Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know that you need multiple IP addresses if you want to use multiple SSL certificate with Apache. Assuming I have 2 IPs on my VPS (let's name them 1.1.1.1 and 2.2.2.2), I was wondering if the following setup is possible:

domain1.com would be on 1.1.1.1 and use a signed SSL certificate (from a provider like Verisign)

domain2.com, domain3.com, .. would be on 2.2.2.2 and share a self-signed certificate...

In other words, one domain needs its own signed certificate because it has to process financial transaction etc..so it will be "alone" on the first IP.. Other domain(s) only need a self signed certificate since it's only for their admin areas and I don't mind the warning(s), so they would all be on the second IP

Is such a setup possible? If so, any examples of what the virtual host config would look like?

Any help would be appreciated!

share|improve this question

2 Answers 2

It's pretty simple to have a different cert for a different IP address; just put the SSL cert stuff inside the virtualhosts for each.

Having multiple virtualhosts on a single IP won't really work at this point. There's some technologies that might work for that down the road, but the user population isn't running browsers that can do it. The user agent (browser) establishes an SSL connection and verifies the SSL connection before telling the server what host it's connecting to. You really need a separate IP for each SSL virtualhost.

<VirtualHost 1.1.1.1:443>
        ServerName foo
        DocumentRoot /var/www/foo
        CustomLog /var/log/httpd/foo.ssl_access_log combined
        ErrorLog /var/log/httpd/foo.ssl_error_log

        SSLEngine on
        SSLProtocol all -SSLv2
        SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
        SSLCertificateFile /etc/pki/tls/certs/foo.crt
        SSLCertificateKeyFile /etc/pki/tls/private/foo.key
</VirtualHost>

<VirtualHost 2.2.2.2:443>
        ServerName bar
        DocumentRoot /var/www/bar
        CustomLog /var/log/httpd/bar.ssl_access_log combined
        ErrorLog /var/log/httpd/bar.ssl_error_log

        SSLEngine on
        SSLProtocol all -SSLv2
        SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
        SSLCertificateFile /etc/pki/tls/certs/bar.crt
        SSLCertificateKeyFile /etc/pki/tls/private/bar.key
</VirtualHost>
share|improve this answer
    
ok so if I understand well (still a bit new at this server stuff, sorry), those would be 2 IP-Based virtual hosts... from there, how do I set up my domains? (I need multiple domain names to point to 2.2.2.2)... do I need additional name based virtual hosts on top of these 2? I guess I'm missing something here hehe... –  user24994 Nov 4 '09 at 19:09
    
updated answer to address that part of question... –  freiheit Nov 4 '09 at 19:23
    
Basically: if you want one IP address to host multiple SSL hosts (domains), it simply won't work with enough clients to be worth doing right now. Basically people running Windows XP can't use the multiple-hosts-on-one-IP-SSL stuff, but on Vista or Windows 7 they can. It'll be several years before it's practical; since people are still installing XP on new systems today and those might be running it for 5 or more years. –  freiheit Nov 4 '09 at 21:04
    
Actually, I think I wasn't clear enough: I have 2 IPs on my VPS... I wanted to have 1 IP used for ONE domain,with a commercial certificate, the other IP to use for a couple of domains, sharing a self-signed certificate... So basically, 2 different SSL configuration, 1 on each IP... I was able to do it using IP-based virtual hosts for both IP, each with different SSL configs. One of them (the one with multiple domain) using NameVirtualHosts...the other having only 1 virtual host... –  user24994 Nov 5 '09 at 21:32

As freiheit already mentioned, there is a new way, to setup vhosts with different ssl
certificates on a single ip. But the support from the client-side is still incomplete.

Its called SNI (Server Name Indication) and it's worth a read.

Best regards...

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.