4

I am hosting multiple domains on a single AWS instance. The domains all share the same underlying codebase, but we provide "white label" services on various domains. Each of the domains (foo.com, bar.com, baz.com) will have their own SSL certificates.

I've done some research that seems conflicting (and mostly out of date) about whether I need a dedicated IP address for each SSL certificate, or not.

Do I need a dedicated IP address for each SSL certificate?

Improve this question

2 Answers 2

Reset to default
11

If you can safely limit the supported clients of your service to systems supporting Server Name Indication, having only one IP address should be sufficient.

See this article for a list of supported clients.

Improve this answer
2
  • Unfortunately we can't safely limit the supported clients, because its a SaaS app. Based on our analytics it appears that everyone is currently supported, who who knows going forward that we don't get some on Windows XP and IE? Would it be an option to use a Multidomain SSL certificate, and just keep adding domains to that cert every time we need to?
    – JonoB
    Jul 22, 2015 at 11:24
  • Well, I don't know about your customers, but I would simply declare WinXP as unsupported in your TOS. It is out of service for 15 months now and this shouldn't hold you back. If that's impossible, look closer into the solution proposed by Alpha01 (or simply add a surcharge for XP support with a dedicated IP).
    – Sven
    Jul 22, 2015 at 11:32
0

This might require some web server reconfiguration. But you can configure your https virtual hosts to use different local private ip addresses and have a reverse proxy ssl server like Nginx to handle all incoming https connections.

This is how I overcame this exact limitation. https://www.rubysecurity.org/nginx_reverse_ssl-proxy

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .