Apache 上特定 URL 的 SSL 证书答案

【问题标题】：SSL Certificate at a specific URL on ApacheApache 上特定 URL 的 SSL 证书
【发布时间】：2017-07-31 18:44:27
【问题描述】：

是否可以为域内的特定 URL 配置 SSL 证书密钥文件（双向）？

是的，使用mod_rewrite。但我确实需要保留所请求的域和 URL。

当前domain.com.conf 配置：

<VirtualHost domain.com:443>
    ServerAdmin name@domain.com
    SSLEngine on
    SSLCertificateFile    /usr/local/apache2/conf/server.cer
    SSLCertificateKeyFile /usr/local/apache2/conf/server.key

    SSLVerifyClient require
    SSLVerifyDepth 10
    SSLCACertificateFile /usr/local/apache2/conf/ca.cer

    <location />
        Order allow,deny
        allow from all
        SSLRequire (%{SSL_CLIENT_S_DN_CN} eq "clientcn")
    </location>

    DocumentRoot /usr/local/apache2/htdocs/
    <Directory "/usr/local/apache2/htdocs">
        Options FollowSymLinks
        AllowOverride None
        allow from all
    </Directory>

    LogLevel warn
    ErrorLog /usr/local/apache2/conf/logs/error.log
    CustomLog /usr/local/apache2/conf/logs/ssl_access.log combined

    BrowserMatch ".*MSIE.*"\
    nokeepalive ssl-unclean-shutdown \
    downgrade-1.0 force-response-1.0
</VirtualHost>

【问题讨论】：

证书对域上的所有url都有效
这就是问题所在。是否可以为一组 URL 禁用它并为另一组禁用它？

标签： apache ssl ssl-certificate

【解决方案1】：

没有this is not possible。

在任何路由/端点调度发生之前，SSL 握手发生在服务器级别。在成功的 TLS 协商之前，甚至不会考虑 HTTP 标头中的完整 URL。

例如，在此 URL 上使用 curl 以查看它首先连接到主机，然后当且仅当形成可信连接时，它才会传递 URI 主干。

curl -vI https://stackoverflow.com/questions/42718090/ssl-certificate-at-a-specific-url-on-apache

*   Trying 151.101.193.69...
* Connected to stackoverflow.com (151.101.193.69) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 714 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
*      server certificate verification OK
*      server certificate status verification SKIPPED
*      common name: *.stackexchange.com (matched)
*      server certificate expiration date OK
*      server certificate activation date OK
*      certificate public key: RSA
*      certificate version: #3
*      subject: C=US,ST=NY,L=New York,O=Stack Exchange\, Inc.,CN=*.stackexchange.com
*      start date: Sat, 21 May 2016 00:00:00 GMT
*      expire date: Wed, 14 Aug 2019 12:00:00 GMT
*      issuer: C=US,O=DigiCert Inc,OU=www.digicert.com,CN=DigiCert SHA2 High Assurance Server CA
*      compression: NULL
* ALPN, server accepted to use http/1.1
> HEAD /questions/42718090/ssl-certificate-at-a-specific-url-on-apache HTTP/1.1
> Host: stackoverflow.com
> User-Agent: curl/7.47.0
> Accept: */*

【讨论】：