1

I am running CentOS running on a VPS. I read some guides on having multiple SSL certificates on the same system, but I can not get the basics to work.

The guide I got that makes the most sense to me is the doing the following. In CentOS I can make virtual NIC's. So I made 2 virtual NIC's to start with. 192.168.10.1, 192.168.10.2.

Now I work in ISP manager Pro, so this is listening on my primary ip 1.1.1.1

For each website I have them listening on 192.168.10.1:80, 192.168.10.1:443

In the hosts file I made the following 2 entries

192.168.10.1 1st.com 192.168.10.2 2nd.com

Now the strange thing is that when I browser to 1st.com I do not get the website located at 192.168.10.1, I get the website located at my prim IP 1.1.1.1

Should I do something like forwarding or routing for this setup to work?

And the basic question: Will this setup even work? Are the SSL certificates based on the IP adress, or are the based on the host name, 1st.com and 2nd.com.

Recource: Host multiple SSL sites on a single network card with IP aliasing

3 Answers 3

1

Normally, there is one certificate at a time per IP address, because the server commits to the certificate during the initial handshake (before it sees the HTTP Host header). But Server Name Indication (SNI) changes this, by letting the client send the Host of the server during the TLS handshake.

I don't think you're quite on the right track. Assuming you want your two sites to be publically accessible, at some point you'll have to specify (through DNS), that 1st.com and 2nd.com are both at x.x.x.x (a public IP). Then, you need to use SNI to distinguish between them. There is no need for virtual NICs or local IPs.

3
  • "Then, you need to use SNI to distinguish between them". Is this not even possible with routes? May 1, 2010 at 3:07
  • There is a very good Apache document which describes SNI here: wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI Matthew's right, you can't achieve what you want with simple IP routing because you will always hit the problem that a single public IP address will be resolving to two domains. May 1, 2010 at 10:48
  • @Saif, you need SNI unless you have more than one public IP. May 2, 2010 at 23:59
0

What you want to do is possible - it's how I run something like 30 SSL-enabled sites on a single server.

If you want to do it without using SNI (which most Win XP browsers don't support AFAIK), you'll need two public IP addresses - 1.1.1.2 and 1.1.1.3 say. Then depending on what your hosting provider supports, you could do either of the following:

  1. Configure those public IP addresses on your 2 virtual NICs - e.g. eth0:1 is 1.1.1.2, eth0:2 is 1.1.1.3. Then configure the web server(s) appropriately, and ensure that the DNS entries for 1st.com and 2nd.com point to those public IP addresses.
  2. Leave the private addresses on your virtual NICs, and get Network Address Translation set up between 1.1.1.2 and 192.168.10.2, and between 1.1.1.3 and 192.168.10.3, and ensure that the DNS entries for 1st.com and 2nd.com point to those public IP addresses.

When you say you've added those entries to "the hosts file", is that the hosts file on your server, or on the desktop PC that you're browsing from? What are the DNS entries associated with 1st.com and 2nd.com? If they're both pointing to the 1.1.1.1 IP address in DNS, that might explain why you end up at the ISP Manager site when you browse to https://1st.com. I'd also check what IP addresses ISP manager is configured to listen on - it might just be grabbing ports 80 and 443 on all available IP addresses on the server.

2
  • Thank you for the response. If I understand your solution correct you say you run multiple SSL keys on the same server. I know that is possible with multiple IP's. But is it also possible to use just 1 IP. I have to pay my provider for every new IP I request, is there no way around this? May 5, 2010 at 7:16
  • The only ways around it are one certificate with multiple Subject Alternate Names (but you'd have to repurchase the certificate each time you added a new site), or using SNI.
    – meulop
    May 5, 2010 at 11:52
0

Without SNI, you can only have one certificate per public IP address. Until SNI is fully supported, your best option is to use a single Unified Communications certificate that includes all the hostnames that you need to secure.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .