17

Is it possible for a web server to select an SSL certificate to use based on the host-header of the incoming connection, or is that information that is only available after the SSL connection is established?

That is, can my webserver listed on port 443 and use the foo.com certificate if https://foo.com is requested, and the bar.com certificate if https://bar.com is requested or am I trying to do something impossible because the server has to establish an SSL connection before it knows what the client wants?

4 Answers 4

23

Historically, your first statement is accurate. Now, there are multiple options:

  • A wildcard certificate if subdomains within the same domain.
  • A SAN/UCC cert to specify alternative names for the certificate, thus being able to serve multiple certificates.
  • SNI was introduced to establish the SSL connection after the Host header. This has limited support, however, as it is newer.

This has been answered numerous times on ServerFault by myself and others. I'd suggest searching for further details unless you have a specific question.

5
  • 4
    I went searching and couldn't find anything; this is probably one of those things that is only easy to search for if you know the answer so you can include that in search terms. Thanks.
    – DrStalker
    Mar 26, 2010 at 3:39
  • 3
    If there are existing answers on ServerFault, it would have been nice to links to them. Jun 3, 2011 at 21:07
  • serverfault.com/search, @organicveggie.
    – Warner
    Jun 6, 2011 at 17:14
  • 4
    SNI does not establish the SSL connection after the Host header, but includes the hostname in the SSL handshake. Not that it matters if you're not an SSL developer. Mar 16, 2012 at 22:24
  • Searching Serverfault gives this as the answer. That means that canonically any other questions are duplicates of this one. That link you included has no results.
    – Ian Boyd
    May 2, 2012 at 18:01
5

To extend Warner's answer: CAcert's page Vhost Task Force compares several methods for using multiple domains on a single server. I personally use Server Name Indication.

1
  • How do you cope with Windows XP users, Android users, Blackberry users, etc? Oct 20, 2011 at 4:06
3

Short answer: no

HTTP is encapsulated inside SSL, so any information about the request is inaccessible until the connection has been established. Hence until a certificate was given to the client. No way to use headers nor any other encrypted info, as they are still not available.

EDIT: this is true if you want nowadays to be cross browser and fully portable. As said by others there are some new emerging methods making it possible in the near future.

0
1

or is that information that is only available after the SSL connection is established?

Correct. The SSL connection is established before any part of the HTTP request (host header included) is sent.

1
  • 2
    That is no longer fully accurate.
    – Warner
    Mar 25, 2010 at 13:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .