3

I've inherited a lighttpd server that I have really very little knowledge of how to manage. I'm currently trying to install an SSL for one domain on that server.

I've been looking at this bit in the conf:

$SERVER["socket'] == ":443" {
  ssl.engine = "enable"
  ssl.pemfile = "/etc/ssl/private/domain.com.pem"
  ssl.ca-file = "/etc/ssl/private/chain.cer"
}

As I understand, this applies to the entire server, not just the domain I wish to secure. Using this in the config gives me "site not available" for all sites on the server (lighttpd won't restart correctly).

I've seen two suggestions in regards to handling SSL on a single vhost, one indicates that you need to assign a unique IP to the vhost, and then use that before the :443. This requires me purchasing an additional IP. I don't want to do this without confirmation from someone lighttpd minded that it will work.

The other suggestion I've seen here: https://www.digitalocean.com/community/tutorials/how-to-set-up-multiple-ssl-certificates-on-one-ip-with-lighttpd indicates that you can do it with a single IP, but it seems to say that you need a "default" PEM for the server. What I don't understand there is what domain that default PEM should be for?

If anyone knows what my config should look like to handle SSL for ONE SPECIFIC VHOST and what steps I need to take, I would appreciate the help!

1 Answer 1

0

So for now it looks like I'm ok just to use this domain's SSL as the default for the whole server, since this site is currently the only site using SSL. Doing some reading into SNI, I will likely have to move to static IPs per domain if I need to install another SSL on this site, to ensure compatibility with older Android devices.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .