Apache 2.2: Reject https for http-only sites on server w/ 1 https site?

[David]

Hi,

I have a handful of sites (name virtual hosts) being served on the same
physical server (and IP address), using Apache 2.2.15. One of the sites also
has an https version (in fact, the http version of that site redirects
straight to the https version), but the other sites are http-only.

Unfortunately, if somebody inadvertently attempts to access any of the other
http-only sites using https, then the server will attempt to serve the
corresponding URI on the (sole) https site instead (and causing web browsers
to disable a security certificate warning page, for obvious reasons).

I have a feeling that I may be rather stuck in the catch-22 situation that the
server does not know which https site has actually been requested until it has
started to negotiate the secure connection, and therefore is returning the
certificate (and content) for the default https site regardless?

Is there any way that I can prevent https content from being (attempted to be)
served for the non-https sites?

Would Server Name Indication (SNI) (and 'empty' https sites for the http-only
sites, or something in the config for these virtual hosts to 'unlisten' on the
https port?)) help at all? Our Apache supports SNI, but there is still the
risk that a reasonable proportion of client browsers and OSes may not,
unfortunately.

Would I be able to set up SNI so that the single required https site can still
be served properly to non-SNI-aware clients? It's essential that the https
site works for as wide a range of users as possible (yes, another grumble at
old versions of IE and Windows..).

The webserver also serves another http *and* https site, but these are on a
different IP address, so I assume that is not particularly relevant to this
current problem.

Thanks for any advice,


David.

[Eli the Bearded]

In comp.infosystems.www.servers.unix,

Post by David
I have a feeling that I may be rather stuck in the catch-22 situation that
the server does not know which https site has actually been requested until
it has started to negotiate the secure connection, and therefore is
returning the certificate (and content) for the default https site
regardless?

Exactly. Whenever possible, use separate IP addresses for each HTTPS site
to avoid this possibility.

Post by David
Is there any way that I can prevent https content from being (attempted to
be) served for the non-https sites?

No.

Post by David
Would Server Name Indication (SNI) (and 'empty' https sites for the
http-only sites, or something in the config for these virtual hosts to
'unlisten' on the https port?)) help at all? Our Apache supports SNI, but
there is still the risk that a reasonable proportion of client browsers and
OSes may not, unfortunately.

SNI would help, probably help a lot, but it won't be perfect. I'd guess more
than 50% of the time, but less than 95%, of clients would benefit.

Elijah
------
has, so far, been able to use separate IP addresses for all his https needs

[David]

Post by Eli the Bearded
In comp.infosystems.www.servers.unix,

Post by David
I have a feeling that I may be rather stuck in the catch-22 situation that
the server does not know which https site has actually been requested until
it has started to negotiate the secure connection, and therefore is
returning the certificate (and content) for the default https site
regardless?

Exactly. Whenever possible, use separate IP addresses for each HTTPS site
to avoid this possibility.

Post by David
Is there any way that I can prevent https content from being (attempted to
be) served for the non-https sites?

No.

Sorry for the belated reply:

Thanks, that's what I'd feared..

OK, we'll need to dig up a spare IP address for the https site, I guess.


[...]

Post by Eli the Bearded
SNI would help, probably help a lot, but it won't be perfect. I'd guess more
than 50% of the time, but less than 95%, of clients would benefit.

I'll hold off on SNI until Windows XP has gone away, or usage has at least
dropped to negligible levels..


Thanks,

David.

[Paul Rubin]

Post by David
Would I be able to set up SNI so that the single required https site
can still be served properly to non-SNI-aware clients?

I think this should work, but I haven't tried it.

Post by David
Thanks for any advice,

If it's that important to you to support old browsers and OS's, you can
probably afford another IP address for the purpose.

You can also get multi-domain certificates though it's possible that
really ancient browsers have problems with those.