diff --git a/install/share/ipa-vhost.conf.template b/install/share/ipa-vhost.conf.template
new file mode 100644
index 000000000..5a649f125
--- /dev/null
+++ b/install/share/ipa-vhost.conf.template
@@ -0,0 +1,53 @@
+#
+# VERSION 32 - DO NOT REMOVE THIS LINE
+#
+# This file may be overwritten on upgrades.
+#
+
+# FIXME: WSGISocketPrefix is a server-scope directive.  The mod_wsgi package
+# should really be fixed by adding this its /etc/httpd/conf.d/wsgi.conf:
+WSGISocketPrefix $WSGI_PREFIX_DIR
+
+# Configure mod_wsgi handler for /ipa
+WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1 maximum-requests=500 \
+  user=ipaapi group=ipaapi display-name=%{GROUP} socket-timeout=2147483647 \
+  lang=C.UTF-8 locale=C.UTF-8
+WSGIImportScript /usr/share/ipa/wsgi.py process-group=ipa application-group=ipa
+
+<VirtualHost *:80>
+    ServerName $FQDN
+    ServerAlias ipa-ca.$DOMAIN
+
+    # Logging
+    CustomLog /var/log/httpd/ipa-access.log combined
+    ErrorLog /var/log/httpd/ipa-error.log
+
+    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
+    Include $HTTPD_IPA_REWRITE_CONF
+    Include $HTTPD_IPA_CONF
+</VirtualHost>
+
+# the below section is only need if you have above 3 lines and want SSL
+<VirtualHost *:443>
+    ServerName $FQDN
+    ServerAlias ipa-ca.$DOMAIN
+
+    # Logging
+    CustomLog /var/log/httpd/ipa-access.log combined
+    ErrorLog /var/log/httpd/ipa-error.log
+
+    # SSL
+    SSLEngine on
+    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
+    SSLCACertificateFile /etc/ipa/ca.crt
+    SSLCertificateKeyFile /var/lib/ipa/private/httpd.key
+    SSLCertificateFile /var/lib/ipa/certs/httpd.crt
+    SSLCipherSuite PROFILE=SYSTEM
+    SSLProxyCipherSuite PROFILE=SYSTEM
+
+    #
+    IncludeOptional $HTTPD_IPA_KDCPROXY_CONF_SYMLINK
+    IncludeOptional $HTTPD_IPA_PKI_PROXY_CONF
+    Include $HTTPD_IPA_REWRITE_CONF
+    Include $HTTPD_IPA_CONF
+</VirtualHost>
diff --git a/ipaplatform/base/paths.py b/ipaplatform/base/paths.py
index 947b4df37..a762be523 100644
--- a/ipaplatform/base/paths.py
+++ b/ipaplatform/base/paths.py
@@ -45,12 +45,14 @@ class BasePathNamespace:
     GSSAPI_SESSION_KEY = "/etc/httpd/alias/ipasession.key"
     OLD_KRA_AGENT_PEM = "/etc/httpd/alias/kra-agent.pem"
     HTTPD_CONF_D_DIR = "/etc/httpd/conf.d/"
+    HTTPD_IPA_DIR = "/etc/httpd/ipa"
     HTTPD_IPA_KDCPROXY_CONF = "/etc/ipa/kdcproxy/ipa-kdc-proxy.conf"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/conf.d/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/conf.d/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/httpd/conf.d/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/httpd/conf.d/ipa.conf"
-    HTTPD_IPA_WSGI_CONF = "/etc/httpd/conf.d/ipa-wsgi.conf"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/httpd/ipa/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/httpd/ipa/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/httpd/ipa/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/httpd/ipa/ipa.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/httpd/conf.d/vhost-ipa.conf"
+    HTTPD_IPA_WSGI_CONF = "/etc/httpd/ipa/ipa-wsgi.conf"
     HTTPD_NSS_CONF = "/etc/httpd/conf.d/nss.conf"
     HTTPD_SSL_CONF = "/etc/httpd/conf.d/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/httpd/conf.d/ssl.conf"
diff --git a/ipaplatform/debian/paths.py b/ipaplatform/debian/paths.py
index ee44e40e2..71f11068a 100644
--- a/ipaplatform/debian/paths.py
+++ b/ipaplatform/debian/paths.py
@@ -20,11 +20,13 @@ class DebianPathNamespace(BasePathNamespace):
     ETC_HTTPD_DIR = "/etc/apache2"
     HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
     HTTPD_CONF_D_DIR = "/etc/apache2/conf-enabled/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf-enabled/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf-enabled/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf-available/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/apache2/conf-enabled/ipa.conf"
-    HTTPD_IPA_WSGI_CONF = "/etc/apache2/conf-enabled/ipa-wsgi.conf"
+    HTTPD_IPA_DIR = "/etc/apache2/ipa/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/ipa/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/ipa/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/ipa/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/apache2/ipa/ipa.conf"
+    HTTPD_IPA_WSGI_CONF = "/etc/apache2/ipa/ipa-wsgi.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/apache2/sites-available/ipa.conf"
     HTTPD_NSS_CONF = "/etc/apache2/mods-available/nss.conf"
     HTTPD_SSL_CONF = "/etc/apache2/mods-available/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/apache2/sites-available/default-ssl.conf"
diff --git a/ipaplatform/suse/paths.py b/ipaplatform/suse/paths.py
index f451280a0..c13bc8daf 100644
--- a/ipaplatform/suse/paths.py
+++ b/ipaplatform/suse/paths.py
@@ -17,11 +17,13 @@ class SusePathNamespace(BasePathNamespace):
     HTTPD_ALIAS_DIR = "/etc/apache2/ipa"
     GSSAPI_SESSION_KEY = "/etc/apache2/ipa/ipasession.key"
     HTTPD_CONF_D_DIR = "/etc/apache2/conf.d/"
-    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/conf.d/ipa-kdc-proxy.conf"
-    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/conf.d/ipa-pki-proxy.conf"
-    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/conf.d/ipa-rewrite.conf"
-    HTTPD_IPA_CONF = "/etc/apache2/conf.d/ipa.conf"
-    HTTPD_IPA_WSGI_CONF = "/etc/apache2/conf.d/ipa-wsgi.conf"
+    HTTPD_IPA_DIR = "/etc/apache2/ipa/"
+    HTTPD_IPA_KDCPROXY_CONF_SYMLINK = "/etc/apache2/ipa/ipa-kdc-proxy.conf"
+    HTTPD_IPA_PKI_PROXY_CONF = "/etc/apache2/ipa/ipa-pki-proxy.conf"
+    HTTPD_IPA_REWRITE_CONF = "/etc/apache2/ipa/ipa-rewrite.conf"
+    HTTPD_IPA_CONF = "/etc/apache2/ipa/ipa.conf"
+    HTTPD_IPA_WSGI_CONF = "/etc/apache2/ipa/ipa-wsgi.conf"
+    HTTPD_IPA_SITE_CONF = "/etc/apache2/conf.d/ipa-vhost.conf"
     HTTPD_NSS_CONF = "/etc/apache2/conf.d/nss.conf"
     HTTPD_SSL_CONF = "/etc/apache2/conf.d/ssl.conf"
     HTTPD_SSL_SITE_CONF = "/etc/apache2/conf.d/ssl.conf"
diff --git a/ipaserver/install/httpinstance.py b/ipaserver/install/httpinstance.py
index b41ff9d57..108876db7 100644
--- a/ipaserver/install/httpinstance.py
+++ b/ipaserver/install/httpinstance.py
@@ -87,13 +87,14 @@ class HTTPInstance(service.Service):
 
