Using multiple host names on the same Apache Httpd server (and any HTTPS server for that matter) poses two problems:
- For the connection to be secure, the client must first verify the server certificate.
- If there are multiple certificates available to the server, the server must be able to get which certificate to pick from the client request.
HTTPS is HTTP over SSL/TLS: the SSL/TLS handshake, which establishes the secure tunnel, is started by the client just after creating the TCP connection, before any HTTP exchange is made. All the subsequent HTTP traffic of the HTTPS exchange is done over this SSL/TLS connection.
The server certificate is sent by the server as part of the SSL/TLS handshake. The verification process relies on (a) verifying the certificate is trusted and (b) verifying it was issued for the server the client intended to contact. There are more details in this answer on StackOverflow.
In HTTP, the requested host name is sent in the HTTP
Host header. This is how name-based virtual hosts work: the dispatch is done based on the
Host header internally within Apache Httpd.
However, the HTTP
Host header isn't available to Apache Httpd before the SSL/TLS has completed successfully. Thus, it's not available before the server certificate has been sent.
There are two ways to help Apache Httpd choose which certificate to use during the handshake, without relying on any HTTP traffic:
- Using a certificate per IP address/port combination. This is the traditional way.
- Using the Server Name Indication extension of SSL/TLS, send during the SSL/TLS handshake, which establishes the secure tunnel. The problem with this option is that not all browsers support it. In particular, it's not supported on any version of IE on XP (and some mobile browsers, I think).
If you cannot use SNI or have multiple IP addresses on your server, you could use a certificate that is valid for all the host names that you want to serve. This can be done by using:
- a certificate issued to a wildcard name (but their usage is discouraged), or
- a certificate with multiple Subject Alternative Name DNS entries. This should be your preferred option.
If you really want to try SNI, it should work with a recent-enough version of Apache Httpd 2, using a recent-enough version of OpenSSL (if using
mod_ssl as provided with the main code base). This is documented here: http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI