Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have mass virtual hosting set up on one of our servers allowing me to basically create a symlink in a certain directory and immediately have that host available on both http as well as https. This works great if all of the hostnames are in the same domain (wildcard certificate) but not otherwise. Let me show you my VirtualHost container:

    SSLEngine on
    SSLProtocol all -SSLv2

    ### Mass SSL Vhosts ###
    RewriteEngine on

    #   define two maps: one for fixing the URL and one which defines
    #   the available virtual hosts with their corresponding
    #   DocumentRoot.
    RewriteMap    lowercase    int:tolower

    #   2. make sure we have a Host header
    RewriteCond   %{HTTP_HOST}  !^$

    #   3. lowercase the hostname
    RewriteCond   ${lowercase:%{HTTP_HOST}|NONE}  ^(.+)$

    #   5. finally we can map the URL to its docroot location
    #      and remember the virtual host for logging puposes
    RewriteRule ^/(.*)$ /wwwroot/vhosts/%{HTTP_HOST}/$1 [E=VHOST:${lowercase:%{HTTP_HOST}}]

    <Directory "/wwwroot/vhosts/">
        Options FollowSymLinks
        AllowOverride All
    <Files ~ "\.(cgi|shtml|phtml|php3?)$">
        SSLOptions +StdEnvVars
    <Directory "/var/www/cgi-bin">
        SSLOptions +StdEnvVars

    ErrorLog /var/log/httpd/ssl_error_log
    TransferLog /var/log/httpd/ssl_access_log
    LogLevel warn

    SSLCertificateFile /etc/pki/tls/certs/
    SSLCACertificateFile /etc/pki/tls/certs/
    SSLCertificateKeyFile /etc/pki/tls/private/

    SetEnvIf User-Agent ".*MSIE.*" \
             nokeepalive ssl-unclean-shutdown \
             downgrade-1.0 force-response-1.0
    CustomLog logs/ssl_request_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

This setup works anytime I want to create a domain. I just create a symbolic link in /wwwroot/vhosts to a user's directory and bam it works. I now want to create a domain. Once again, I can just create it and drop it in and will work. What I cannot get working however, is because of the explicitly defined certificates above.

Is there any way to branch inside the VirtualHost container to use different SSL certificates depending on the hostname?

share|improve this question
up vote 2 down vote accepted

Have you looked into SNI (Server Name Indication)? E.g. with mod_ssl or mod_gnutls:

share|improve this answer
Yes, the problem is: "SNI has only recently gained support in browsers. The browsers that have been confirmed to support SNI are: Opera 8.0+, Firefox 2+, Internet Explorer 7+, Safari 3.2.1+, Chrome (NOT Chromium) ((Chromium 11.0.696.28 seems to do sni fine -mt))" – Vic Jun 25 '11 at 19:49
I'm curious-- what happens if someone visits the site using IE6? – Vic Jun 25 '11 at 19:53
SNI in older browsers (i.e. IE6) won't work... It's called progress. ;-) – Henk Jun 25 '11 at 20:53
So I guess people with older browsers will see the very first virtual host? I agree that it's progress, however there are plenty of corporate IT environments where the update cycle hasn't caught up to progress because of bureaucratic nonsense. – Vic Jun 25 '11 at 21:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.