Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 2 down vote favorite

Hello IT Security!

I have Apache2 vhost with HTTPS listening on port 443, ie. https:// securesecret.com.
I have another vhosts with HTTP listening on port 80, ie. http:// one.com, http:// two.com.

When I visited website http:// securesecret.com:443 I got this message:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>400 Bad Request</title>
</head><body>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
Reason: You're speaking plain HTTP to an SSL-enabled server port.<br />
Instead use the HTTPS scheme to access this URL, please.<br />
<blockquote>Hint: <a href="https://securesecret.com/"><b>https://securesecret.com/</b></a></blockquote></p>
</body></html>

There is information about domain. How can I prevent to show it?
Where is appropriate configuration in apache?
I have disabled ServerToken, ServerSignature etc.

share|improve this question
I noticed that information about described error (securesecret.com) are retrieved from first (default) vhost configuration listening on that (443) port. I can add fake vhost to obscure these information but I think this is very inelegant. – vizzdoom Nov 21 '11 at 22:54

3 Answers

up vote 11 down vote

You cannot really hide the domain name, because if someone connects to the port 443 of your server and begins initiating a SSL connection, your server will respond by sending his certificate... which contains the server name.

Actually, the client may send the intended client name as part of a Server Name Indication, which is a rather recent extension which is not supported everywhere (Internet Explorer on Windows XP will not send it, it requires IE 8 and Vista or later). The server may theoretically wait for an explicit SNI before sending his certificate; however, both the SNI and the certificate will travel unencrypted at this point, so the server name cannot be considered as really secret. And you cannot realistically mandate a SNI from clients right now (maybe in five years, when the current crop of WinXP has mostly died out...).

Also, the server name is part of the data which the DNS sends to whoever asks, on a regular basis, and without any encryption. A server name is definitely not a secret.

share|improve this answer
Thanks for professional help. I know that domain name is not a secret, but it can be part of (ugly ;) ) security through obscurity. I only do not want that user of one domain get information about another domain hosted in the same IP address (reverse IP scanners etc.) – vizzdoom Nov 21 '11 at 22:47
up vote 5 down vote

The message you are seeing is from the default apache "400 error page". You can override the 400 error page via:

ErrorDocument 400 /error-docs/400.shtml

in the appropriate location in your config file. Replace the default text with a generic message that doesn't include the host name.

share|improve this answer
1  
Even if I get a proper 400 doc, I'll still get a cert that is signed for securesecret.com. – StrangeWill Nov 23 '11 at 21:00
1  
@StrangeWill: While I agree with the principle of what you're saying ("there's no way to keep the server name a secret"), the OP is doing an http request to port 443. The server won't send back a cert, just an error page. Try doing echo 'GET / HTTP/1.0' | nc -q 10 secure.example.com 443. – bstpierre Nov 23 '11 at 21:58
Ah good catch, yeah, no cert for you in that case. – StrangeWill Nov 24 '11 at 2:18
up vote 1 down vote

Complete Answer:

While the other two answers are good, this is the way you can actually solve the problem.

To get around the problems of dual homing identified by @bstpierre and @Thomas Pornin you can use an extra IP address and separate Apache configs.

You can launch a separate Apache instance on the secure IP address to host the securesecret domain (both http and https) and the one and two domains will operate on the other Apache instance and IP addresses just using http.

Of course, you might have difficulty getting the new IP address from your provider and routing and configuring your server, but you need to determine the cost/benefit for yourself.

The Apache config docs have a lot of information on the scenarios and options.

Alternative:

  • You could choose to serve the securesecret content from the other content by hosting it on a different Apache instance and a different port than usual. i.e. https://securesecret.com:444/.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.