Setting up subdomain to respond on :443 with apache2
- by compucuke
I read through some guides on this and I believe it is possible to have apache respond to a subdomain through ssl. I have domain.com responding on 80 and I do not need domain.com responding on 443. Rather, the only use I have for ssl is for the subdomain sub.domain.com.
So my site should be
http://domain.com
http://www.domain.com
https://sub.domain.com
https://www.sub.domain.com
My CNAME records are as follows
sub.domain.com xxx.xx.xx.xxx
*.sub.domain.com xxx.xx.xx.xxx
The A record exists but should not matter for the example.
I set up a separate config file in sites-enabled for sub.domain.com
NameVirtualHost xxx.xx.xx.xxx:443
<VirtualHost xxx.xx.xx.xxx:443>
SSLEngine on
SSLStrictSNIVHostCheck on
SSLProtocol -ALL +SSLv3 +TLSv1
SSLCipherSuite ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:-MEDIUM
ServerAlias sub.domain.com
DocumentRoot /usr/local/www/ssl/documents/
SSLCertificateFile /root/sub.domain.com.crt
SSLCertificateKeyFile /root/sub.domain.com.key
Alias /robots.txt /usr/local/www/ssl/documents/robots.txt
Alias /favicon.ico /usr/local/www/ssl/documents/favicon.ico
Alias /js/libs /usr/local/www/ssl/documents/js/libs
Alias /media/ /usr/local/www/documents/media/
Alias /img/ /usr/local/www/ssl/documents/img/
Alias /css/ /usr/local/www/ssl/documents/css/
<Directory /usr/local/www/ssl/documents/>
Order allow,deny
Allow from all
</Directory>
WSGIDaemonProcess sub.domain.com processes=2 threads=7 display-name=%{GROUP}
WSGIProcessGroup sub.domain.com
WSGIScriptAlias / /usr/local/www/wsgi-scripts/script.wsgi
<Directory /usr/local/www/wsgi-scripts>
Order allow,deny
Allow from all
</Directory>
</VirtualHost>
Now, it is important to mention that https://domain.com responds with what I have running from script.wsgi above instead of on https://sub.domain.com. It does not respond to sub.domain.com. checking https://sub.domain.com causes a 105 error. This is a DNS error but I am convinced the DNS does not have a problem with the CNAME records, they just point to my IP. Am I doing something that Apache can not do?
