Subject: Quickie on Certrificate Requests (combined with virtual hosts)...

From: Sean M Alderman <[email-masked]>
Date: 01 Jul 2002 15:16:46 -0400

Greetings all,
  I'm hoping someone on the list might have some experience with
multiple IP based virtual hosts and generating CSRs for ssl certs for
each host.  Something has me thinking that if I run the commans from the
mod_ssl faq, I'll get several CSRs for the same host (either local or
the main hostname).  That shouldn't be, certs are hostname specific
right?  Anyway, if anyone would be so kind as to pass me a clue.

Thanks.
-- 
Sean M. Alderman
ITRACK Systems Analyst
PACE/NCI - NASA Glenn Research Center
(216) 433-2795

Calling a windowed operating system "Windows" is like naming an
automobile "Wheels."
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Cliff Woolley <[email-masked]>
Date: Mon, 1 Jul 2002 15:18:10 -0400 (EDT)

> right?  Anyway, if anyone would be so kind as to pass me a clue.

The commands in the FAQ should be okay.  When you run openssl and ask it
to generate a CSR, it will prompt you for various things, one of which is
"Common Name (CN)" -- enter the hostname with which the certificate should
be associated there, and that's all you should have to do.

--Cliff

---

From: Sean M Alderman <[email-masked]>
Date: 01 Jul 2002 16:05:43 -0400

Cool, thanks!... So I've done that, I needed to use the make certificate
instead of the openssh commands because of the lack of a /dev/random on
Solaris 8 (I don't know why make is able to do make it happen when I
can't).  Anyway, each time I run it it generates a new server.key file,
I need to keep each of these right?...perhaps name them based on the
virtual host each are for?

---

From: Cliff Woolley <[email-masked]>
Date: Mon, 1 Jul 2002 16:30:09 -0400 (EDT)

> virtual host each are for?

Yes, exactly right.

Dunno why the make certificate thing works when the openssl commands
directly don't -- probably just some configuration issues.

--Cliff

---

From: Sean M Alderman <[email-masked]>
Date: 02 Jul 2002 09:01:55 -0400

Thanks guys.  I saw the Sun patch, but unfortunately I'm just the
webmaster on this machine, not the Admin, so there's not a lot I can do
about that except ask him to put it on.  Anyway, I just shipped off my
CSRs.  Thanks for the Help!