     def create_instance(self, realm, fqdn, domain_name, dm_password=None,
                         pkcs12_info=None,
-                        subject_base=None, auto_redirect=True, ca_file=None,
-                        ca_is_configured=None, promote=False,
+                        subject_base=None, auto_redirect=True, ui_vhost=False,
+                        ca_file=None, ca_is_configured=None, promote=False,
                         master_fqdn=None):
         self.fqdn = fqdn
         self.realm = realm
         self.domain = domain_name
         self.dm_password = dm_password
+        self.ui_vhost = ui_vhost
         self.suffix = ipautil.realm_to_suffix(self.realm)
         self.pkcs12_info = pkcs12_info
         self.cert = None
@@ -112,6 +113,10 @@ class HTTPInstance(service.Service):
             IPA_CCACHES=paths.IPA_CCACHES,
             WSGI_PREFIX_DIR=paths.WSGI_PREFIX_DIR,
             WSGI_PROCESSES=constants.WSGI_PROCESSES,
+            HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
+            HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
+            HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
+            HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF
         )
         self.ca_file = ca_file
         if ca_is_configured is not None:
@@ -198,6 +203,14 @@ class HTTPInstance(service.Service):
         # https://pagure.io/freeipa/issue/7662
         tasks.restore_context(session_dir)
 
