Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have 2x SSLs on one server for two different domains. I've done so by making SSL number 2 point to another port number, in this case 444. Code for apache below:

<VirtualHost XX.XX.XX.XX:443>
  ServerAlias *
  SSLEngine on
  SSLCertificateFile /usr/local/ssh/xxx/xxx.crt
  SSLCertificateKeyFile /usr/local/ssh/xxxx/xxxx.key
  DocumentRoot /var/www/

Listen 444
NameVirtualHost *:444

<VirtualHost xx.xx.xx.xx:444>
  ServerAlias *
  SSLEngine on
  SSLCertificateFile /usr/bin/
  SSLCertificateKeyFile /usr/bin/yyyy.key
  SSLCertificateChainFile /usr/bin/yyyyy.crt
  DocumentRoot /var/www/

Currently, all of my links point to so the user doesn't see any invalid SSL certificates. The issue is I have some users who just type in and do not enter in a port # and they shouldn't have to.

If I visit, it's looking at the certificate for and an invalid ssl cert error pops up. I've tried several mod rewrite that if the is on port 443 to redirect to

I am sure the answer is obvious... But for the life of me, I can't figure it out!

share|improve this question

This is not possible unless you have two subdomains of a common top level domain, and you have obtained a wildcard certificate.

The reason this is not possible is when a customer types (note, no :444), their browser initiates a TLS connection to the process listening on port 443. Over this port the certificate and handshaking information (which includes host name of the default vhost bound to that ip:port combination) are exchanged.

Only once the TLS connection has been established can you exchange the HTTP level 301 redirection. But by this point the customer has already seen the invalid certificate information for

Also, I notice you are aliasing to the same vhost as, this will have the same effect. Your certificate (unless it is a wildcard) is for or only.

share|improve this answer

Antoine Benkemoun, It used to be the case that you couldn't do multiple SSL with name based vhosts but using separate ports got around this limitation.
You still can't if not using GnuTLS

I'm going to guess here but I suspect your NOT using GnuTLS for your webservers ssl library and therefore what you are asking for is name base vhosting and SSL and won't work.

share|improve this answer

With SSL, one IP = one certificate. If you want several certificates, get an extra IP. The exception to this is multidomain certificates that are signed for several subdomains.

share|improve this answer
That's not true. You can have multiple SSL they just need to run on different ports. I already have two SSLs on one server and it works fine, except for the redirection. – P Hank Jun 16 '09 at 5:17
Multiple ports is really ugly and calls for trouble... Honestly no one wants to type – Antoine Benkemoun Jun 16 '09 at 6:58
That's still not true: you have STARTTLS (RFC 2817), the TLS extension SNI (Server Name Indication), and multiple-names certificates - Thawte sells them). – bortzmeyer Jun 16 '09 at 11:08
Ok my bad, now I will know for the future. Thank you very much. – Antoine Benkemoun Jun 16 '09 at 11:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.