Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We run cent os, plesk with apache and php, mysql. There are around 25 sites and each of them need an SSL certificate now. The host cannot have more than 16 IPs on the same server. Is it possible to have all these sites use just one IP address and have SSL certificate setup for each site?

If yes, please let me know how I can set this up.


share|improve this question
up vote 4 down vote accepted

You can do it with SNI technology but it doesn't work with all the available browsers. Check if your clients and your servers support it. For example, Apache on Debian Lenny does not support it.

share|improve this answer
So do we need 25 IP address to reliably have 25 SSL certificate enabled websites? – ServerDown May 17 '10 at 16:34
Don't cry but yes. Except if all the sites are from the same (sub-)domain and you can have a certificate for all the sites of this subdomain. It is named a wildcard certificate – Dom May 17 '10 at 16:55
You don't necessarily need 25 IP addresses... Another alternative (and one supported by most browsers) is to use a certificate with multiple Subject Alternative Names (SANs), sometimes referred to as a Unified Communications (UC) certificate (Exchange 2007 and 2010 use them to support UC). Unlike a wildcard certificate, a SAN certificate would allow you to support multiple root domains (e.g. and SAN certs are available from several trusted CAs (e.g. DigiCert at a reasonable cost; even free ones from StartCom... see – jnaab Jun 3 '10 at 19:01

Most things in the other answer are correct.

However with debian lenny it IS possible to implement SNI (on the server side!) - but be aware of the fact that this is experimental. You have to use libapache2-mod-gnutls which uses GnuTLS instead of OpenSSL. For an example see:

share|improve this answer
Thanks for pointing this. I will try this ! – Dom May 17 '10 at 17:32
Note that at the moment, Parallels doesn't officially support SNI on their Plesk system. I'm sure with some elbow grease and custom Apache / OpenSSL compiling, you can make it work. – James Jun 19 '10 at 2:27

If you cannot do SNI or similar configurations, keep in mind that you can have 25 sites in a single IP address with their 25 separate certificates. You need to make your 25 SSL (HTTPS) servers listen on 25 different ports and have your HTTP listener redirect to the corresponding HTTPS server using mod_rewrite for each virtual host.

share|improve this answer
Then, also keep in mind that this way it is not possible to directly visit (ok, one of them that is on port 443 will work) and that corporate firewalls often block outgoing traffic not on port 80 or 443. – mihi Mar 7 '11 at 17:52
Just a clarification in the comment above because the SF editor crunched it: You cannot visit directly https :// In such cases have the server listening on port 443 redirect to a directory containing links to the 25 servers. – adamo Mar 7 '11 at 18:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.