Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

i have multiple domains i'm using ssl for on one apache install. i know i need to put each domain on a separate IP externally. does the same apply to the IPs behind the NAT?

meaning, i have one domain on a hypothetical external IP:, another on (these are made up IPs, obviously)

internally these IPs both point to does it have to be a 1:1 mapping in that domain will point to and the IP has to point to say, can they both point to and still work?

share|improve this question
up vote 4 down vote accepted

You can use the same internal ip, so long as you use a different port. Apache needs to know which SSL cert/key to use for the connection - and since the domain name in the request is encrypted, it can't use that. The only thing it has to go on is ip:port, so at least one of these must be unique.

share|improve this answer

I believe the answer is yes, the IP address behind the NAT must be unique per SSL cert.

SSL is a transport-level encryption, it is set up before the client makes its request. So the server doesn't know in advance which website the client is going to ask for.

share|improve this answer
You're correct. In other words, the server knows which SSL cert to use based on the IP address. So you can't have multiple SSL certs on – Josh Oct 14 '09 at 16:22
There are couple of ways to do that: one is to terminate the SSL on a public ip and use non-ssl connection to the real web server backend, another one is redirect the different public ips to different ports listening on the same internal ip. – Istvan Oct 14 '09 at 17:15

On you can read the following:

Note that if you have a wildcard SSL certificate, or a certificate that has multiple hostnames on it using subjectAltName fields, you can use SSL on name-based virtual hosts without further workarounds.

SAN certificates can not only have multiple hosts on one domain, but also multiple domains in them.

share|improve this answer

you can use the same internal ip, because you have to see the TCP workflow in this case. You client is connecting to the external IP0 which has DOMAIN0 name. The SSL key is for DOMAIN0. This TCP session is going to the IP0 and even tho there is a redirect to internal ip the client will see the external one and will be happy.

share|improve this answer
The problem is on the server end - it needs to differentiate among virtual hosts. Your solution would work if the SSL sessions were being terminated at an SSL accelerator that forwarded the requests in the clear to an Apache backend. – MikeyB Oct 14 '09 at 17:25
This is exactly what Nginx does using simple http backends. But becase you no clue about this just press the minus flag :) – Istvan Oct 17 '09 at 10:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.