3

I'm using ubuntu 9.10, apache2 and php5. Is it a good idea to host multiple SSL sites on one IP address but on different ports? If yes, what ports should I be using?

2 Answers 2

4

Use whatever port you like but know that this can cause some confusion for users. If you want to do this adjust your /etc/apache2/ports.conf file and add something like this (ports are part of the cert):

<IfModule mod_ssl.c>
    # SSL name based virtual hosts are not yet supported, therefore no
    # NameVirtualHost statement here
    NameVirtualHost *:443
    Listen 443
    NameVirtualHost *:442
    Listen 442
</IfModule>

Then edit your /etc/apache2/sites-enabled/somefile so it has something like this:

<VirtualHost *:443>
   ServerName  blah1.site.com
   more stuff here
</VirtualHost>

<VirtualHost *:442>
   ServerName blah2.site.com
   more stuff here
</VirtualHost>

You may be able to use a mod_rewrite to conceal the port if that's an issue.

1
  • @johnlai2004 - if you need to use multiple IP addresses and you want to avoid using multiple ports (ie 443, 442, etc) consider installing esxi server and running multiple os builds. That way you don't have to have two or more physical servers. That being said, I've been burnt by virtual solutions before (I'm currently using them in some cases). But this would be a good case for that environment. That's how companies like Slicehost pull this off (they use Xenserver). You'd definitely be able to avoid ssl errors in IE on XP with that.
    – Patrick R
    Feb 5, 2010 at 12:31
1

I'd say it's not a good idea as there are a number of firewalls set up as port filter that intentionally let 80 (http) and 443 (https) pass and block others. Or they police what protocols are talked on other open ports. So you'll loose parts of your audience this way.

Another source for annoyance is that your users must remember to enter the correct port number if they don't want to get a certificate error. That is: If https://www.example.com:444/ is correct, https://www.example.com:445/ will trigger an error, if port 445 uses the certificate for another site.

I've never tried this, but I believe that the port number even has to be part of your certificate.

Depending on your usecase you might be better off with a wildcard certificate that certifies *.example.com and you can operate any number of subdomains with that certificate. If you're scaling out you can use this on as many hosts as you like, as long as they are reached as https://anysubdomain.example.com/.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .