Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a VPS with a dedicated ip. I host several websites on this server. Can I have a ssl certificate on one of the websites, and still host the other websites on that same ip? The other websites does not require ssl. I'm asking because I read that ssl's require a dedicated ip.

Edit: I'm using apache in a lamp setup.

share|improve this question

migrated from stackoverflow.com Jun 11 '11 at 10:53

This question came from our site for professional and enthusiast programmers.

    
I believe this belongs to server fault –  Cem Kalyoncu Jun 11 '11 at 9:31
add comment

3 Answers 3

up vote 4 down vote accepted

You need a distinct IP address per HTTPS host+port (or, to be precise, per certificate, because some certificate may have multiple Subject Alt. Names) because the client cannot tell the server which host it wants (and thus which certificate should be used) when it connects to the HTTPS port, unless you're using Server Name Indication (which is an SSL/TLS extension that seems more and more supported).

The plain HTTP virtual hosts run on a different port (usually 80) than the port used for HTTPS (usually 443) and are not affected by this restriction.

Even if you're not using SNI (in which case you're restricted to using one certificate per IP+port), you can have as many plain HTTP virtual hosts as you want.

A configuration like this should work (specify the port number in the VirtualHost):

<IfModule mod_ssl.c>
<VirtualHost www.name1.example:443>
        ServerName www.name1.example

        SSLEngine on

        SSLCertificateFile    /etc/...
        SSLCertificateKeyFile /etc/...
        ...
</VirtualHost>
</IfModule>

# (optional)
<VirtualHost www.name1.example:80>
        ....
</VirtualHost>


<VirtualHost www.name2.example:80>
        ....
</VirtualHost>
share|improve this answer
    
I think I can say that a your answer means YES (it's maybe not completly clear). He can run several domain on port 80 and 1 on port 443, no SSL problem in that configuration. Problems will arise when trying to get several domains in HTTPS. –  regilero Jun 11 '11 at 15:34
    
@regilero, indeed, sorry if I wasn't clear. My answer meant that yes, it's possible. –  Bruno Jun 11 '11 at 15:47
    
Thanks, that's what I wanted to know. :-) –  Felthragar Jun 11 '11 at 16:55
add comment

SSL certs work on a per IP basis. You need your sites to have seperate IPs if other sites needs SSL later on.

share|improve this answer
    
This is wrong information.It is the server that is authenticated not the individual web sites it hosts –  user76678 Jun 11 '11 at 10:28
    
@user76686: how is this wrong? a server with 10 IP's can host 10 different virtual hosts each with it's own SSL certificate. –  HampusLi Jun 11 '11 at 11:26
    
@user76678: actually, it's one certificate per IP+port combination (unless you're using SNI). I guess it depends on what you call a "web site". –  Bruno Jun 11 '11 at 14:16
    
@Bruno:You are right.You can have different certificates per port.But still it is for the same IP and this certificate per port can be used for multiple web apps deployed by the same endpoint –  user76678 Jun 11 '11 at 14:21
    
@user76678, sure, it's what you said "the server that is authenticated not the individual web sites" that wasn't clear. One server (the actual machine) can have multiple (virtual) hosts and can also have multiple IP addresses (which may or may not match the number of virtual hosts). –  Bruno Jun 11 '11 at 14:24
show 1 more comment

You don not mention what web server you are using about e.g. IIS, Tomcat etc?
Generally speaking you can configure a web server to require ssl for some of the web sites it is hosting e.g you can do this in IIS.
In Tomcat you have to enable the ssl connector and configure it to use your certificate.
In this case the access to the web site must be from the secure port. The sites requiring plain http can still function

ssl's require a dedicated ip

Well depends on what you mean. Usually certificates are issued to an IP or FQDN but it is not mandatory. The pitfall is that if your web clients check on the hostname and the certificate subject name they may reject connection.

share|improve this answer
    
Sorry about that, I'm using Apache in a standard LAMP setup. –  Felthragar Jun 11 '11 at 9:34
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.