2

I'm setting SSL up for a new server and going off of how I configured it on the previous server. I noticed that I have SSLCertificateFile, SSLCertificateKeyFile, and SSLCertificateChainFile specified in two different places. I have it in my ssl.conf file (which is included from the httpd.conf file), and I also have it inside my <VirtualHost *:443> block inside the httpd.conf file.

Do I need these three settings in both places, or is just one sufficient? Are there any performance implications to one versus the other?

2 Answers 2

1

You don't need those setting in both places. For a single site, it doesn't particularly matter which one you use, and there's no performance difference.

In multi-site configurations, it matters very much. For example, if you have two sites a.example.com and b.example.com, a single wildcard *.example.com certificate defined at the site level would be ideal.

On the other hand, if you have two sites a.example.com and b.contoso.com, you would want to specify those certificates at the virtual host level, since they cannot share the certificates and still be valid.

1
  • But the weird thing is if I don't put it into ssl.conf, I can't get apache to start. I previously thought this error was the problem (Server should be SSL-aware but has no certificate configured [Hint: SSLCertificateFile]) but even after fixing that, apache still wouldn't start.
    – Waynn Lue
    Apr 7, 2015 at 7:08
0

The SSL definition entries can be inside a VirtualHost to give a certificate just for theat VirtualHost. This of course becomes useful when you want to serve more than one site with SSL and they have different certificates.

The config can also have a default SSL Certificate that it uses for any VirtualHost that does not explicitly specify a certificate.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .