SSL with other sites on same server

Question

I have a VPS with a dedicated ip. I host several websites on this server. Can I have a ssl certificate on one of the websites, and still host the other websites on that same ip? The other websites does not require ssl. I'm asking because I read that ssl's require a dedicated ip.

Edit: I'm using apache in a lamp setup.

Answer 1

You need a distinct IP address per HTTPS host+port (or, to be precise, per certificate, because some certificate may have multiple Subject Alt. Names) because the client cannot tell the server which host it wants (and thus which certificate should be used) when it connects to the HTTPS port, unless you're using Server Name Indication (which is an SSL/TLS extension that seems more and more supported).

The plain HTTP virtual hosts run on a different port (usually 80) than the port used for HTTPS (usually 443) and are not affected by this restriction.

Even if you're not using SNI (in which case you're restricted to using one certificate per IP+port), you can have as many plain HTTP virtual hosts as you want.

A configuration like this should work (specify the port number in the VirtualHost):

<IfModule mod_ssl.c>
<VirtualHost www.name1.example:443>
        ServerName www.name1.example

        SSLEngine on

        SSLCertificateFile    /etc/...
        SSLCertificateKeyFile /etc/...
        ...
</VirtualHost>
</IfModule>

# (optional)
<VirtualHost www.name1.example:80>
        ....
</VirtualHost>


<VirtualHost www.name2.example:80>
        ....
</VirtualHost>

Answer 2

SSL certs work on a per IP basis. You need your sites to have seperate IPs if other sites needs SSL later on.

Answer 3

You don not mention what web server you are using about e.g. IIS, Tomcat etc?
Generally speaking you can configure a web server to require ssl for some of the web sites it is hosting e.g you can do this in IIS.
In Tomcat you have to enable the ssl connector and configure it to use your certificate.
In this case the access to the web site must be from the secure port. The sites requiring plain http can still function

ssl's require a dedicated ip

Well depends on what you mean. Usually certificates are issued to an IP or FQDN but it is not mandatory. The pitfall is that if your web clients check on the hostname and the certificate subject name they may reject connection.