Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I can only configure one. when I try to configure the other I get httpd error with bad syntax. any one know how to configure 2 certificates in apache? this is what I have:

# ssl

LoadModule ssl_module modules/mod_ssl.so
Listen 443

AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl

SSLPassPhraseDialog  builtin

SSLSessionCache         shmcb:/var/cache/mod_ssl/scache(512000)
SSLSessionCacheTimeout  300

SSLMutex default
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin

SSLCryptoDevice builtin

<VirtualHost *:443>
  ServerName  company ip address
  ServerAlias *.company wild card certificate 
  DocumentRoot /live/html

  ErrorLog logs/ssl_error_log             
  TransferLog logs/ssl_access_log
 LogLevel warn

  RewriteEngine on     
  RewriteOptions Inherit

  SSLEngine on
  SSLProtocol all -SSLv2               
  SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

###  SSLCertificateFile /etc/httpd/pki/company.co.uk.crt
###  SSLCertificateKeyFile /etc/httpd/pki/server.key
###  SSLCACertificateFile /etc/httpd/pki/intermediate.crt

SSLCertificateFile /etc/httpd/pki/USA/server.crt
  SSLCertificateKeyFile /etc/httpd/pki/USA/server.key
  SSLCACertificateFile /etc/httpd/pki/USA/intermediate.crt

  <Files ~ "\.(cgi|shtml|phtml|php3?)$">
      SSLOptions +StdEnvVars
  </Files>
 <Directory "/var/www/cgi-bin">
      SSLOptions +StdEnvVars
  </Directory>

 SetEnvIf User-Agent ".*MSIE.*" \
          nokeepalive ssl-unclean-shutdown \
           downgrade-1.0 force-response-1.0

  CustomLog logs/ssl_request_log \
           "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
share|improve this question
1  
What are you trying to accomplish? What problem is this the solution to? (Also, this won't work if both services are using the same IP address. SNI is not production-ready yet.) –  David Schwartz Mar 11 '12 at 15:30
1  
The production-readiness of SNI will coincide with the eradication of Windows XP, because SNI works fine on any reasonably recent version of Firefox/Safari/Chrome as well as IE7 and up on Vista or better. It just doesn't work in IE6 or in any version of IE on XP. –  Skyhawk Mar 11 '12 at 16:06
    
Hi, I'm using Linux and Apache. I'm also using GEO DNS and I want my europe customers who are not using co.uk to be able to reach me with .com and not go to my USA servers. this is the reason I need 2 certificates on my Europe servers. –  edotan Mar 11 '12 at 18:29
add comment

1 Answer

You need to define an IP/certificate. You can only use one certificate per IP. So instead of *:443 in your vhost you should use an IP.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.