0

We have a SSL offloader (nginx) with different certificates for different machines and subdomains. It encrypts and redirects all the traffic to the corresponding machines. It works OK with all browsers I've tryed (IE10, Firefox, Safari, Chrome), but IE8 says that the certificate is not valid because it is signed for a different machine.

Explanation: We only have one public IP so we have different subdomains all pointing to the SSL offloader machine. And SSL offloader redirects and encrypts the traffic to different machines in the local network depending on the URL the user asks.

The problem is that IE8 takes the first subdomain alphabetically, so if you ask for other than first one, it says the certificate isn't valid because de fqdn doesn't match.

Thanks in advance.

Improve this question

1 Answer 1

Reset to default
4

In order to have multiple certificates on one IP, you must be using SNI (Server Name Indication).

Internet Explorer 8 does not support SNI. Neither does Android 2.x.

If you have to support IE8, you'll need either a single multi-domain certificate (sometimes called UCC) or different IPs per cert.

Improve this answer
3
  • Thanks for the info. So, the only option is to use a wildcard certificate, isn't it?
    – mattinsalto
    Nov 27, 2013 at 16:36
  • 1
    @mattinsalto A wildcard or a subject alternative names certificate.
    – Shane Madden
    Nov 27, 2013 at 17:35
  • 1
    @mattinsalto Or just wait five months; when XP goes out of support you can justifiably tell anyone still using it that it's their problem.
    – Michael Hampton
    Nov 27, 2013 at 17:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .