Keep Server Online
If you find the Apache Lounge, the downloads and overall help useful, please express your satisfaction with a donation.
or
A donation makes a contribution towards the costs, the time and effort that's going in this site and building.
Thank You! Steffen
Your donations will help to keep this site alive and well, and continuing building binaries. Apache Lounge is not sponsored.
| |
|
 Topic: Blocking invalid subdomains before SSL certificate is served |
|
| Author |
|
skynet
Joined: 31 Oct 2023
Posts: 3
|
 Posted: Tue 31 Oct '23 14:40 Post subject: Blocking invalid subdomains before SSL certificate is served |
 |
|
Hi,
My Apache server config is as below.
Version: Apache/2.4.52
OS: Ubuntu (22.04)
I have many number of virtual hosts that are created and deleted automatically through a script with SSL certificates from lets-encrypt, I have a requirement where if invalid subdomains when requested should be blocked immediately terminating tcp connection and without serving default SSL certificate(main domain's SSL), is there any simple way to achieve this?.
I don't/cant have wildcard certificate for main domain for some reasons. |
|
| Back to top |
|
skynet
Joined: 31 Oct 2023
Posts: 3
|
| Posted: Thu 02 Nov '23 9:05 Post subject: No solutions? bump? |
|
|
Hi,
Can anyone help on this?. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7298
Location: Germany, Next to Hamburg
|
| Posted: Thu 02 Nov '23 10:31 Post subject: |
|
|
Hello,
there is no way of blocking that. First, there is the TCP connection, then the SSL Handshake and the client sends the requested name. See RFC 3546 Section 2.3
Without SNI you need a single IP address for each vhost.
[1] https://datatracker.ietf.org/doc/html/rfc3546#section-2.3 |
|
| Back to top |
|
skynet
Joined: 31 Oct 2023
Posts: 3
|
| Posted: Thu 02 Nov '23 11:44 Post subject: Alternate options for blocking |
|
|
Hi,
Thanks for the reply, any alternate simple solution, like WAF can block these?.
I am using pfsense firewall infront and using port forwarding to 80 and 443 to apache. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7298
Location: Germany, Next to Hamburg
|
|
| Back to top |
|
|
|
|
|
|
