Subject: Virtual hosts and ssl.

From: David <[email-masked]>
Date: Fri, 01 Mar 2002 14:51:53 +1300

Hello,

Could someone clarify this point for me please.

When compiling a .crs the following message is displayed which implies I 
don't have to use a FQND

Common Name (eg, your name or your server's hostname) []:

But from the ssl-faq it says

Make sure you enter the FQDN ("Fully Qualified Domain Name") of the 
server when OpenSSL prompts you for the "CommonName"

I have several virtual users hosted on the same apache server and want 
to be able to provide ssl for them. Do I have to use a FQDN and 
therefore need an individual certificate for Virtual user or can I have 
one certificate in the name of the hosting organization that will 
provide ssl for all the hosted users?

Thanks.

-David.

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "SoilentG" <[email-masked]>
Date: Thu, 28 Feb 2002 22:34:13 -0800

What is required for SSL and Virtual Hosts is that you use IP based
virutal hosts.  Name based VH's don't work on SSL.  So if you have
only 1 public IP then you'll only be able to have 1 SSL enabled
host.  5 = 5 and so on.

g'luck

Jeff

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of David
> Sent: Thursday, February 28, 2002 5:52 PM
> To: [email-masked]
> Subject: Virtual hosts and ssl.
> 
> 
> Hello,
>

---

From: "Matus \"fantomas\" Uhlar" <[email-masked]>
Date: Fri, 1 Mar 2002 09:19:20 +0100

-> What is required for SSL and Virtual Hosts is that you use IP based
-> virutal hosts.  Name based VH's don't work on SSL.  So if you have
-> only 1 public IP then you'll only be able to have 1 SSL enabled
-> host.  5 = 5 and so on.

well, they _do_ work - but only with one certificate. you cannot use more
certificates on one IP.

-- 
 Matus "fantomas" Uhlar, [email-masked] ; http://www.fantomas.sk/
 Warning: I don't wish to receive spam to this address.
 Varovanie: Nezelam si na tuto adresu dostavat akukolvek reklamnu postu.
 Due to unexpected conditions Windows 2000 will be released
 in first quarter of year 1901
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: "Mark Weisman" <[email-masked]>
Date: Thu, 28 Feb 2002 23:16:25 -0900

Working a little here with Apache couldn't you just make another VS
entry in Apache for the new port, all using a singular IP addr? 
Example;
--<VirtualHost 120.120.120.120:80>
--	ServerAdmin [email-masked]
--	DocumentRoot /www/domain1
--	ServerName www.whatever.com
--	ErrorLog wherever
--	CustomLog wherever part two
--</VirtualHost>
--<VirtualHost 120.120.120.120:443>
--	ServerAdmin sameguy or gal
--	DocumentRoot /www/ssl
--	ServerName www.whatever.com
--	ErrorLog wherever
--	CustomLog wherever part two
--</VirtualHost>

By allowing Apache to do the internal routing, wouldn't that re-direct
where he's talking about. I'm also doing a lot of virtual hosting, and
currently I use a singular domain name for all SSL requests I was
thinking about trying the above out and see if it worked? But since
we're on the topic.

Thank you,
Mark-Nathaniel Weisman MCP, CNA, A+, MOUS MI
Network Systems Administrator
Career Academy MIS Department
Anchorage, AK 

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of SoilentG
Sent: Thursday, February 28, 2002 9:34 PM
To: [email-masked]
Subject: RE: Virtual hosts and ssl.

What is required for SSL and Virtual Hosts is that you use IP based
virutal hosts.  Name based VH's don't work on SSL.  So if you have only
1 public IP then you'll only be able to have 1 SSL enabled host.  5 = 5
and so on.

g'luck

Jeff

> When compiling a .crs the following message is displayed which implies

> I

---

From: Owen Boyle <[email-masked]>
Date: Fri, 01 Mar 2002 09:46:32 +0100

> thinking about trying the above out and see if it worked? But since

What you have above is perfect. This is port-based virtula-hosting and
there is no problem with it. The problem arises if you try name-based
VHing with SSL - that won't work:

http://www.modssl.org/docs/2.8/ssl_faq.html#ToC47
http://marc.theaimsgroup.com/?l=apache-modssl&m=98559369910170&w=2

Rgds,

owen Boyle.

---

From: "Joe Pearson" <[email-masked]>
Date: Fri, 1 Mar 2002 05:46:44 -0700

You can only have one certificate per hostname.   So you need to enter the
FQDN of the host.  If you want to use this for all your hosted users, the
URL would need to go to this FQDN.  So all your virtual domains would need
to switch to this url when they want SSL.

If you want to have multiple virtual domains with their own certificate, you
need to setup IP based virtual domains.  In other words, each virtual domain
would need their own IP address.

---

From: "Andrew Lietzow" <[email-masked]>
Date: Fri, 1 Mar 2002 09:31:16 -0600

Dear David and list,
Jeff wrote:
RE:>>Name based VH's don't work on SSL.

It seems to me that every hosted DN would need to have its own CERT.  Sure,
the server could have just one CERT, with all of your DNS users sharing it,
but then the identity being confirmed would be that of the ISP.  What good
would that do for me as a purchaser, to access the Encrypted Key of the ISP
if the company with whom I am transacting business is simply one of their
hosted Domain Names?

If there is a way around having to purchase one CERT per Domain Name, I
would like to discover it. However, if I am understanding this correctly,
multiple domains can share one IP (which is how I host most domains), but I
never did understand the use of Name-Based VH's.

In what context are Name-Based VH's of value?  From what Jeff states,
obviously not on SSL.

Andrew L.
The ACL Group, Inc.