2

After doing some research, I haven't found a definitive answer for my question.

I'm currently hosting clients on a VPS that has two IP addresses:

XXX.XX.XXX.XX1
XXX.XX.XXX.XX2

When I purchased this VPS, the second IP was said to be there for me to host my SSL certificate(s).

I am wondering if since all domains point back to the same IP, would I need only one SSL certificate that covers the IP? Or do I need individual SSL certificates that cover each unique domain?

Improve this question
0
5

SSL certificates verify the domain or hostname, not the IP address. However, most web servers and browsers now support Server Name Indication (SNI) and Subject Alternative Name (SAN) which means you don't need a second IP address. For that matter you don't need to buy certificates any more. LetsEncrypt Certbot provides Domain Verification certificates for multiple domains for free.

Improve this answer
3
  • How secure is LetsEncrypt compared to regular SSL? And will I be seen as a less reputable company if I used that instead of regular SSL certificates? – PythonReactor Feb 11 '18 at 19:53
  • They are exactly the same as commercial domain verification certificates. By definition they confirm that you own a domain and encrypt the connection between your server and browser with the same level of encryption. If you require other verification look at commercial extended verification (EV) certificates. – Simon Greenwood Feb 11 '18 at 19:58
  • Thank you, @Simon Greenwood. I think I will end up using them, I have been doing some research on them! – PythonReactor Feb 11 '18 at 23:50
2

If your server doesn't support SNI, or you're concerned about browsers that don't, you'll need a Cert per domain and you'll need an ip address per domain.

Prior to SNI, when a client made a https connection, the server had to accept it and decrypt it before it knew that http host the client wanted to connect to. In that instance, if the server was serving multiple http hosts on the same ip address, the server would always assume that the client wanted to connect to the first ordered host in the configuration. If the certificate served in response didn't match the host requested by the client, the browser would generate an error. Hence, you had to run different domains on different ip addresses.

Where SNI is enabled, the server presents all available certs to the client request, and the client can match its host request to the correct cert if its exists, meaning a browser error is only generated if none of the certs match.

This allows you have host multiple https hosts on the same ip address. You will still however need an https cert per domain (free or commercial).

Improve this answer
1
  • thank you for the info, it has been very informative! I think I am going to go with Simon's answer as it seems to suit my immediate needs, but this information will help me in the future! – PythonReactor Feb 11 '18 at 23:55
1

SSL Certificate is per domain not per IP.

You can have 1000 IP`s but when you have certificate for domain myextradomain.com, then you can host this site on 1000 IP`s with SSL certificate:) .

If you have many subdomain in example:

  • subdomain.myextradomain.com
  • subdomain2.myextradomain.com
  • subdomain3.myextradomain.com

You can buy wildcard certificate, then can use this certificate on all subdomains.

Improve this answer
1
  • Thank you for the info on wildcard certificates, I was a bit in the dark on that! – PythonReactor Feb 11 '18 at 19:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.