HTTPS on domains without configured SSL gets directed to wrong website.

  • Changing the protocol to HTTPS on unconfigured domains for SSL will lead the server to serve the wrong website.


    If a website does not have SSL configured for it but still the user entered HTTPS the request will go to the first VirtualHost accepting requests at that port.

  • The problem is very simple... Use a website where ssl is not activated. Call the website with https and the apache will get the first site with the ip of the this website where the port 443 is activated. Then you will see an incorrect ssl cert.
    Your idea should be testet or let us test the idea of Cool

  • hello ;


    Something like this added in 00_master_ssl.conf works:


    Code
    1. <Location />
    2. RewriteEngine On
    3. RewriteCond %{HTTP_HOST} !^(www.)?wheezy.nuxwin.com
    4. RewriteRule (.*) http://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
    5. </Location>


    Here, I've hardcoded the host but of course, I'll replace it with placeholder. I don't see any other solution ;)

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    Edited once, last by Nuxwin ().


  • I think this is a good solution.
    Will you add this to the templates in the next time or is this only a solution for the exsiting problem?


    Well, I'll surely add this statement in template but still that I must do that for each IP which have SSL enabled.

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    Edited once, last by Nuxwin ().

  • Another solution:


    Code
    1. SSLRequire ( %{HTTP_HOST} =~ m/^(www.)wheezy.nuxwin.com/ )


    In such a case, you get access forbidden...

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

  • After a discussion with our team on IRC, the solution which will be implemented will be as follow:



    Code
    1. <Location />
    2. RewriteEngine On
    3. RewriteCond %{HTTP_HOST} !^(www.)?wheezy.nuxwin.com
    4. RewriteRule (.*) - [R=501,L]
    5. ErrorDocument 501 path to 501 error document
    6. </Location>


    The error document will show a specific message which will say: SSL NOT ENABLED

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    Edited once, last by Nuxwin ().

  • please note that this solution breaks openDKIM plugin (error 404)...


    SSLRequire ( %{HTTP_HOST} =~ m/^(www.)wheezy.nuxwin.com/ ) looks like the best workarround for the moment...


    best regards, julian