+        # create /etc/httpd/ipa
+        if not os.path.isdir(paths.HTTPD_IPA_DIR):
+            os.makedirs(paths.HTTPD_IPA_DIR)
+        # Must be world-readable / executable
+        os.chmod(paths.HTTPD_IPA_DIR, 0o755)
+        # Restore SELinux context of /etc/httpd/ipa
+        tasks.restore_context(paths.HTTPD_IPA_DIR)
+
         target_fname = paths.HTTPD_IPA_CONF
         http_txt = ipautil.template_file(
             os.path.join(paths.USR_SHARE_IPA_DIR,
@@ -220,6 +233,18 @@ class HTTPInstance(service.Service):
         http_fd.close()
         os.chmod(target_fname, 0o644)
 
+
+        target_fname = paths.HTTPD_IPA_SITE_CONF
+        http_txt = ipautil.template_file(
+            os.path.join(paths.USR_SHARE_IPA_DIR,
+                         "ipa-vhost.conf.template"),
+            self.sub_dict)
+        self.fstore.backup_file(paths.HTTPD_IPA_SITE_CONF)
+        http_fd = open(target_fname, "w")
+        http_fd.write(http_txt)
+        http_fd.close()
+        os.chmod(target_fname, 0o644)
+
         target_fname = paths.HTTPD_IPA_REWRITE_CONF
         http_txt = ipautil.template_file(
             os.path.join(paths.USR_SHARE_IPA_DIR,
diff --git a/ipaserver/install/ipa_backup.py b/ipaserver/install/ipa_backup.py
index a997e9196..7b259b612 100644
--- a/ipaserver/install/ipa_backup.py
+++ b/ipaserver/install/ipa_backup.py
@@ -154,6 +154,7 @@ class Backup(admintool.AdminTool):
         paths.HTTPD_CERT_FILE,
         paths.HTTPD_KEY_FILE,
         paths.HTTPD_IPA_CONF,
+        paths.HTTPD_IPA_SITE_CONF,
         paths.HTTPD_WSGI_CONF,
         paths.SSHD_CONFIG,
         paths.SSHD_IPA_CONFIG,
diff --git a/ipaserver/install/server/__init__.py b/ipaserver/install/server/__init__.py
index f8d4b238f..4c4d2a760 100644
--- a/ipaserver/install/server/__init__.py
+++ b/ipaserver/install/server/__init__.py
@@ -317,6 +317,12 @@ class ServerInstallInterface(ServerCertificateInstallInterface,
     )
     no_ui_redirect = enroll_only(no_ui_redirect)
 
+    ui_vhost = knob(
+        None,
+        description="Use virtual host for Web UI",
+    )
+    ui_vhost = enroll_only(ui_vhost)
+
     dirsrv_config_file = knob(
         str, None,
         description="The path to LDIF file that will be used to modify "
diff --git a/ipaserver/install/server/install.py b/ipaserver/install/server/install.py
index 91e6c6a33..729af3512 100644
--- a/ipaserver/install/server/install.py
+++ b/ipaserver/install/server/install.py
@@ -943,12 +943,14 @@ def install(installer):
             realm_name, host_name, domain_name, dm_password,
             pkcs12_info=http_pkcs12_info, subject_base=options.subject_base,
             auto_redirect=not options.no_ui_redirect,
+            ui_vhost=options.ui_vhost,
             ca_is_configured=setup_ca)
     else:
         http.create_instance(
             realm_name, host_name, domain_name, dm_password,
             subject_base=options.subject_base,
             auto_redirect=not options.no_ui_redirect,
+            ui_vhost=options.ui_vhost,
             ca_is_configured=setup_ca)
 
     ca.set_subject_base_in_config(options.subject_base)
diff --git a/ipaserver/install/server/replicainstall.py b/ipaserver/install/server/replicainstall.py
index d5ab3b512..825ecaa33 100644
--- a/ipaserver/install/server/replicainstall.py
+++ b/ipaserver/install/server/replicainstall.py
@@ -150,7 +150,7 @@ def install_ca_cert(ldap, base_dn, realm, cafile, destfile=paths.IPA_CA_CRT):
     return destfile
 
