1

I have a dedicated server which is pointed to the domain www.domain1.com. I bought ssl sertificates for my domain x1.domain1.com which cost $10 so I bought ssl certificates for all sub domains, since wildcard certificate is too costly.

When i restart apache, the x1.domain1.com is getting set to the ssl certificate on x2.domain1.com it shows an "untrusted warning" that this certificate is valid for some other domain. I checked the certificate itself, and it shows a domain of x1.domain1.com, that is the certificicate of x1.domain1.com

How can I get multiple SSL vhosts set up?

My config file is

<VirtualHost *:443>
        ServerAdmin [email protected]
        DocumentRoot /var/htm2/
        ServerName x1.domain1.com
        SSLEngine on
        SSLCertificateFile /usr/server.crt
        SSLCertificateKeyFile /usr/server.key </VirtualHost>



 <VirtualHost *:443>
        ServerAdmin [email protected]
        DocumentRoot /var/htm/
        ServerName x2.domain1.com
        SSLEngine on
        SSLCertificateFile /usr/l/server.crt
        SSLCertificateKeyFile /usr/l/server.key  </VirtualHost>

the problem is i am having a single dedicated ip : 141.XX.XX.X but when i go to https://x1.domain1.com in chrome or firefox latest , the certificate works , but when i go to https://x2.domain1.com . it shows a certificate untrustness , and says conform trust of certificate as this certificate is for another domain , i viewed the certificate and saw it as certificate of x1.domain1.com

i want both of the sites to be browsed like 

https:\\x1.domain1.com
https:\\x2.domain1.com

with out any port or any thing ... what settings should i alter in the above config to attain this , what is the trouble which cause x2.domain1.com to show certificate of x1..domain and also how can i redirect

http:\x1.domain1.com to https:\x1.domain1.com with out using htaccess , if by htaccess then how ?

also how to redirect

Improve this question
3
  • You forgot to ask a question.
    – David Schwartz
    Oct 12, 2012 at 12:38
  • 2
    @DavidSchwartz After editing for spelling and formatting, I added the question that you and I both answered :)
    – Alex
    Oct 12, 2012 at 12:58
  • Do you get the content for x1 or x2 after you click through the cert warning? Does your client browser support SNI? Provide the output of apachectl -S; do you have NameVirtualHost *:80 configured?
    – Shane Madden
    Oct 13, 2012 at 20:35

2 Answers 2

Reset to default
1

SNI isn't supported by almost half of current Internet browsers. So the server has to decide which certificate to send to the client knowing only the port the client connected to. If you need to serve two different certificates, probably your best choice is to use two different ports. Alternatively, you can use a service that lets you put both names in the same certificate. (StartSSL, for example, lets you put any hosts for any domains you validate in any certificates you issue in any combination.)

Improve this answer
2
  • It's mostly just browsers on the Microsoft crypto APIs under XP - that's well under half these days, isn't it?
    – Shane Madden
    Oct 13, 2012 at 20:37
  • Last I checked (about four months ago) it was just under half. (Browsers that didn't support SNI, mostly IE under XP, but others too.)
    – David Schwartz
    Oct 13, 2012 at 21:52
1

You need to either bind your vhosts to a different IP address or bind to a different port.

The problem is that you can't have two SSL hosts on the same IP+PORT because the hostname can't be determined as it is part of the encrypted content. So it picks one of the vhosts and delivers that (typically the first vhost) http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

As David Schwartz said, you can also put all the names in a single certificate. In x509 parlance, that is the SubjectAlternateName field.

Improve this answer
2
  • can i merge the two different ssl certificates into a single one ? , then how ?
    – cc4re
    Oct 14, 2012 at 5:59
  • SubjetAlternateName is part of the certificate signing request (CSR). You would have to generate a new CSR with both names in it.
    – Alex
    Oct 15, 2012 at 17:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .