0

I have an Ubuntu 11.04 Server with multiple Virtual Hosts running on a shared IP. Is it possible to have two (different) SSL certificates for each site?

I remember hearing something about you only being able have one SSL certificate per IP.

Improve this question
1

2 Answers 2

Reset to default
6

You can host multiple SSL based sites. You have to use SNI, and not all browsers support SNI, so you can have issues with an older web browser. Most modern browsers should support it. It's described in RFC-6066

This HOW-TO can walk you though how to do it.

Improve this answer
2
  • SNI works in all modern browsers and operating systems. The problem is, as so often, Windows XP, where no version of IE supports SNI. Only Firefox does in XP. Also problematic are certain libraries such as JSSE (Java) and Qt. Wikipedia has a list.
    – daff
    Sep 3, 2011 at 6:04
  • Correct, however I know several corporations and government groups that are still on windows XP. I don't know is IE6 can handle SNI.
    – Squidly
    Sep 11, 2011 at 4:11
-2

You are correct. You can only associate an SSL certificate per IP address. SSL certificates (sadly) do not work with virtual hosting.

Improve this answer
7
  • That's what I thought. I have vague memories of being stuck up at 4AM trying to figure it out -- to no avail. Thanks for confirming.
    – Trent Scott
    Sep 3, 2011 at 1:55
  • Do you mean named-based virtual hosting (which is what the poster is apparently referring to)? SSL Certificates will work with IP-based sites just fine as long as there is a different certificate per IP. :D
    – Rilindo
    Sep 3, 2011 at 2:27
  • 2
    -1 for Incorrect answer.
    – Squidly
    Sep 3, 2011 at 4:11
  • 2
    This answer is incorrect. Server Name Indication solves this exact problem and has been around for a while now. Apache as of 2.2.14 has SNI activated by default, if I recall correctly. See Wikipedia on SNI.
    – daff
    Sep 3, 2011 at 6:06
  • 2
    Even without SNI, name based vhosts under a wildcard or subject alternate name certificate work just fine - which is specifically not what the question asked for, but it's another problem with this answer. @Trenton, this answer is not correct.
    – Shane Madden
    Sep 3, 2011 at 8:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.