Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I were to get 2 SSL certificates, one for and one for, is there a way to install them both on the site in DirectAdmin? The default interface only allows installing one for both versions.

If not, can I separate the 2 domains into 2 sites? One of them would only be a redirection, so there wouldn't be any duplication of site files.

(Please don't answer with "one certificate should work for both". It doesn't always. SNI also doesn't help me. I already have one half of the certificate pair, and need to configure it. This is a DirectAdmin question)

share|improve this question

closed as off-topic by HopelessN00b Apr 9 '15 at 2:50

  • This question does not appear to be about server, networking, or related infrastructure administration within the scope defined in the help center.
If this question can be reworded to fit the rules in the help center, please edit the question.

A given (IP address,port) tuple can only have a single SSL certificate associated with it. So you'll need to have a second IP address available to you to be able to run both certs. – BMDan Mar 16 '12 at 17:22
@BMDan That is incorrect, with Apache SNI you can run multiple SSL certificates from a single IP address. – Ben Lessani - Sonassi Mar 16 '12 at 21:50
@sonassi: I've yet to have a client willing to accept SNI's limitations. Give it another five years (sadly, that's literal—*another* five years) and it'll hit effectively 100% of clients, at which point the argument may change. Even then, personally, the information-disclosure MitM potential of SNI creeps me out. – BMDan Mar 19 '12 at 2:04
Actually only companies that care about IE6 should fear SNI, and thanksfully I don't work for one of those :) – gparent Mar 20 '12 at 14:20
@gparent, it's not just IE6, it's any version of IE running on Windows XP. – Bruno Mar 20 '12 at 22:35

I am personally of the opinion that SNI is not production ready for public internet facing sites in general. There are still plenty of Windows XP boxes out there that would get denied.

This means that generally speaking you can run 1 SSL site on one IP/Port combo. You'll need a second IP to run a second.

Good news is though that you can use a single UCC/SAN(Subject Alternative Name) SSL certificate which has good browser coverage. You can purchase one cert with both variations and use it on one site that supports both hostnames or use it on 2 sites running on different IPs (if your CA allows it).

share|improve this answer

You do not need to install 2 certificates. Even the cheapest SSL certificate out there (RapidSSL Basic) provides support for and as standard.

So it supports the TLD and www subdomain as standard. No need for two certificates.

share|improve this answer
The one I already have, however, does not (and it's from VeriSign, not exactly cheap). Thanks for trying to help, but this doesn't answer the question. – Bart van Heukelom Mar 16 '12 at 22:21
As of late, all VeriSign certifications are SAN certs. so it should cover both variants of your domain ... – Ben Lessani - Sonassi Mar 16 '12 at 22:31
To check if your certificate will support both and you should check certificate subject alt name filed in certificate description. You may check this with any browser. – jollyroger Mar 21 '12 at 20:00
@sonassi: You can likely ask Verisign to provide a replacement certificate that covers both (I've asked this of GeoTrust in the past when I've accidentally submitted in a way that didn't result in a SAN being attached for both name variations). Otherwise, switch to a cheaper cert that includes SANs; most CAs offer a competitive-replacement program for low, no, or sometimes negative cost (i.e., they give you a rebate). – BMDan Mar 27 '12 at 13:39

You have 2 solutions:

  1. Create a SSL SAN certificate (that has the subjectAltName field). Ask the certificate authority if they can generate a SAN certificate.
  2. Create 2 listeners one with one certificate and the other with the 2nd certificate. They can (and should) point to the same site.
share|improve this answer
A certificate with a SAN specifically avoids the SNI requirement. SNI is only required when you have two different certificates from which to choose. – BMDan Mar 27 '12 at 13:37
Sorry, you are right. I will update my answer. – Mircea Vutcovici Mar 27 '12 at 14:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.