up vote 1 down vote favorite
share [g+] share [fb]

I know 1 SSL for 1 dedicated IP, yes, but now TLS technology offer a better solution by only use one port for unsecure and secure connection (like no need 443) and no need dedicated IP for each SSL. It is offered by SNI extension or subjectAltName based on here http://en.wikipedia.org/wiki/Server_Name_Indication and http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

But this thing seems new to me. I found this can be configure in Apache 2.2.x server as mention here: SSL site not using the correct IP in Apache and Ubuntu and Multiple SSL domains on the same IP address and same port?

So it is possible to do in the Apache itself.

I wondering if it can be done in cPanel so any of my domains can gat a SSL cert and apply without buying another dedicated IP. I am looking to see this is possible in cPanel/WHM server either from update, easyapache rebuild, plugin, tweak manually...Anyone knows?

link|improve this question
Keep in mind that SNI is not supported by the Windows XP crypto libraries, so you'll need to stay away from it if you have connecting clients on XP. Can't help you on whether the management panels support it, though. – Shane Madden Nov 11 '11 at 7:43
I thought Firefox since v2 support it, then how about Firefox in Win XP? So I can suggest user to use non-IE browser. – CallMeLaNN Nov 11 '11 at 8:00
I found it here forums.cpanel.net/f145/… – CallMeLaNN Nov 11 '11 at 9:11
1  
Keep in mind that SNI requires "OpenSSL 0.9.8k and later" which is not provided on all major Distros (It's not supported on RHEL5, for example). Check your OpenSSL version first, before going down this path. – Stefan Lasiewski Nov 14 '11 at 18:44
feedback

1 Answer

up vote 0 down vote

I believe that what you want can be accomplished using a Unified Communications Certificate. This is a more expensive certificate that contains multiple domains. (Around $300/year).

Scroll down on the second link for an Apache specific example.

http://www.sslshopper.com/article-ssl-host-headers-in-iis-7.html

http://www.sslshopper.com/article-how-to-configure-ssl-host-headers-in-iis-6.html

One down side though is that you will need to know all your domain names up front or you will have to get a new Unified Communications Certificate with all the existing domains plus the new one each time you add one.

VeriSign offers a variant that uses the same field.

SAN SSL Certificates

Choose the VeriSign® SSL Certificate that fits your business and secure up to 24 additional domain names by adding them to the subject alternative name (SAN) field during enrollment. SAN is an optional feature used for Unified Communications (UC) to secure Microsoft Exchange 2007 Server, Office Communications Server 2007 or Mobile Device Manager as well as server names, intranet and local names.

May be prohibitively expensive but it does look to be a viable option.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.