1

I have 2x SSLs on one server for two different domains. I've done so by making SSL number 2 point to another port number, in this case 444. Code for apache below:

<VirtualHost XX.XX.XX.XX:443>
  ServerAlias *.xxxx.com
  ServerName xxxx.com
  SSLEngine on
  SSLCertificateFile /usr/local/ssh/xxx/xxx.crt
  SSLCertificateKeyFile /usr/local/ssh/xxxx/xxxx.key
  DocumentRoot /var/www/www.xxxxx.com/web/
</VirtualHost>

Listen 444
NameVirtualHost *:444

<VirtualHost xx.xx.xx.xx:444>
  ServerAlias *.yyyyyy.com
  ServerName yyyyyy.com
  SSLEngine on
  SSLCertificateFile /usr/bin/yyyyy.com.crt
  SSLCertificateKeyFile /usr/bin/yyyy.key
  SSLCertificateChainFile /usr/bin/yyyyy.crt
  DocumentRoot /var/www/www.yyyyyy.com/web/
</VirtualHost>

Currently, all of my links point to https://yyyyy.com:444/ so the user doesn't see any invalid SSL certificates. The issue is I have some users who just type in https://yyyyy.com/ and do not enter in a port # and they shouldn't have to.

If I visit, https://yyyyy.com/ it's looking at the certificate for xxxx.com and an invalid ssl cert error pops up. I've tried several mod rewrite that if the yyyyy.com is on port 443 to redirect to https://yyyyy.com:444/

I am sure the answer is obvious... But for the life of me, I can't figure it out!

4 Answers 4

2

This is not possible unless you have two subdomains of a common top level domain, and you have obtained a wildcard certificate.

The reason this is not possible is when a customer types https://yyyyy.com/ (note, no :444), their browser initiates a TLS connection to the process listening on port 443. Over this port the certificate and handshaking information (which includes host name of the default vhost bound to that ip:port combination) are exchanged.

Only once the TLS connection has been established can you exchange the HTTP level 301 redirection. But by this point the customer has already seen the invalid certificate information for https://xxxx.com.

Also, I notice you are aliasing www.xxxx.com to the same vhost as xxxx.com, this will have the same effect. Your certificate (unless it is a wildcard) is for xxxx.com or www.xxxx.com only.

1

Possible solutions:

0

Antoine Benkemoun, It used to be the case that you couldn't do multiple SSL with name based vhosts but using separate ports got around this limitation.
You still can't if not using GnuTLS

I'm going to guess here but I suspect your NOT using GnuTLS for your webservers ssl library and therefore what you are asking for is name base vhosting and SSL and won't work.

-1

With SSL, one IP = one certificate. If you want several certificates, get an extra IP. The exception to this is multidomain certificates that are signed for several subdomains.

4
  • That's not true. You can have multiple SSL they just need to run on different ports. I already have two SSLs on one server and it works fine, except for the redirection.
    – P Hank
    Jun 16, 2009 at 5:17
  • Multiple ports is really ugly and calls for trouble... Honestly no one wants to type xxx.com:444... Jun 16, 2009 at 6:58
  • That's still not true: you have STARTTLS (RFC 2817), the TLS extension SNI (Server Name Indication), and multiple-names certificates - Thawte sells them).
    – bortzmeyer
    Jun 16, 2009 at 11:08
  • Ok my bad, now I will know for the future. Thank you very much. Jun 16, 2009 at 11:41

You must log in to answer this question.