如何禁用对特定虚拟主机的https访问?


10

好了,因此我使用以下指令设置了Apache服务器:

NameVirtualHost *:80

<VirtualHost *:80>  
ServerName example1.com  
ServerAlias www.example1.com  
DocumentRoot /var/www/html
</VirtualHost>

<VirtualHost *:80>
ServerName example2.com
ServerAlias *.example2.com
DocumentRoot /var/www/example2
</VirtualHost>

<VirtualHost example1.com:443>
DocumentRoot /var/www/html
ServerName example1.com:443
SSLEngine on
...
</VirtualHosts>

因此example1.com具有SSL支持,可以通过http:// example1.com或https:// example1.com进行访问。但是,这有意外的副作用,当我在浏览器中访问https:// example2.com时显示https:// example1.com。我想做的基本上是某种程度上禁用https:// example2.com或将其重定向到http:// example2.com,这样当我访问它时,我不会得到警告和错误的站点。

Answers:


7

您将无法避免收到警告,除非example1和example2位于不同的IP地址上,或者您获得了包含两个名称的SSL证书-错误页面或重定向只有在建立SSL连接后才能发生。

话虽这么说,应该遵循以下原则:

NameVirtualHost *:443
<VirtualHost *:443>
  ServerName example1.com
  SSLEngine on
  #...
</VirtualHost>
<VirtualHost *:443>
  ServerName example2.com
  SSLEngine on
  # same certificate config here as on example1, unless you're wanting to use TLS SNI
  # then, let's redirect the user to non-SSL
  Redirect permanent / http://example2.com/
</VirtualHost>

谢谢!我认为我缺少NameVirtualHost指令,而Apache则想让两个虚拟主机相互冲突。有趣的是,Chrome并未针对此重定向发出警告...但是我对此并不担心,只是不希望我的SSL网站显示在其他域名下。
nearengine

与将无效的证书添加到回退到非SSL相同吗?我猜您可以将_fake直接附加到vhost指令上的证书名称上。
m3nda

0

我不认为您应该将:443放在ServerName example1.com:443上

这些应该正确配置

<VirtualHost example1.com:443> //change example1.com to ip address is a good habit
DocumentRoot /var/www/html
ServerName example1.com
SSLEngine on
...
</VirtualHosts>

By using our site, you acknowledge that you have read and understand our Cookie Policy and Privacy Policy.
Licensed under cc by-sa 3.0 with attribution required.