Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'd like to make setting up new subdomains easy (at least for the development side) and getting one wildcard cert, setting up a wildcard dns (which is done and works great) and setting up SNI (Server Name Indication) seems like it would work for our HTTPS testing but googling around I haven't found any good instructions. Is this even possible? Everything I've read about SNI says you need to setup a cert for every site and that SNI just makes it possible to deliver a different cert depending on the hostname.

share|improve this question

1 Answer 1

up vote 5 down vote accepted

If you have a wildcard certificate you can do named-based virtual hosting just like you do without SSL.

When negotiating an SSL connection, your web server needs to select a certificate BEFORE any http protocol headers have been received -- which means that, without SNI, Apache can't select between multiple name-based virtual hosts. This is why in the past you needed a separate ip address for every virtual host hosted on your system. Using SNI, the client is able to provide the server with the name of the host to which it wishes to connect. This allows the server to select the appropriate virtual host configuration, and hence the appropriate certificate.

If you're using a wildcard certificate, you sidestep this problem as long as all of your virtual hosts share a common parent domain. In this case, SNI is unnecessary. Because the certificate is valid for any of your hosts, there's no requirement that your web server is able to identify the appropriate virtual host at the beginning of the SSL negotiation...which means you can use the HTTP headers to identify the host, and proceed with normal name-based virtual hosting.

Using Apache, your configuration would look something like this:

NameVirtualHost *:443

<VirtualHost *:443>
    ServerName foo.example.com
    DocumentRoot /sites/foo.example.com/html
    SSLEngine On
    # ...other SSL parameters...
</VirtualHost>

<VirtualHost *:443>
    ServerName bar.example.com
    DocumentRoot /sites/bar.example.com/html
    SSLEngine On
    # ...other SSL parameters...
</VirtualHost>

We're been running this sort of configuration in a production situation for a few years now without problems.

share|improve this answer
    
+1 to answer and clarity. btw, Not all the browsers support SNI. –  Carlos Jan 26 '11 at 8:27
    
The only browser that doesn't support SNI is IE and only on Windows XP. Those users will be presented with the "this is not a valid cert" error but the site still works, right? –  Sheldon McGee Jan 26 '11 at 17:52
    
They all use the same certificate, yes, that was sort of the whole point of my answer. I apologize if that wasn't clear. –  larsks Jan 26 '11 at 18:18
    
My guess is the cert is the same for both hosts since I'm using a wildcard cert but what if I don't have a wildcard cert? How would the SNI config look? –  Sheldon McGee Jan 26 '11 at 18:46
    
Heck if know. Your question said you were getting a wildcard cert, and my answer was predicated on that. Since we have a wildcard cert I haven't had to look into SNI. –  larsks Jan 26 '11 at 19:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.