Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Ubuntu 11.04 Server with multiple Virtual Hosts running on a shared IP. Is it possible to have two (different) SSL certificates for each site?

I remember hearing something about you only being able have one SSL certificate per IP.

share|improve this question
    

2 Answers 2

up vote 5 down vote accepted

You can host multiple SSL based sites. You have to use SNI, and not all browsers support SNI, so you can have issues with an older web browser. Most modern browsers should support it. It's described in RFC-6066

This HOW-TO can walk you though how to do it.

share|improve this answer
    
SNI works in all modern browsers and operating systems. The problem is, as so often, Windows XP, where no version of IE supports SNI. Only Firefox does in XP. Also problematic are certain libraries such as JSSE (Java) and Qt. Wikipedia has a list. –  daff Sep 3 '11 at 6:04
    
Correct, however I know several corporations and government groups that are still on windows XP. I don't know is IE6 can handle SNI. –  Squidly Sep 11 '11 at 4:11

You are correct. You can only associate an SSL certificate per IP address. SSL certificates (sadly) do not work with virtual hosting.

share|improve this answer
    
That's what I thought. I have vague memories of being stuck up at 4AM trying to figure it out -- to no avail. Thanks for confirming. –  Trent Scott Sep 3 '11 at 1:55
    
Do you mean named-based virtual hosting (which is what the poster is apparently referring to)? SSL Certificates will work with IP-based sites just fine as long as there is a different certificate per IP. :D –  Rilindo Sep 3 '11 at 2:27
2  
-1 for Incorrect answer. –  Squidly Sep 3 '11 at 4:11
2  
This answer is incorrect. Server Name Indication solves this exact problem and has been around for a while now. Apache as of 2.2.14 has SNI activated by default, if I recall correctly. See Wikipedia on SNI. –  daff Sep 3 '11 at 6:06
2  
Even without SNI, name based vhosts under a wildcard or subject alternate name certificate work just fine - which is specifically not what the question asked for, but it's another problem with this answer. @Trenton, this answer is not correct. –  Shane Madden Sep 3 '11 at 8:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.