Number of https virtual hosts support under v2.0.59

Hi, all

How many https virtual hosts supported under Apache v2.0.59? I can't test w=
ith v2.2.14 since the bug I just filed.=20

On my Solaris 10, Apache 2.0.59 reverse proxy server, I have a https virtua=
l host defined with a real certificate from a CA and forward https traffic =
to a backend server (different server). I have multiple http reverse proxy =
servers defined but only one https reverse proxy server defined. The https =
session is redirected from http session and it works.

Now I'd like to add another test https reverse proxy server with a self sig=
ned certificate which the traffic will be redirected from internet client's=
http session and communicate with the backend server (different server) wi=
th http traffic. In my ssl.conf file, I basically did copy and paste the co=
nfiguration from the one that works, append the configuration at the bottom=
of the ssl.conf and made necessary changes. The configuration test passed =
fine.

When I started "apachectl startssl", it prompts me for the pass phrase with=
the self signed one and it never prompts for the real certificate's pass p=
hrase. I was expecting two pass phrase prompts, one for each https server.

I used Firefox to access self-signed site and it prompts that certificate d=
oes not match. The detail of the certificate shows the certificate used for=
the session is the real certificate not self-signed one. When I access the=
site that has real certificate and it works correct. The problem happens o=
n IE 6 also.=20

So I wonder whether Apache 2.0.59 supports more than one https reverse prox=
y setup? Thanks in advance.

Ryan



This message (including any attachments) is intended
solely for the specific individual(s) or entity(ies) named
above, and may contain legally privileged and
confidential information. If you are not the intended=20
recipient, please notify the sender immediately by=20
replying to this message and then delete it.
Any disclosure, copying, or distribution of this message,
or the taking of any action based on it, by other than the
intended recipient, is strictly prohibited.


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Number of https virtual hosts support under v2.0.59

On Fri, Feb 26, 2010 at 9:55 PM, Ruiyuan Jiang wrote:

> So I wonder whether Apache 2.0.59 supports more than one https reverse proxy setup? Thanks in advance.

You probably are trying to use name based https vertual posts. This
used to be impossible, not due to limitations in apache, but due to
limitations in the SSL protocol.

More background to this problem you can find here:
http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts

When I'm saying "it used to be impossible" I am indeed implaying that
nowadays this can be made to function, due an extension to the SSL
protocol, named SNI. This requires a bleeding edge apache and only
works with recent browsers though.

Krist

--
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: Number of https virtual hosts support underv2.0.59

Thanks for the response, Krist.=20
The version of openssl that I am using is good 0.98l. The problem is the Ap=
ache since I can't use 2.2.14 because the bug it has. See my another post a=
bout the page does not refresh automatically after user logs in. I guess I =
have to try to use work around.
By the way, you stated "only works with recent browsers though." What brows=
ers and versions work with that, Firefox or IE or both?

Ryan

-----Original Message-----
From: Krist van Besien [mailto:krist.vanbesien@gmail.com]=20
Sent: Monday, March 01, 2010 4:13 AM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Number of https virtual hosts support under v2.0=
..59

On Fri, Feb 26, 2010 at 9:55 PM, Ruiyuan Jiang wrot=
e:

> So I wonder whether Apache 2.0.59 supports more than one https reverse pr=
oxy setup? Thanks in advance.

You probably are trying to use name based https vertual posts. This
used to be impossible, not due to limitations in apache, but due to
limitations in the SSL protocol.

More background to this problem you can find here:
http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html#vhosts

When I'm saying "it used to be impossible" I am indeed implaying that
nowadays this can be made to function, due an extension to the SSL
protocol, named SNI. This requires a bleeding edge apache and only
works with recent browsers though.

Krist

--=20
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org




This message (including any attachments) is intended
solely for the specific individual(s) or entity(ies) named
above, and may contain legally privileged and
confidential information. If you are not the intended=20
recipient, please notify the sender immediately by=20
replying to this message and then delete it.
Any disclosure, copying, or distribution of this message,
or the taking of any action based on it, by other than the
intended recipient, is strictly prohibited.


