我们有两个域(gis4business.co.uk 和 gis4business.com)指向使用 apache 托管的同一个网站。我们为整个站点使用 SSL,并为 *.gis4business.co.uk 提供通配符 SSL 证书。
默认的 apache conf 文件 (000-default.conf) 有一个配置为从 http 重定向到 https 的虚拟主机,如下所示:
<VirtualHost *:80>
...
Redirect permanent "/" "https://www.gis4business.co.uk/"
</VirtualHost>
然后我们有一个默认的 SSL 配置文件 (default-ssl.conf),其中配置了一个虚拟主机,如下所示:
<VirtualHost _default_:443>
ServerName gis4business.co.uk
ServerAlias *.gis4business.co.uk www.gis4business.co.uk *gis4business.com www.gis4business.com gis4business.com
...
SSLEngine on
SSLCertificateFile /etc/ssl/certs/certificate.crt
SSLCertificateKeyFile /etc/ssl/private/privatekey.key
SSLCertificateChainFile /etc/ssl/certs/ca_certificate.crt
</VirtualHost>
对于以下 url,此配置按预期工作:
但是,url https://www.gis4business.com导致证书警告(Firefox 中的 SSL_ERROR_BAD_CERT_DOMAIN 和 Chrome 中的 ERR_CERT_COMMON_NAME_INVALID)。
它显然提示 SSL 证书与域 (gis4business.com) 不匹配,所以我假设我们需要一个从 gis4business.com 到 gis4business.co.uk 的 HTTPS 重定向。我们尝试了各种配置,但未能成功实现重定向。
我们已经尝试过:
1) 在 000-default.conf 文件的顶部添加另一个虚拟主机 (*:443),如下所示:
<VirtualHost *:443>
ServerName gis4business.co.uk
ServerAlias *.gis4business.co.uk www.gis4business.co.uk *gis4business.com www.gis4business.com gis4business.com
Redirect permanent "/" "https://www.gis4business.co.uk/"
...
SSLEngine on
SSLCertificateFile /etc/ssl/certs/certificate.crt
SSLCertificateKeyFile /etc/ssl/private/privatekey.key
SSLCertificateChainFile /etc/ssl/certs/ca_certificate.crt
</VirtualHost>
2) 将另一个虚拟主机 (default:443) 添加到 default-ssl.conf 文件的顶部,如下所示:
<VirtualHost _default_:443>
ServerName gis4business.co.uk
ServerAlias *.gis4business.co.uk www.gis4business.co.uk *gis4business.com www.gis4business.com gis4business.com
Redirect permanent "/" "https://www.gis4business.co.uk/"
...
SSLEngine on
SSLCertificateFile /etc/ssl/certs/certificate.crt
SSLCertificateKeyFile /etc/ssl/private/privatekey.key
SSLCertificateChainFile /etc/ssl/certs/ca_certificate.crt
</VirtualHost>
如果可以在没有证书错误的情况下将 https 从一个域重定向到另一个域,那么使其工作的正确配置是什么?
最佳答案
让我们看看 redirect指令工作
The Redirect directive maps an old URL into a new one by asking the client to refetch the resource at the new location.
第一个请求由 apache 处理生成一个 30x
自动重定向浏览器到新 URL 的响应
browser SERVER SSL cert
https://www.gis4business.com --> redirect *.gis4business.co.uk
302-redirect <--
https://www.gis4business.co.uk/ --> process *.gis4business.co.uk
第一个请求是从 https://www.gis4business.com
使用颁发给 *.gis4business.co.uk
的证书提供的,因此它被认为是无效的因此
要修复它,您需要使用颁发给 www.gis4business.com
或 *.gis4business.com
的证书。定义一个新的虚拟主机或请求一个包含两个主机名的新证书。
关于Apache HTTPS 重定向证书错误,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/48382040/