443端口根域名重定向至虚拟主机异常问题求助

云上老周

2026-7-5

Apache虚拟主机SSL配置问题修复方案

问题现象

使用Cloudflare SSL的domain1正常：domain1.com可永久重定向到www.domain1.com
配置独立SSL的domain2/3/4出现异常：
- 访问domain2.com不执行跳转，直接显示自身站点内容
- 访问domain3.com时显示domain2.com的内容，但www.domain3.com访问正常
- domain4.com的问题表现和domain3.com完全一致
额外测试发现：
- 移除所有443端口虚拟主机配置后，所有域名恢复正常
- 单独移除某域名的80端口重定向规则或虚拟主机，其根域名仍显示domain2.com的内容
- 移除domain2.com的虚拟主机配置后，根域名会显示其他443端口虚拟主机的内容
- 仅保留一个SSL虚拟主机时，访问根域名会出现“服务不可用”错误

当前配置代码

# Virtual Hosts
#
<VirtualHost *:80>
  ServerName localhost
  ServerAlias localhost
  DocumentRoot "${INSTALL_DIR}/www"
  <Directory "${INSTALL_DIR}/www/">
    Options +Indexes +Includes +FollowSymLinks +MultiViews
    AllowOverride All
    Require local
  </Directory>
</VirtualHost>
#
<VirtualHost *:80>
    ServerName www.domain1.com
    DocumentRoot "c:/wamp64/www/domain1"
    <Directory  "c:/wamp64/www/domain1/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
<VirtualHost *:80>
        ServerName domain1.com
        Redirect permanent / http://www.domain1.com/
</VirtualHost>
#
<VirtualHost *:443>
    ServerName www.domain2.com
    DocumentRoot "c:/wamp64/www/domain2"
    <Directory  "c:/wamp64/www/domain2/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain2.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain2.com\privkey.pem"
</VirtualHost>
<VirtualHost *:80>
        ServerName domain2.com
        Redirect permanent / http://www.domain2.com/
</VirtualHost>
<VirtualHost *:80>
    ServerName www.domain2.com
    DocumentRoot "c:/wamp64/www/domain2"
    <Directory  "c:/wamp64/www/domain2/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
#
<VirtualHost *:443>
    ServerName www.domain3.com
    DocumentRoot "c:/wamp64/www/domain3"
    <Directory "c:/wamp64/www/domain3/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain3.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain3.com\privkey.pem"
</VirtualHost>
<VirtualHost *:80>
        ServerName domain3.com
        Redirect permanent / http://www.domain3.com/
</VirtualHost>
<VirtualHost *:80>
    ServerName www.domain3.com
    DocumentRoot "c:/wamp64/www/domain3"
    <Directory "c:/wamp64/www/domain3/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>
#
<VirtualHost *:443>
    ServerName www.domain4.com
    DocumentRoot "c:/wamp64/www/domain4"
    <Directory  "c:/wamp64/www/domain4/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain4.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain4.com\privkey.pem"
</VirtualHost>
<VirtualHost *:80>
        ServerName domain4.com
        Redirect permanent / http://www.domain4.com/
</VirtualHost>
<VirtualHost *:80>
    ServerName www.domain4.com
    DocumentRoot "c:/wamp64/www/domain4"
    <Directory  "c:/wamp64/www/domain4/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

问题根源

缺少根域名的HTTPS虚拟主机配置：仅配置了www.domain2/3/4.com的443端口虚拟主机，但domain2/3/4.com的HTTPS请求没有对应配置，Apache会默认匹配第一个443端口的虚拟主机（也就是domain2的），导致其他根域名的HTTPS请求被解析到错误站点。
重定向规则未覆盖HTTPS场景：当前仅在80端口配置了根域名到www的重定向，但用户访问时可能直接使用HTTPS（比如浏览器自动跳转），此时80端口的规则不生效，导致domain2.com直接显示内容。
SNI支持缺失（可能）：若Apache版本较旧未启用SNI，多SSL证书环境下会默认使用第一个加载的证书，引发域名匹配错误。

修复步骤

1. 为每个根域名添加443端口虚拟主机配置

针对domain2.com、domain3.com、domain4.com分别配置HTTPS虚拟主机，设置重定向到对应的www子域名，同时确保SSL证书覆盖根域名（如果当前证书是单域名证书，需要重新申请包含根域名和www的SAN证书）。

示例（以domain2.com为例）：

<VirtualHost *:443>
    ServerName domain2.com
    # 永久重定向到HTTPS的www域名
    Redirect permanent / https://www.domain2.com/
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain2.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain2.com\privkey.pem"
</VirtualHost>

