How to host multiple SSL websites with a single IP address using a wildcard certificate in an IBM Domino server

Question

I am using Domino 9.0.1 FP5. I am planning on hosting multiple websites, all of which will be accessed using SSL. I want to use one IP address for all the sites. I will be obtaining a wildcard certificate for the domain so each website will have the same domain but a different sub domain.

Example:

site1.example.com
site2.example.com

In Domino Administrator I am creating Internet Site documents for each site. The documentation states that you must specify the IP address in the "Host names or addresses mapped to this site" field when using SSL.

I understand the reasoning behind this - the server does not know the host domain until it can decrypt the http header but in my case since I am planning on using a wildcard certificate I want to be able to tell the server to use this certificate regardless of the host name. Is there any way to do this?

Answer 1

From the technotes :

If you enter the same IP address in more than one Web Site document, however, only the first one is used for SSL connections no matter which host name is entered in the Web browser.

So apparently what you want to do isn't supported natively. But it is simple enough to generate a self signed wildcard certificate and test, before you buy one.

Answer 2

As you want to use a wildcard certificate it simply does not matter, where you put your ssl certificate, domino will always use the first one found. Just put your wildcard certificate in the default document for the domain, and it will use the kyr- file that is configured there for all websites and ignore the settings for the other site documents. I did this in the past and it was not a problem as long as the kry- file could be found. To be 100% sure, just put the same kyr- file in all your internet- sites and put the ip- address only in one of the documents.

Edit: By the way: Here in Germany you can get a 3 year wildcard certificate for as small as 300€ ... even if it would not work in your special scenario, you can use this for so many services / sites / jobs, that it is almost always worth buying one...

Answer 3

Unfortunately, the only way I've found to do this is to decrypt traffic prior to it hitting the Domino server, through haproxy, nginx, or anything like that.

After decrypting, send the traffic on to Domino as HTTP and it will pick the correct site based on the host header.

There are actually performance benefits in doing this as well, as Domino is not very efficient at SSL/TLS, so response times should improve slightly.