Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Zimbra ZCS 7.1.3 server it running the OSE version. The server hosts 4 domains for email. Each of the email domains has its own SSL cert that is self generated.

Something that has sort of bugged me since the time it was installed is the way I have everything configured. When I set it up I wanted an SSL cert for each domain, as per a conversation on the Zimbra forums I was told I needed a separate IP address for EACH domain for SSL to work right.

So this left me with a configuration like so;

eth0 - - eth0:0 - - eth0:1 - - eth0:2 - -

Each of those IP addresses is NATed to a public IP and has basic port forwarded to it. While everything does in fact work I can help but think this is not correct.

The original reason this was though to be the correct way was because of the command you must enter to make per domain ssl certs with zimbra.

The command is, zmprov md <domain> +zimbraVirtualHostName {} +zimbraVirtualIPAddress {}

The other way to make multiple domains to work is use an SSL with alternative names. Which I am not entirely sure how to use.

In the end all I am trying to do is make the zimbra a little less complex on the networking side.

share|improve this question
up vote 3 down vote accepted

You have to use either different IPs or different ports. SNI (deciding which SSL certificate based on the name the other person is trying to reach) isn't supported on enough browsers yet for name-based SSL hosting to work.

share|improve this answer
so then the way I have it is configured correctly? An interface per domain?. Could I / How would I use SSL certs with SubjectAlternativeName(s)? Because then I would only need one cert for the whole server, right? – ianc1215 Nov 22 '11 at 3:23
You could do it that way, if you can get one certificate that can cover the names for all your sites. The problem is that you may have to send the certificate without knowing which name the client was trying to reach. – David Schwartz Nov 22 '11 at 3:38
Apparently I am doing it right as per this wiki article from Zimbra, when shown graphically it makes sense. – ianc1215 Nov 22 '11 at 3:40

As you mentioned in one of your comments, since you are self-generating your certificates, you could make one certificate with Subject Alternative Names which includes all your domains. I don't see any problems doing it this way.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.