How to set SSL certificates dynamically based on request domain?

Viewed 373

I am trying to setup a dynamic apache virtual host configuration with SSL.

Consider i have 3 domains example1.com, example2.com and example3.com and their project folders resides in /var/www/html/.
eg.
example1.com - /var/www/html/example1/
example2.com - /var/www/html/example2/
example3.com - /var/www/html/example3/

I have configured apache to form self-referential URLs from domain setting UseCanonicalName to Off. Referred this doc here. My conf looks like this

UseCanonicalName Off
VirtualDocumentRoot /var/www/html/%1
<Directory /var/www/html>
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Order allow,deny
    allow from all
    Require all granted
</Directory>

It worked fine for HTTP requests.

Issue #1
I want to include SSL certificates dynamically but failed. I tried by adding

SSLEngine on
SSLCertificateFile /home/abc/certs/%1/domain.crt
SSLCertificateKeyFile /home/abc/certs/%1/domain.key
SSLCertificateChainFile /home/abc/certs/%1/domain.ca-bundle

It throwed

SSLCertificateFile: file '/home/abc/certs/%1/domain.crt' does not exist or is empty

How can i fix this? is there way to set ssl from DB?

Issue #2\

After using the above vhost configuration, apache fails to map the dedicated server name.

UseCanonicalName Off
VirtualDocumentRoot /var/www/html/%1
<Directory /var/www/html>
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Order allow,deny
    allow from all
    Require all granted
</Directory>
<VirtualHost *:80>
    ServerName dev.example.com
    DocumentRoot /var/www/html/devportal
    <Directory "/var/www/html/devportal">
        Options Indexes FollowSymLinks Multiviews
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

The above VirtualDocumentRoot overrides other virutalhost blocks. When I tried enclosing the VirtualDocumentRoot inside a VirtualHost block, dev.example.com works but other domains points to default apache html. I am not able to figureout what was my mistake here.

1 Answers
 SSLCertificateFile /home/abc/certs/%1/domain.crt

This can't be done. It needs to have a static path name since the certificates are loaded at startup, not on TLS handshake.

Related