Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a dedicated server which is pointed to the domain I bought ssl sertificates for my domain which cost $10 so I bought ssl certificates for all sub domains, since wildcard certificate is too costly.

When i restart apache, the is getting set to the ssl certificate on it shows an "untrusted warning" that this certificate is valid for some other domain. I checked the certificate itself, and it shows a domain of, that is the certificicate of

How can I get multiple SSL vhosts set up?

My config file is

<VirtualHost *:443>
        DocumentRoot /var/htm2/
        SSLEngine on
        SSLCertificateFile /usr/server.crt
        SSLCertificateKeyFile /usr/server.key </VirtualHost>

 <VirtualHost *:443>
        DocumentRoot /var/htm/
        SSLEngine on
        SSLCertificateFile /usr/l/server.crt
        SSLCertificateKeyFile /usr/l/server.key  </VirtualHost>

the problem is i am having a single dedicated ip : 141.XX.XX.X but when i go to in chrome or firefox latest , the certificate works , but when i go to . it shows a certificate untrustness , and says conform trust of certificate as this certificate is for another domain , i viewed the certificate and saw it as certificate of

i want both of the sites to be browsed like


with out any port or any thing ... what settings should i alter in the above config to attain this , what is the trouble which cause to show certificate of x1..domain and also how can i redirect

http:\ to https:\ with out using htaccess , if by htaccess then how ?

also how to redirect

share|improve this question
You forgot to ask a question. –  David Schwartz Oct 12 '12 at 12:38
@DavidSchwartz After editing for spelling and formatting, I added the question that you and I both answered :) –  Alex Oct 12 '12 at 12:58
Do you get the content for x1 or x2 after you click through the cert warning? Does your client browser support SNI? Provide the output of apachectl -S; do you have NameVirtualHost *:80 configured? –  Shane Madden Oct 13 '12 at 20:35

2 Answers 2

SNI isn't supported by almost half of current Internet browsers. So the server has to decide which certificate to send to the client knowing only the port the client connected to. If you need to serve two different certificates, probably your best choice is to use two different ports. Alternatively, you can use a service that lets you put both names in the same certificate. (StartSSL, for example, lets you put any hosts for any domains you validate in any certificates you issue in any combination.)

share|improve this answer
It's mostly just browsers on the Microsoft crypto APIs under XP - that's well under half these days, isn't it? –  Shane Madden Oct 13 '12 at 20:37
Last I checked (about four months ago) it was just under half. (Browsers that didn't support SNI, mostly IE under XP, but others too.) –  David Schwartz Oct 13 '12 at 21:52

You need to either bind your vhosts to a different IP address or bind to a different port.

The problem is that you can't have two SSL hosts on the same IP+PORT because the hostname can't be determined as it is part of the encrypted content. So it picks one of the vhosts and delivers that (typically the first vhost)

As David Schwartz said, you can also put all the names in a single certificate. In x509 parlance, that is the SubjectAlternateName field.

share|improve this answer
can i merge the two different ssl certificates into a single one ? , then how ? –  cc4re Oct 14 '12 at 5:59
SubjetAlternateName is part of the certificate signing request (CSR). You would have to generate a new CSR with both names in it. –  Alex Oct 15 '12 at 17:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.