Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a little private webserver where I have several virtualhosts. I know that it's impossible to assign a certificate to each individual virtualhost, because the server finds out which virtualhost was requested only AFTER the SSL connection has been established. But is it possible to have a single SSL certificate which lists several domains? Or at least a wildcard domain, like *.example.com. If yes, what Linux commands do I have to write to make such a self-signed certificate?

Added: To clarify - I have just one IP address for all the virtual hosts.

share|improve this question

4 Answers 4

To expand on AlberT's answer:

http://blog.loftninjas.org/2008/11/11/configuring-ssl-requests-with-subjectaltname-with-openssl/

You don't have to use wildcard domains. You can just list all hostnames you need as subject alt names and it should work on all major browsers.

share|improve this answer
1  
Unfortunately that link is dead. The WayBackMachine still has a record of that blogposting. –  Jpsy Oct 7 '13 at 19:47

Create a certificate with domain.com as the CN and *.domain.com in the subjectAltName:dNSName names field - that works.

In openssl, add this to the extensions:

subjectAltName          = DNS:*.domain.com
share|improve this answer
    
How does one do that without using a CSR? –  Walf Feb 23 '12 at 1:56

I guess, this might help you : http://adam.shand.net/archives/2007/the_easy_way_to_generate_openssl_csrs_with_subjectaltnames/

What you have to do is to set up subjectAltNames with all the domain you want to use.

share|improve this answer

First of all - you can assign a certificate for each individual virtual host - the key is to make different private (and external/public, if you want to make it world accessible) ip address for each virtualhost.

But then yes - alternatively, you can assign a wildcard certificate if your virtual hosts is simply *.example.com.

For the command - there are many results from google - i'll just put an example from here:

http://www.justinsamuel.com/2006/03/11/howto-create-a-self-signed-wildcard-ssl-certificate/

And make sure you enter *.example.com for the Common Name.

share|improve this answer
1  
That's the point - I have just one IP address. Guess I was unclear on that. –  Vilx- Oct 13 '09 at 12:52
    
@coolwater - Good advice if I'm setting up a production server at work, which would be in our own /16 block. For those of us with small business connections that only give five static IPs, not really an option. I've dealt with this by limiting myself to five SSL Vhosts, one per IP. –  Jason Antman Oct 13 '09 at 22:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.