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Number of https virtual hosts support under v2.0.59

On Mon, Mar 1, 2010 at 4:30 PM, Ruiyuan Jiang wrote=
:
> Thanks for the response, Krist.
> The version of openssl that I am using is good 0.98l. The problem is the =
Apache since I can't use 2.2.14 because the bug it has. See my another post=
about the page does not refresh automatically after user logs in. I guess =
I have to try to use work around.
> By the way, you stated "only works with recent browsers though." What bro=
wsers and versions work with that, Firefox or IE or both?
(from wikipedia)
Browsers

Browsers with support for TLS server name indication:

* Mozilla Firefox 2.0 or later
* Opera 8.0 or later (the TLS 1.1 protocol must be enabled)
* Internet Explorer 7 (Vista or higher, not XP) or later
* Google Chrome (Vista or higher, not XP)
* Safari Safari 3.2.1 and newer on Mac OS X 10.5.6 and Windows
Vista or higher, not XP


Krist

--=20
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

RE: Number of https virtual hosts support underv2.0.59

Hi, Krist

I tested with Apache 2.2.15 reverse proxy with two certs on the Apache, one=
is real cert and the other is self-signed. The configuration is virtualhos=
ts for ssl.=20
The results that I got are:

On PC client:

Firefox v3.5.8 showed correct certs, one real and the other is not.
IE 8 showed incorrect when I viewed the certs. The self-signed cert site us=
ed the real cert.

On MAC client:

Both Safari 4.0.4 and Firefox 3.5.2 showed correctly, one real and one self=
-signed cert.

My question is eventually both sites will have real certs when I am done te=
sting. Will IE 6 and above uses the correct certs or only uses one cert, ma=
y be the first virtual host listed in ssl configuration file of Apache?

Thanks.

Ryan


-----Original Message-----
From: Krist van Besien [mailto:krist.vanbesien@gmail.com]=20
Sent: Wednesday, March 03, 2010 5:36 AM
To: users@httpd.apache.org
Subject: Re: [users@httpd] Number of https virtual hosts support under v2.0=
..59

On Mon, Mar 1, 2010 at 4:30 PM, Ruiyuan Jiang wrote:
> Thanks for the response, Krist.
> The version of openssl that I am using is good 0.98l. The problem is the =
Apache since I can't use 2.2.14 because the bug it has. See my another post=
about the page does not refresh automatically after user logs in. I guess =
I have to try to use work around.
> By the way, you stated "only works with recent browsers though." What bro=
wsers and versions work with that, Firefox or IE or both?
(from wikipedia)
Browsers

Browsers with support for TLS server name indication:

* Mozilla Firefox 2.0 or later
* Opera 8.0 or later (the TLS 1.1 protocol must be enabled)
* Internet Explorer 7 (Vista or higher, not XP) or later
* Google Chrome (Vista or higher, not XP)
* Safari Safari 3.2.1 and newer on Mac OS X 10.5.6 and Windows
Vista or higher, not XP


Krist

--=20
krist.vanbesien@gmail.com
krist@vanbesien.org
Bremgarten b. Bern, Switzerland
--
A: It reverses the normal flow of conversation.
Q: What's wrong with top-posting?
A: Top-posting.
Q: What's the biggest scourge on plain text email discussions?

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org




This message (including any attachments) is intended
solely for the specific individual(s) or entity(ies) named
above, and may contain legally privileged and
confidential information. If you are not the intended=20
recipient, please notify the sender immediately by=20
replying to this message and then delete it.
Any disclosure, copying, or distribution of this message,
or the taking of any action based on it, by other than the
intended recipient, is strictly prohibited.


------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: Number of https virtual hosts support under v2.0.59

On 12 March 2010 16:43, Ruiyuan Jiang wrote:
> Hi, Krist
>
> I tested with Apache 2.2.15 reverse proxy with two certs on the Apache, one is real cert and the other is self-signed. The configuration is virtualhosts for ssl.
> The results that I got are:
>
> On PC client:
>
> Firefox v3.5.8 showed correct certs, one real and the other is not.
> IE 8 showed incorrect when I viewed the certs. The self-signed cert site used the real cert.
>
> On MAC client:
>
> Both Safari 4.0.4 and Firefox 3.5.2 showed correctly, one real and one self-signed cert.
>
> My question is eventually both sites will have real certs when I am done testing. Will IE 6 and above uses the correct certs or only uses one cert, may be the first virtual host listed in ssl configuration file of Apache?

Presuming you've configured SNI correctly, what operating system are
you using? Note that SNI only works with IE 7 and 8 only work when
running on Vista or higher, not with Windows XP. IE6 doesn't support
SNI at all and never will to my knowledge.

Are you putting this on a live site to be accessed by unknown users on
the internet? If so, basically, don't. Most users on the internet will
not be running an SNI-capable browser.

-- Phil.

------------------------------------------------------------ ---------
The official User-To-User support forum of the Apache HTTP Server Project.
See for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

connections monitor

--_000_BBD8B569345D4F3EA0F5CB3255B7C86Bmimectl_
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable

I am wondering if there is a way some of you are aware of to monitor concur=
rent connections to the Apache server, that does not include counting all t=
he IP's in the access log at one point in time?

Thanks,
Brent

--_000_BBD8B569345D4F3EA0F5CB3255B7C86Bmimectl_
Content-Type: text/html; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable