Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I would like to implement dynamic sub domains for a site that has to be secure (ssl).

I can setup a call to a dns api to add the A name for the subdomain, but was wondering if anyone can recommend an approach for adding the ssl information (based on a wildcard ssl certificate)?

All the subdomains would be for the name main domain.

eg.

https://abc.domain.com

https://def.domain.com

https://ghi.domain.com

The webserver is apache serving php.

share|improve this question

5 Answers 5

The main problem is that before the underlying http request is sent the browser first has to take the SSL hurdle. In this phase the hostname is checked against the certificate that is used for the encryption. So before the webserver is told about the name of the requested site, the browser of the user is already seeing complaints about the hostname being different in the certificate.

The successor of SSL is called TLS and that does have a feature to allow what you want: Server Name Indication (SNI).

Read here for more information on TLS and SNI on these Wikipedia pages:

Here is a pretty good demo site:

share|improve this answer

You cannot have more than one domain name per IP on HTTPS. The 'Host' header is not sent, so the server doesn't know the domain name it's serving HTTPS content for - just the IP address.

edit: A wildcard certificate will allow serving of the same content from the same IP to multiple subdomains, but my reading of your question is that you'd like different content served for the different subdomains.

share|improve this answer
    
No thats not quite right. With a wildcard ssl certificate you can have multiple subdomains served from the one IP. –  ae. Jul 30 '09 at 13:40
    
That doesn't permit you to serve different content to different subdomains, though. It just permits the same content at multiple subdomain URLs. –  ceejayoz Jul 30 '09 at 14:27

You can have a wildcard certificate issued for CN=*.domain.com

share|improve this answer

You can set up a wildcard dns entry (or multiple single entries) so that *.domain.com goes to the single ip address, then get a wildcard SSL certificate for *.domain.com

Then on the server, all 3 urls would reach the same website where you would need to handle in serverside script which site to show based on the hostname used.

share|improve this answer

Check out Subject Alternative Name support from your Certificate Provider.

Some offer it, others don't (Verisign does but you have to go through their PKI Sales channel!).

Digicert does:

http://www.digicert.com/subject-alternative-name.htm

Cheers

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.