Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Can I set multiple SSL certificates for virtual hosts using Lighttpd web server?

I have several webshops on my server (each webshop has its own domain) and I need to setup a SSL certificate for each of them.

thanks Patrick

share|improve this question

2 Answers 2

up vote 0 down vote accepted

You can only setup one SSL certificate per ip/port pair that you use. If you have one IP address and multiple virtual hosts on the same ip address it will not work except if you get a SAN certificate with all the virtual host/domain contained in the SAN certificate. This will get expensive.

The reason for this limitation is that the web server needs to decrypt the SSL request to see which host the client is trying to access. This will be done using the SSL cert bound to that port. The client will then get a different certificate which will not match the host/domain the client is expecting.

This will cause all sorts of security warnings on the client side.

Correction:

Please look at Lighttpd SNI, Server Name Indication is supported by Lighttpd since 1.4.24, which will allow more than one vhost per ip for SSL as pointed out by jae. Browser support is limited though including IE on XP.

share|improve this answer
    
@Francois Wolmarans So this means, it is not possible to have more than one webshop on the same server ? –  Patrick Nov 10 '10 at 10:37
    
Or should I maybe assign a different port to each webshop ? (redirecting the customer to that port) ? –  Patrick Nov 10 '10 at 10:40
    
@Patrick to be clear you can use unique IP's and/or unique ports, in the case of a "webshop" as you put it, you would be better off using unique ips –  Oneiroi Nov 10 '10 at 10:43
1  
@Patrick I am sure your web host would provide more IP addresses to your VPS for a nominal fee, in fact I'd go so far as to say they could also help support you in the deployment of you ssl, send an email to their support address. –  Oneiroi Nov 10 '10 at 10:56
1  
@Patric I agree with Oneiroi, you will probably run into all sorts of errors if you start using non standard ports. A lot of corporates limit the port ranges their staff can access. Try for the multiple ip address option. –  Francois Wolmarans Nov 10 '10 at 15:46

Using SNI is the way to do it. Here is a quick example:

$HTTP["host"] == "www.domain1.com" {
     server.document-root = "/home/www/domain1.com/public"
     server.errorlog = "/var/log/lighttpd/domain1.com/error.log"
     accesslog.filename = "/var/log/lighttpd/domain1.com/access.log"

     server.error-handler-404 = "/index.php"

     ssl.pemfile = "/etc/lighttpd/certs/www.domain1.com.pem"
}

and if you want to add an other domain with its own SSL,

$HTTP["host"] == "www.domain2.com" {
         server.document-root = "/home/www/domain2.com/public"
         server.errorlog = "/var/log/lighttpd/domain2.com/error.log"
         accesslog.filename = "/var/log/lighttpd/domain2.com/access.log"

         server.error-handler-404 = "/index.php"

         ssl.pemfile = "/etc/lighttpd/certs/www.domain2.com.pem"
}

Keep in mind that not all browsers support this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.