How to make Apache NOT confuse virtualhosts?

Question

Apache HTTP Server

I'm trying to get some sites to work with SSL, and some not.
Faced a problem: Apache confuses the certificate files of the first and second site.
It is CERTIFICATES, not DocumentRoot.

Не удалось подтвердить, что это сервер site2.site. Его сертификат безопасности относится к site1.site. Возможно, сервер настроен неправильно или кто-то пытается перехватить ваши данные.

When you go to the site .. everything works as it should. Except for the error warning.
The first site has no such problem.
It was not me who configured the sites, but the control panel (in it, by the way, ssl also works fine).
Control panel - Webmin, code generated by it (as I think - correct):

<VirtualHost site2.site>
    DocumentRoot /var/www/mrcheatga/site2.site
    <Directory "/var/www/mrcheatga/site2.site">
        allow from all
        Options None
        Require all granted
    </Directory>
    SSLEngine on
    SSLProtocol +TLSv1 +TLSv1.1 +TLSv1.2
    SSLCertificateFile /etc/letsencrypt/live/site2.site/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/site2.site/privkey.pem
</VirtualHost>

<VirtualHost site1.site>
    DocumentRoot /var/www/site1.site
    <Directory "/var/www/site1.site">
        allow from all
        Options None
        Require all granted
    </Directory>
    SSLEngine on
    SSLProtocol +TLSv1 +TLSv1.1 +TLSv1.2
    SSLCertificateFile /etc/letsencrypt/live/site1.site/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/site1.site/privkey.pem
</VirtualHost>

I will add that in other cases (* address + servername, __default address + servername, etc.) I got negative results, or just ERR_SSL_PROTOCOL_ERROR with zero errors in the logs.

I don't know anything about Apache. Help.

Answer 1

you
<VirtualHost site2.site>
should have in your config something like

<VirtualHost *:80>
    DocumentRoot /var/www/mrcheatga/site2.site
    <Directory "/var/www/mrcheatga/site2.site">
        allow from all
        Options None
        Require all granted
    </Directory>
RewriteEngine on
RewriteCond %{SERVER_NAME} =site2.site
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443>
DocumentRoot /var/www/mrcheatga/site2.site
    <Directory "/var/www/mrcheatga/site2.site">
        allow from all
        Options None
        Require all granted
    </Directory>
    SSLEngine on
    SSLProtocol +TLSv1 +TLSv1.1 +TLSv1.2
    SSLCertificateFile /etc/letsencrypt/live/site2.site/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/site2.site/privkey.pem
</VirtualHost>

In general, certbot itself changes the config in the right way, why else should some web panels be allowed to change?