3

i have multiple domains i'm using ssl for on one apache install. i know i need to put each domain on a separate IP externally. does the same apply to the IPs behind the NAT?

meaning, i have one domain on a hypothetical external IP: 1.2.3.4, another on 1.2.3.5 (these are made up IPs, obviously)

internally these IPs both point to 192.168.1.5. does it have to be a 1:1 mapping in that 1.2.3.4 domain will point to 192.168.1.5 and the 1.2.3.5 IP has to point to say, 192.168.1.6? can they both point to 192.168.1.5 and still work?

4 Answers 4

4

You can use the same internal ip, so long as you use a different port. Apache needs to know which SSL cert/key to use for the connection - and since the domain name in the request is encrypted, it can't use that. The only thing it has to go on is ip:port, so at least one of these must be unique.

2

I believe the answer is yes, the IP address behind the NAT must be unique per SSL cert.

SSL is a transport-level encryption, it is set up before the client makes its request. So the server doesn't know in advance which website the client is going to ask for.

2
  • You're correct. In other words, the server knows which SSL cert to use based on the IP address. So you can't have multiple SSL certs on 192.168.1.5
    – Josh
    Oct 14, 2009 at 16:22
  • 2
    There are couple of ways to do that: one is to terminate the SSL on a public ip and use non-ssl connection to the real web server backend, another one is redirect the different public ips to different ports listening on the same internal ip.
    – Istvan
    Oct 14, 2009 at 17:15
0

On https://httpd.apache.org/docs/current/ssl/ssl_faq.html#vhosts you can read the following:

Note that if you have a wildcard SSL certificate, or a certificate that has multiple hostnames on it using subjectAltName fields, you can use SSL on name-based virtual hosts without further workarounds.

SAN certificates can not only have multiple hosts on one domain, but also multiple domains in them.

-1

you can use the same internal ip, because you have to see the TCP workflow in this case. You client is connecting to the external IP0 which has DOMAIN0 name. The SSL key is for DOMAIN0. This TCP session is going to the IP0 and even tho there is a redirect to internal ip the client will see the external one and will be happy.

2
  • 1
    The problem is on the server end - it needs to differentiate among virtual hosts. Your solution would work if the SSL sessions were being terminated at an SSL accelerator that forwarded the requests in the clear to an Apache backend.
    – MikeyB
    Oct 14, 2009 at 17:25
  • 1
    This is exactly what Nginx does using simple http backends. But becase you no clue about this just press the minus flag :)
    – Istvan
    Oct 17, 2009 at 10:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .