2

So I have been trying to figure out how to setup multiple ssl sites using only 1 ip. The issue that I am seeing is when you have multiple vhosts using ssl the first site that has ssl is the one that is used for the rest of the sites.

I am wondering if i would be able to setup all vhosts to use a different port (444, 445) for the ssl connection and then redirect each site from 443 to whatever port I have defined for the to use ssl on.

ie.

domain1.com:443 redirect to domain1:444

domain2.com:443 redirect to domain2:445

Would this allow apache to use each domains ssl cert properly? Or am I just plain old wrong.

Improve this question
3
  • Many people use a reverse proxy/load balancing software like pound (apsis.ch) for this (and other) purpose.
    – 3molo
    Commented Nov 1, 2010 at 19:50
  • @3molo, exactly how does a reverse proxy or load balancer accomplish what he's requesting???
    – Chris S
    Commented Nov 2, 2010 at 1:28
  • of course you're right, I had it all mixed up.
    – 3molo
    Commented Nov 2, 2010 at 5:16

2 Answers 2

Reset to default
2

It is possible to have more than one SSL certificate on a given IP address, even without SNI. As long as you have your web server listening on a different port (e.g. 444, 445, etc.) for each of your different domains, each domain can each have its own SSL cert while served from the same IP address. (The cert is uniquely selected by the combination of IP address and port number, before the encryption handshake occurs.)

Here is the (small) fly in the ointment: If the initial connection is made to the default HTTPS port (443), the browser will encounter a server certificate error before the redirect (to port 444 or 445 or ...) can happen. This will scare away most regular people attempting to reach your sites.

One way around this is to tell your users to browse to your sites via regular HTTP (i.e. to port 80), as you probably would anyway. Then you simply do your rewrite/redirects from there, i.e.

domain1.com:80 -> domain1.com:444
domain2.com:80 -> domain2.com:445
...
Improve this answer
4
  • 1
    Note if you use this and anyone ever types in "domain2.com" they'll get a nasty security warning.
    – Chris S
    Commented Nov 2, 2010 at 1:28
  • Yep, that was the fly in the ointment I mentioned.
    – Steven Monday
    Commented Nov 2, 2010 at 1:49
  • Another solution is to use a single SSL certificate that contains all the domains that need to be secured (a SAN certificate). You can then have all the sites use port 443 without receiving any warnings.
    – Robert
    Commented Nov 2, 2010 at 15:27
  • I think we are either going to go with multiple IP's or a UC cert. But accepting your answer :)
    – jwilson11
    Commented Nov 2, 2010 at 18:23
0

You can only use 1 certificate per IP address. So you will need a certificate with all the possible domain names (or a wildcard for them) on a single cert.

You can't use alternate ports unless you're going to tell your clients to use them; and that generally doesn't go over well at all.

Improve this answer
3
  • Would using a rewrite rule (443->444) on the server work? Instead of just telling the client to use 444 instead of 443.
    – jwilson11
    Commented Nov 1, 2010 at 19:59
  • The issue is that unless the browser and server support SNI, there's no way for the server to tell what the content of the request is and perform a rewrite, because the request in encrypted. The server chooses the certificate for decryption based on the IP, prior to being able to perform any rewrite/redirect.
    – phoebus
    Commented Nov 1, 2010 at 20:28
  • @Jwilson11, no because the connection negotiations SSL security before the HTTP request comes through. So the client will start the SSL negotiation and (usually) fail because the SSL Cert will not match what the user typed in. Your only options are to get a single cert for all the domains, use different IPs for different certs, or use non-standard port and tell your clients or use a redirect as Steven mentions.
    – Chris S
    Commented Nov 2, 2010 at 1:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .