Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

i have multiple domains i'm using ssl for on one apache install. i know i need to put each domain on a separate IP externally. does the same apply to the IPs behind the NAT?

meaning, i have one domain on a hypothetical external IP: 1.2.3.4, another on 1.2.3.5 (these are made up IPs, obviously)

internally these IPs both point to 192.168.1.5. does it have to be a 1:1 mapping in that 1.2.3.4 domain will point to 192.168.1.5 and the 1.2.3.5 IP has to point to say, 192.168.1.6? can they both point to 192.168.1.5 and still work?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

You can use the same internal ip, so long as you use a different port. Apache needs to know which SSL cert/key to use for the connection - and since the domain name in the request is encrypted, it can't use that. The only thing it has to go on is ip:port, so at least one of these must be unique.

share|improve this answer

I believe the answer is yes, the IP address behind the NAT must be unique per SSL cert.

SSL is a transport-level encryption, it is set up before the client makes its request. So the server doesn't know in advance which website the client is going to ask for.

share|improve this answer
    
You're correct. In other words, the server knows which SSL cert to use based on the IP address. So you can't have multiple SSL certs on 192.168.1.5 –  Josh Oct 14 '09 at 16:22
2  
There are couple of ways to do that: one is to terminate the SSL on a public ip and use non-ssl connection to the real web server backend, another one is redirect the different public ips to different ports listening on the same internal ip. –  Istvan Oct 14 '09 at 17:15

you can use the same internal ip, because you have to see the TCP workflow in this case. You client is connecting to the external IP0 which has DOMAIN0 name. The SSL key is for DOMAIN0. This TCP session is going to the IP0 and even tho there is a redirect to internal ip the client will see the external one and will be happy.

share|improve this answer
1  
The problem is on the server end - it needs to differentiate among virtual hosts. Your solution would work if the SSL sessions were being terminated at an SSL accelerator that forwarded the requests in the clear to an Apache backend. –  MikeyB Oct 14 '09 at 17:25
1  
This is exactly what Nginx does using simple http backends. But becase you no clue about this just press the minus flag :) –  Istvan Oct 17 '09 at 10:19

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.