1

I'd like to know if it's possible to have two Nginx virtual hosts sitting on the same v4 IP address. I know there exist SNI but I have two basic (no SAN, no wildcard) SSL certificates from two different Certificate Authorities to make live together on one IP address.

Basically, is it enough to setup two conf files (one per virtual host) each pointing to its own KEY and CRT? Or are there other issues?

I'd try it the solution by myself if I could but CAs want money for certificates and I'd rather order the second certificate only if I am fairly sure I can make it work. N.B. I won't buy the second certificate from the first CA, their support has been abysmal and I want to leave them.

1

Certificates from different CAs is a non-issue as long as the clients trust these CAs.

Serving multiple sites with different certificates on the same IP, regardless which CAs have signed the certificates, is what has some limitations in terms of compatibility.

Supporting multiple certificates on one IP, at all, requires support for a TLS extension called Server Name Indication (SNI) on both server and client side. This is not a problem if dealing with modern browsers but may be a problem if you have to deal with legacy client software.

The Wikipedia article on SNI has a non-exhaustive list of incompatible software with highlights such as Internet Explorer on Windows XP, the default browser in Android 2.x, Java before 1.7, etc.

1
  • Thank you. Since I have no legacy support constraints and my nginx -V clearly says TLS SNI support enabled then I should be set! – Dario Fumagalli Mar 6 '15 at 9:18
0

The only issue is client compatibility, some very old browser/OS combination will not work, notably Windows XP/IE8. Everything else (Chrome, Opera, Firefox, etc.) on Windows XP will work.

You do not need to buy anything, sign one of the certificates (or all of them) yourself. Signing CA does not matter on the server side, only on the client, and if you import your CA into the browser it will behave exactly as if they were signed by the paid CA.

2
  • Hello, I need the certificates because the websites are open to the public. I had them self signed before I went public, but now I need everybody to access the websites without issues. I don't cater to Win XP. One website is already available with CA certificate but I need to add a second, with a certificate coming from another CA. – Dario Fumagalli Mar 5 '15 at 16:07
  • then you should be OK, SNI has been around for a decade – Aleksandar Ivanisevic Mar 6 '15 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.