Subject: RE: how to add multiple SSL cert for each virtual host?

From: Hack Hawk <[email-masked]>
Date: Tue, 03 Dec 2002 12:34:58 -0800

What?!?!?!  Are you absolutely sure about this?  SSL certs are based on the 
Domain Name,,, NOT the IP address.  It stands to reason that it would be 
possible for virtual hosts/domains to have their own certs.  Perhaps modssl 
doesn't support it, but I think that in theory it's possible.

- hawk

At 10:24 AM 12/03/2002, you wrote:
>Multiple SSL certs for name-based virtual hosts aren't possible based upon
>the way SSL is designed. Each site requiring a separate cert must have it's
>own IP address.
>
>---
>Shawn Syms | Systems Administrator
>Infinet Communications | [email-masked]
>---
>
>
>
>-----Original Message-----
>From: Thomas Sandor [mailto:[email-masked]]
>Sent: Tuesday, December 03, 2002 1:20 PM
>To: [email-masked]
>Subject: how to add multiple SSL cert for each virtual host?
>
>
>hi everyone,
>
>I have an apache 2.0.40 installed on a RedHat 7.2 box, complied with ssl
>(openssl 0.9.6g).
>Till now I had only one domain for which apache should use SSL cert files
>(crt, key), but for our next project I have to add another SSL cert file a
>specific domain.
>
>I have NameVirtualHost 12.34.56.78 and have a list of <virtualhost/> for
>each of our domain, using ServerNamed base aliases, but for the ssl conf it
>ain't works. In my ssl.conf in short looks like this:
>
>NameVirtualHost 12.34.56.78:443
>
><VirtualHost 12.34.56.78:443>
>     ServerName domain1.com
>     CustomLog "..."
>     ErrorLog "..."
>     SSLEngine on
>     SSLCertificateFile "/somewhere/ssl.crt/domain1.crt"
>     SSLCertificateKeyFile "somewhere/ssl.key/domain1.key"
></VirtualHost>
>
><VirtualHost 12.34.56.78:443>
>     ServerName domain2.com
>     CustomLog "..."
>     ErrorLog "..."
>     SSLEngine on
>     SSLCertificateFile "/somewhere/ssl.crt/domain2.crt"
>     SSLCertificateKeyFile "somewhere/ssl.key/domain2.key"
></VirtualHost>
>
>The problem is that apache does not serve domain2 cert files for domain2, it
>uses the first declaration for every https://domainX.com invoke. Does anyone
>know how to tell apache to uses specific SSL cert I'd like to define for
>each of my virtualhosts?
>
>Thanks in advance for any help.
>
>Regards,
>Thomas
>
>______________________________________________________________________
>Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
>User Support Mailing List                      [email-masked]
>Automated List Manager                            [email-masked]
>______________________________________________________________________
>Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
>User Support Mailing List                      [email-masked]
>Automated List Manager                            [email-masked]

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Dave Paris <[email-masked]>
Date: Tue, 3 Dec 2002 15:52:20 -0500

Look at the handshake for SSL.  During the name to address translation 
phase, you wind up with a chicken-egg scenario if more than one name 
shares an address.

Not only is it not possible, it'd be a HUGE security flaw if it WERE 
possible.

-dsp

On Tuesday, Dec 3, 2002, at 15:34 US/Eastern, Hack Hawk wrote:

> What?!?!?!  Are you absolutely sure about this?  SSL certs are based 
> on the Domain Name,,, NOT the IP address.  It stands to reason that it 
> would be possible for virtual hosts/domains to have their own certs.  
> Perhaps modssl doesn't support it, but I think that in theory it's 
> possible.
>
> - hawk
>

---

From: Cliff Woolley <[email-masked]>
Date: Tue, 3 Dec 2002 17:10:34 -0500 (EST)

On Tue, 3 Dec 2002, Dave Paris wrote:

> Not only is it not possible

With the current state of the SSL protocol such as it is, this is
correct-- it's not possible.

> it'd be a HUGE security flaw if it WERE possible.

Well, not necessarily... all that you would need is for the client to tell
the server which host it *thought* it was contacting, and then the server
would know which vhost to serve the request with and therefore which
certificate to present.  That would require the SSL protocol to have the
equivalent of HTTP's Host: header.  From there, as long as the certificate
can be verified as authentic, there's no more risk than there would be if
there was a one-to-one mapping between IP and hostname as the current SSL
protocol requires.

But please, people, this is SUCH a frequently asked question.  Definitely
one of the top three.  I wonder if we can't find a better way to document
this?  Anyone have any ideas?  I'd say un-hiding it from the FAQ page
would be a good start... it's a prominent question, give the answer a more
prominent location.

--Cliff

---

From: "R. DuFresne" <[email-masked]>
Date: Tue, 3 Dec 2002 16:30:23 -0500 (EST)

Perhaps including it in the defauly httpd.conf file underr the
<VirtualHost> directives as commentary might help?

	#  General setup for the virtual host
	# ...name based VHing does not work, you need to...to get this to
	#  ...work...if you ask this in the modssl-users list, you might
	#well be berated for failing to read documentation...

Perhaps putting the information in the README as well as in the INSTALL
docs, tthus putting it in as many places as possible might help?

Thanks,

Ron DuFresne

P.S.  this is of course not limiting adding it to the list footer <grin>:

>  ...name based VHing does not work, you need to...to get this to
>  ...work...if you ask this in the modssl-users list, you might
> #well be berated for failing to read documentation...

On Tue, 3 Dec 2002, Cliff Woolley wrote:

	[SNIP]

-- 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        admin & senior security consultant:  sysinfo.com
                        http://sysinfo.com

"Cutting the space budget really restores my faith in humanity.  It
eliminates dreams, goals, and ideals and lets us get straight to the
business of hate, debauchery, and self-annihilation."
                -- Johnny Hart

testing, only testing, and damn good at it too!