 
-def install_http(config, auto_redirect, ca_is_configured, ca_file,
+def install_http(config, auto_redirect, ui_vhost, ca_is_configured, ca_file,
                  pkcs12_info=None, fstore=None):
     # if we have a pkcs12 file, create the cert db from
     # that. Otherwise the ds setup will create the CA
@@ -163,7 +163,7 @@ def install_http(config, auto_redirect, ca_is_configured, ca_file,
     http.create_instance(
         config.realm_name, config.host_name, config.domain_name,
         config.dirman_password, pkcs12_info,
-        auto_redirect=auto_redirect, ca_file=ca_file,
+        auto_redirect=auto_redirect, ui_vhost=ui_vhost, ca_file=ca_file,
         ca_is_configured=ca_is_configured, promote=True,
         subject_base=config.subject_base, master_fqdn=config.master_host_name)
 
@@ -1315,6 +1315,7 @@ def install(installer):
     install_http(
         config,
         auto_redirect=not options.no_ui_redirect,
+        ui_vhost=options.ui_vhost,
         pkcs12_info=http_pkcs12_info,
         ca_is_configured=ca_enabled,
         ca_file=cafile,
diff --git a/ipaserver/install/server/upgrade.py b/ipaserver/install/server/upgrade.py
index d5c7da70e..f7aa99b87 100644
--- a/ipaserver/install/server/upgrade.py
+++ b/ipaserver/install/server/upgrade.py
@@ -152,6 +152,19 @@ def find_autoredirect(fqdn):
         return False
     return True
 
+def find_uivhost(fqdn):
+    """
+    When upgrading we need to see if the UI virtual host usage
+    was disabled during install time (or afterward). So sift through the
+    configuration file and see if we can determine the status.
+
+    Returns True if use_vhost is enabled, False otherwise
+    """
+    filename = paths.HTTPD_IPA_SITE_CONF
+    if os.path.exists(filename):
+        return True
+    return False
+
 def find_version(filename):
     """Find the version of a configuration file
 
@@ -1677,10 +1690,12 @@ def upgrade_configuration():
     fix_permissions()
 
     auto_redirect = find_autoredirect(fqdn)
+    use_vhost = find_usevhost(fqdn)
     sub_dict = dict(
         REALM=api.env.realm,
         FQDN=fqdn,
         AUTOREDIR='' if auto_redirect else '#',
+        UI_VHOST='' if use_vhost else '#',
         CRL_PUBLISH_PATH=paths.PKI_CA_PUBLISH_DIR,
         DOGTAG_PORT=8009,
         CLONE='#',
@@ -1694,6 +1709,10 @@ def upgrade_configuration():
         IPA_CUSTODIA_SOCKET=paths.IPA_CUSTODIA_SOCKET,
         KDCPROXY_CONFIG=paths.KDCPROXY_CONFIG,
         DOMAIN=api.env.domain,
+        HTTPD_IPA_KDCPROXY_CONF_SYMLINK=paths.HTTPD_IPA_KDCPROXY_CONF_SYMLINK,
+        HTTPD_IPA_PKI_PROXY_CONF=paths.HTTPD_IPA_PKI_PROXY_CONF,
+        HTTPD_IPA_REWRITE_CONF=paths.HTTPD_IPA_REWRITE_CONF,
+        HTTPD_IPA_CONF=paths.HTTPD_IPA_CONF
     )
 
     subject_base = find_subject_base()
@@ -1730,6 +1749,9 @@ def upgrade_configuration():
         upgrade_file(sub_dict, paths.HTTPD_IPA_CONF,
                      os.path.join(paths.USR_SHARE_IPA_DIR,
                                   "ipa.conf.template"))
+        upgrade_file(sub_dict, paths.HTTPD_IPA_SITE_CONF,
+                     os.path.join(paths.USR_SHARE_IPA_DIR,
+                                  "ipa-vhost.conf.template"))
         upgrade_file(sub_dict, paths.HTTPD_IPA_WSGI_CONF,
                      os.path.join(paths.USR_SHARE_IPA_DIR,
                                   "ipa-wsgi.conf.template"))