2. 统一80端口重定向到HTTPS

将所有80端口的域名（包括www和根域名）都重定向到对应HTTPS地址，避免HTTP/HTTPS混淆，同时提升安全性。

示例（修改domain1的配置）：

<VirtualHost *:80>
    ServerName www.domain1.com
    Redirect permanent / https://www.domain1.com/
</VirtualHost>
<VirtualHost *:80>
    ServerName domain1.com
    Redirect permanent / https://www.domain1.com/
</VirtualHost>

3. 确认Apache启用SNI支持

执行httpd -M命令查看是否加载了ssl_module，Apache 2.2.12及以上版本默认启用SNI，确保模块已加载即可。

4. 调整虚拟主机顺序

将localhost的配置放在最顶部，然后按域名顺序排列所有虚拟主机，确保每个域名的80和443配置一一对应，避免Apache匹配到错误的虚拟主机。

完整修复后配置片段

# Virtual Hosts
#
<VirtualHost *:80>
  ServerName localhost
  ServerAlias localhost
  DocumentRoot "${INSTALL_DIR}/www"
  <Directory "${INSTALL_DIR}/www/">
    Options +Indexes +Includes +FollowSymLinks +MultiViews
    AllowOverride All
    Require local
  </Directory>
</VirtualHost>
#
# domain1 配置（Cloudflare SSL）
<VirtualHost *:80>
    ServerName www.domain1.com
    Redirect permanent / https://www.domain1.com/
</VirtualHost>
<VirtualHost *:80>
    ServerName domain1.com
    Redirect permanent / https://www.domain1.com/
</VirtualHost>
#
# domain2 配置
<VirtualHost *:80>
    ServerName www.domain2.com
    Redirect permanent / https://www.domain2.com/
</VirtualHost>
<VirtualHost *:80>
    ServerName domain2.com
    Redirect permanent / https://www.domain2.com/
</VirtualHost>
<VirtualHost *:443>
    ServerName www.domain2.com
    DocumentRoot "c:/wamp64/www/domain2"
    <Directory  "c:/wamp64/www/domain2/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain2.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain2.com\privkey.pem"
</VirtualHost>
<VirtualHost *:443>
    ServerName domain2.com
    Redirect permanent / https://www.domain2.com/
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain2.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain2.com\privkey.pem"
</VirtualHost>
#
# domain3 配置
<VirtualHost *:80>
    ServerName www.domain3.com
    Redirect permanent / https://www.domain3.com/
</VirtualHost>
<VirtualHost *:80>
    ServerName domain3.com
    Redirect permanent / https://www.domain3.com/
</VirtualHost>
<VirtualHost *:443>
    ServerName www.domain3.com
    DocumentRoot "c:/wamp64/www/domain3"
    <Directory "c:/wamp64/www/domain3/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain3.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain3.com\privkey.pem"
</VirtualHost>
<VirtualHost *:443>
    ServerName domain3.com
    Redirect permanent / https://www.domain3.com/
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain3.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain3.com\privkey.pem"
</VirtualHost>
#
# domain4 配置
<VirtualHost *:80>
    ServerName www.domain4.com
    Redirect permanent / https://www.domain4.com/
</VirtualHost>
<VirtualHost *:80>
    ServerName domain4.com
    Redirect permanent / https://www.domain4.com/
</VirtualHost>
<VirtualHost *:443>
    ServerName www.domain4.com
    DocumentRoot "c:/wamp64/www/domain4"
    <Directory  "c:/wamp64/www/domain4/">
        Options +Indexes +Includes +FollowSymLinks +MultiViews
        AllowOverride All
        Require all granted
    </Directory>
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain4.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain4.com\privkey.pem"
</VirtualHost>
<VirtualHost *:443>
    ServerName domain4.com
    Redirect permanent / https://www.domain4.com/
    SSLEngine on
    SSLCertificateFile "C:\Certbot\live\www.domain4.com\fullchain.pem"
    SSLCertificateKeyFile "C:\Certbot\live\www.domain4.com\privkey.pem"
</VirtualHost>

验证方法

执行httpd -t检查配置文件语法，确保无错误。
重启Apache服务。
清除浏览器缓存后测试：
- 访问domain2.com，应自动跳转到https://www.domain2.com
- 访问domain3.com，应自动跳转到https://www.domain3.com且显示正确内容
- 所有www子域名的HTTPS地址访问正常，证书无错误

内容的提问来源于stack exchange，提问作者laurens holthof

443端口根域名重定向至虚拟主机异常问题求助

问题现象 #

当前配置代码 #

问题根源 #

修复步骤 #

1. 为每个根域名添加443端口虚拟主机配置 #

2. 统一80端口重定向到HTTPS #

3. 确认Apache启用SNI支持 #

4. 调整虚拟主机顺序 #

完整修复后配置片段 #

验证方法 #