Tomcat 6 always uses default host in multi-host config

[Jeff Wild]

I have two IP-based virtual hosts configured in a standalone Tomcat server. Each host has its own SSL certificate and keystore. Tomcat appears to behave as if only the default host is defined. When I hit seconddomain.com, Tomcat serves the ROOT app for firstdomain.com and writes to firstdomain.com access log. When I try https://seconddomain.com, the domain is untrusted, which I suspect is because Tomcat is using the cert for firstdomain.

If I change the defaultHost value to seconddomain.com, the behavior flips and Tomcat serves the ROOT app for seconddomain.com when I try http://firstdomain.com.

AFAIK, the server.xml configuration below should work. Any clues as to what is wrong?

TIA

* Tomcat 6.0.26 (stand alone -- no Apache)
* Red Hat Enterprise 5 (Linux 2.6.18-164.15.1.el5 on x86_64)
* IP-based virtual hosting
* Tomcat running as daemon via JSVC
* server.xml:

<Engine name="Catalina" defaultHost="firstdomain.com" >

   <Connector port="80" protocol="HTTP/1.1"
         connectionTimeout="20000"
         redirectPort="443"
         useIPVHosts="true" />
		 
   <Connector address="1.2.3.4" port="443"
         protocol="org.apache.coyote.http11.Http11Protocol"
         SSLEnabled="true"
         maxThreads="150" scheme="https" secure="true"
         clientAuth="false" sslProtocol="TLS"
         keystoreFile="/usr/share/tomcat/.keystore"
         keystorePass="changeit" />

   <Connector address="5.6.7.8" port="443"
         protocol="org.apache.coyote.http11.Http11Protocol"
         SSLEnabled="true"
         maxThreads="150" scheme="https" secure="true"
         clientAuth="false" sslProtocol="TLS"
         keystoreFile="/usr/share/tomcat/.keystore2"
         keystorePass="changeit" />

   <Host name="firstdomain.com"
         appBase="/home/websites/firstdomain.com/webapps"
         unpackWARs="true"
         autoDeploy="true">
      <Valve className="org.apache.catalina.valves.AccessLogValve"
            directory="/home/websites/firstdomain.com/logs"
            prefix="firstdomain.com_access."
            suffix=".log"
            pattern="common"
            resolveHosts="false"/>
   </Host>

   <Host name="seconddomain.com"
         appBase="/home/websites/seconddomain.com/webapps"
         unpackWARs="true"
         autoDeploy="true">
      <Valve className="org.apache.catalina.valves.AccessLogValve"
            directory="/home/websites/seconddomain.com/logs"
            prefix="seconddomain.com_access."
            suffix=".log"
            pattern="common"
            resolveHosts="false" />
   </Host>

[Tim Holloway]

There is a fundamental limitation of one cert per IP address, I believe. It's not even a Tomcat limitation, just a limitation on how certs work.

And it's a real pain.

[Jeff Wild]

The solution is to add an Alias element to the Host element:

<Host ...>
...
<Alias>1.2.3.4</Alias>
...
</Host>

where 1.2.3.4 is the private IP address specified in the corresponding Connector