settings... </VirtualHost> <VirtualHost _default_:8443> ServerName www.domain2.com ServerAlias domain2.com SSLEngine on SSLCertificateFile "/path/to/file.crt" SSLCertificateKeyFile "/path/to/file.key" SSLCertificateChainFile "/path/to/chainFile.crt" # I want to redirect the https to http Redirect permanent / http://www.domain2.com/ </VirtualHost> # Other virtual hosts like www.domain2.com 

当我访问https://www.domain2.com ，这是我在error_log_ssl中得到的：

 [Mon Oct 16 08:10:07 2017] [debug] ssl_engine_io.c(1830): +------------------------------+ [Mon Oct 16 08:10:07 2017] [debug] ssl_engine_io.c(1869): | 0000: ... [Mon Oct 16 08:10:07 2017] [debug] ssl_engine_io.c(1869): | 0010: ... [Mon Oct 16 08:10:07 2017] [debug] ssl_engine_io.c(1869): | 0020: ... [Mon Oct 16 08:10:07 2017] [debug] ssl_engine_io.c(1869): | ... [Mon Oct 16 08:10:07 2017] [debug] ssl_engine_io.c(1869): | 0060: ... www.domain2.com | [Mon Oct 16 08:10:07 2017] [debug] ssl_engine_io.c(1869): | ... [Mon Oct 16 08:10:07 2017] [debug] ssl_engine_io.c(1875): +------------------------------+ [Mon Oct 16 08:10:07 2017] [debug] ssl_engine_kernel.c(1987): [client 207.46.13.160] SSL virtual host for servername www.domain2.com found **[Mon Oct 16 08:10:07 2017] [debug] ssl_engine_kernel.c(1274): [client 207.46.13.160] handing out temporary 1024 bit DH key **[Mon Oct 16 08:10:07 2017] [info] [client n1.n2.n3.n4] (70014)End of file found: SSL input filter read failed. [Mon Oct 16 08:10:07 2017] [info] [client n1.n2.n3.n4] Connection closed to child 199 with standard shutdown (server www.domain2.com:443) 

标有“**”的行仅有时会出现。 看起来像SSL命名的虚拟主机正在从SSL virtual host for servername www.domain2.com found 。 在浏览器中，它显示证书是不安全的，因为它不符合serverName，如果我不接受证书，那么它不会进一步，这是公平的。 但是如果我接受证书，它仍然会被redirect到真正处理SSL的站点sub.domain1.com 。 为什么不按照设置中的指定redirect到www.domain2.com ？

非常感谢你的帮助！