0

On my server I have this apache config file:

< VirtualHost *:80 >
ServerAdmin xxxx
DocumentRoot /www/a/b/c
< Directory /www/a/b/c > other config data < /Directory>

All the work is done by the application inside /www/a/b/c It accepts all domains that are routed to this apache server and the application detects the domain and serves different content bases on the domain.

Whit this i do not need to reconfigure the apache when new domain is added to to website. Just the user logs to the site registers new domain and fills the cms. Also the adds the domain name in his DNS.

The site can receive subdomains and also different domains.
Example all this domains points to the IP of the server:
domain1.com
domain2.com
maindomain.com
subdomain.maindomain.com

That works fine.

What I need now is for every domain for some pages to have SSL.
I will have certificate files for all domains. (can I have several cert files on one apache and one IP?)

Can I configure the apaceh to read them dynamically in some kind of if statement or I must configure for each domain separate VirtualHost ?

Regards

3 Answers 3

2

Your problem is a little more basic - is this a wildcard certificate? SSL negotiation happens at the TCP layer, so SSL has to be bound to an IP address. If you have two SSL sites with unique certs, then you need two IPs. If you have a wildcard domain cert (*.foo.com) you can bind multiples to one IP.

If you do have a common cert (wildcard) for the domain, then there is a way to do it via some Apache-fu:

http://blog.revolunet.com/index.php/reseau/administration/hosting-multiple-ssl-vhosts-on-a-single-ipportcertificate-with-apache2

Again, that only works when you're using one common cert.

3
  • I have subdomains and wildcart cert will do the work for the subdomains, but I also have different domains on the same IP (same apache) and I need also this domains to be under ssl. Thanks for the link. Jun 22, 2010 at 8:56
  • For part 2, "you can't get there from here" - the SSL cert is presented when the IP connection is made and negotiations are performed. Name Based virtual hosts don't work with SSL if you're using the same port (443) and IP with different domains. This is a core SSL concept.
    – user15590
    Jun 22, 2010 at 9:13
  • Thanks. I fount that there are multi domain ssl certificates. I will see what they are capable of. digicert.com/unified-communications-ssl-tls.htm Jun 22, 2010 at 10:48
2

See http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI The same technique that works for SNI works for Wildcard certs with apache as long as your apache version and openssl version support SNI

Your client applications need to support SNI too.

0

I think there is a way to use NameVirtualHost in apache. When you name the host it has to exactly match the VirtualHost section that it matches to...

Something like <NameVirtualHost staticIP:*443 ..... or something like that.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .