Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a dedicated server which is pointed to the domain www.domain1.com. I bought ssl sertificates for my domain x1.domain1.com which cost $10 so I bought ssl certificates for all sub domains, since wildcard certificate is too costly.

When i restart apache, the x1.domain1.com is getting set to the ssl certificate on x2.domain1.com it shows an "untrusted warning" that this certificate is valid for some other domain. I checked the certificate itself, and it shows a domain of x1.domain1.com, that is the certificicate of x1.domain1.com

How can I get multiple SSL vhosts set up?

My config file is

<VirtualHost *:443>
        ServerAdmin admin1@server1.com
        DocumentRoot /var/htm2/
        ServerName x1.domain1.com
        SSLEngine on
        SSLCertificateFile /usr/server.crt
        SSLCertificateKeyFile /usr/server.key </VirtualHost>



 <VirtualHost *:443>
        ServerAdmin admin2@server1.com
        DocumentRoot /var/htm/
        ServerName x2.domain1.com
        SSLEngine on
        SSLCertificateFile /usr/l/server.crt
        SSLCertificateKeyFile /usr/l/server.key  </VirtualHost>

the problem is i am having a single dedicated ip : 141.XX.XX.X but when i go to https://x1.domain1.com in chrome or firefox latest , the certificate works , but when i go to https://x2.domain1.com . it shows a certificate untrustness , and says conform trust of certificate as this certificate is for another domain , i viewed the certificate and saw it as certificate of x1.domain1.com

i want both of the sites to be browsed like

https:\\x1.domain1.com
https:\\x2.domain1.com   

with out any port or any thing ... what settings should i alter in the above config to attain this , what is the trouble which cause x2.domain1.com to show certificate of x1..domain and also how can i redirect

http:\x1.domain1.com to https:\x1.domain1.com with out using htaccess , if by htaccess then how ?

also how to redirect

share|improve this question
    
You forgot to ask a question. –  David Schwartz Oct 12 '12 at 12:38
2  
@DavidSchwartz After editing for spelling and formatting, I added the question that you and I both answered :) –  Alex Oct 12 '12 at 12:58
    
Do you get the content for x1 or x2 after you click through the cert warning? Does your client browser support SNI? Provide the output of apachectl -S; do you have NameVirtualHost *:80 configured? –  Shane Madden Oct 13 '12 at 20:35
add comment

2 Answers

SNI isn't supported by almost half of current Internet browsers. So the server has to decide which certificate to send to the client knowing only the port the client connected to. If you need to serve two different certificates, probably your best choice is to use two different ports. Alternatively, you can use a service that lets you put both names in the same certificate. (StartSSL, for example, lets you put any hosts for any domains you validate in any certificates you issue in any combination.)

share|improve this answer
    
It's mostly just browsers on the Microsoft crypto APIs under XP - that's well under half these days, isn't it? –  Shane Madden Oct 13 '12 at 20:37
    
Last I checked (about four months ago) it was just under half. (Browsers that didn't support SNI, mostly IE under XP, but others too.) –  David Schwartz Oct 13 '12 at 21:52
add comment

You need to either bind your vhosts to a different IP address or bind to a different port.

The problem is that you can't have two SSL hosts on the same IP+PORT because the hostname can't be determined as it is part of the encrypted content. So it picks one of the vhosts and delivers that (typically the first vhost) http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

As David Schwartz said, you can also put all the names in a single certificate. In x509 parlance, that is the SubjectAlternateName field.

share|improve this answer
    
can i merge the two different ssl certificates into a single one ? , then how ? –  cc4re Oct 14 '12 at 5:59
    
SubjetAlternateName is part of the certificate signing request (CSR). You would have to generate a new CSR with both names in it. –  Alex Oct 15 '12 at 17:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.