SNI取错证书

Question

我得到了下面的设置

Listen 443
NameVirtualHost *:443
    <virtualhost *:443>
    Servername  1.domain.com
    DocumentRoot /1
    SSLEngine on
    SSLVerifyClient none
    SSLCertificateFile /etc/apache/1.cer
    SSLCertificateKeyFile /etc/apache/1.key
    SSLCertificateChainFile /etc/apache/1.crt
    </virtualhost>

    <virtualhost *:443>
    Servername  2.domain.com
    DocumentRoot /2
    SSLEngine on
    SSLVerifyClient none
    SSLCertificateFile /etc/apache/2.cer
    SSLCertificateKeyFile /etc/apache/2.key
    SSLCertificateChainFile /etc/apache/2.crt
    </virtualhost>

由于某种原因，SNI在网站2上从1.domain.com获取证书，导致一个不安全的连接警告页面。有人知道为什么吗？我正在使用Apache/2.2.15 (Unix)和OpenSSL 1.0.1e-fips

Answer 1

为了让它正常工作，显然apache要求namevirtualhost位于/etc/httpd/con.d/ssl.conf文件中，而不是httpd.conf文件中。