Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have mail server. There are may domains hosted on it. I am deploying ssl certificate on it. I want that when user access there mail account using https browser should show that certificate is trusted(In Chrome it should show green https not red in address bar).

What I found is:
I have to create CA certificate first.

openssl genrsa -out rootCA.key 2048
openssl req -x509 -new -nodes -key rootCA.key -days 1024 -out rootCA.pem

Copy it on user's workstation.

Then create key file using following command.

openssl genrsa -out device.key 2048

and csr file using that key file using command:

openssl req -new -key device.key -out device.csr

Once that’s done, sign the CSR, which requires the CA root key.

openssl x509 -req -in device.csr -CA rootCA.pem -CAkey rootCA.key -CAcreateserial -out device.crt -days 500

Using above method I can create certificate for single domain only.
How to create it for multiple domains.

share|improve this question
The command following "csr file using that key file using command" may be wrong. – MadHatter Feb 12 '14 at 11:28
up vote 1 down vote accepted

NameBased SSL VirtualHosts

This problem occurs if you use multiple Name Based Virtual Hosts and SSL on a single IP-address. The Web-server does not know the name of the requested host until the SSL handshake is done, because the HTTP request headers are part of the encrypted content.

In reality, a Web-server like Apache will allow you to configure name-based SSL virtual hosts, but it will always use the configuration from the first-listed virtual host (on the selected IP address and port) to setup the encryption layer. See for more information.

You can use one certificate for multiple virtual hosts if they are on the same domain using a Wildcard certificate like *, which will work for and

NameBased SSL VirtualHosts with SNI

The solution is an extension to the SSL protocol called Server Name Indication (SNI), which allows the client to include the requested hostname in the first message of its SSL handshake. See for more information.

Apache needs to be built with OpenSSL (with the TLS Extensions option enable-tlsext enabled; OpenSSL 0.9.8k and later has this enabled by default)

To check if your Apache installation supports SNI, take the following steps:

Enable NameVirtualHost for SSL in /etc/apache2/ports.conf:

<IfModule mod_ssl.c>
  NameVirtualHost *:443
  Listen 443

Create two SSL VirtualHosts in /etc/apache2/sites-available/default-ssl

<VirtualHost *:443>
  DocumentRoot /var/www/example1
  SSLEngine on
  SSLCertificateFile    /etc/apache2/
  SSLCertificateKeyFile /etc/apache2/

<VirtualHost *:443>
  DocumentRoot /var/www/example2
  SSLEngine on
  SSLCertificateFile    /etc/apache2/
  SSLCertificateKeyFile /etc/apache2/

Enable mod_ssl:

# a2enmod ssl

Enable the SSL site:

# a2ensite default-ssl

Restart Apache:

# /etc/init.d/apache2 restart

Now if you tail the Apache error log and you see the following message, it means SNI is builtin.

[warn] Init: Name-based SSL virtual hosts only work for clients with \
       TLS server name indication support (RFC 4366)

Otherwise you will see an Apache startup a message like You should not use name-based virtual hosts in conjunction with SSL!!

Now if you signed your two certificates and with your CA certificate, added it to your Browser's trusted list and your Browser supports SNI, you should be able to access and without any complaints from the your Browser.

NameBased SSL VirtualHosts with GnuTLS

GnuTLS is an LGPL-licensed implementation of Transport Layer Security, the successor to SSL. With GnuTLS you can create a single certificate valid for multiple domains and wildcard domains, like this:

DNS Name:
DNS Name: *
DNS Name:
DNS Name: *
DNS Name:
DNS Name: *

See for a detailed guide on using GnuTLS.

share|improve this answer
Thanks! Its really help full.But is there any way to do this with OpenSSL 1.0.0-fips. – Yugendra Feb 14 '14 at 6:47

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.