Subject: RE: how to add multiple SSL cert for each virtual host?

From: Shawn Syms <[email-masked]>
Date: Tue, 3 Dec 2002 13:24:25 -0500

Multiple SSL certs for name-based virtual hosts aren't possible based upon
the way SSL is designed. Each site requiring a separate cert must have it's
own IP address.

---
Shawn Syms | Systems Administrator
Infinet Communications | [email-masked]
---

-----Original Message-----
From: Thomas Sandor [mailto:[email-masked]]
Sent: Tuesday, December 03, 2002 1:20 PM
To: [email-masked]
Subject: how to add multiple SSL cert for each virtual host?

hi everyone,

I have an apache 2.0.40 installed on a RedHat 7.2 box, complied with ssl
(openssl 0.9.6g).
Till now I had only one domain for which apache should use SSL cert files
(crt, key), but for our next project I have to add another SSL cert file a
specific domain.

I have NameVirtualHost 12.34.56.78 and have a list of <virtualhost/> for
each of our domain, using ServerNamed base aliases, but for the ssl conf it
ain't works. In my ssl.conf in short looks like this:

NameVirtualHost 12.34.56.78:443

<VirtualHost 12.34.56.78:443>
    ServerName domain1.com
    CustomLog "..."
    ErrorLog "..."
    SSLEngine on
    SSLCertificateFile "/somewhere/ssl.crt/domain1.crt"
    SSLCertificateKeyFile "somewhere/ssl.key/domain1.key"
</VirtualHost>

<VirtualHost 12.34.56.78:443>
    ServerName domain2.com
    CustomLog "..."
    ErrorLog "..."
    SSLEngine on
    SSLCertificateFile "/somewhere/ssl.crt/domain2.crt"
    SSLCertificateKeyFile "somewhere/ssl.key/domain2.key"
</VirtualHost>

The problem is that apache does not serve domain2 cert files for domain2, it
uses the first declaration for every https://domainX.com invoke. Does anyone
know how to tell apache to uses specific SSL cert I'd like to define for
each of my virtualhosts?

Thanks in advance for any help.

Regards,
Thomas

______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: Hack Hawk <[email-masked]>
Date: Tue, 03 Dec 2002 13:04:07 -0800

At 12:49 PM 12/03/2002, Shawn Syms wrote:
>Hawk: Here is more info on why did doesn't work:
>http://www.ensim.com/support/sxc/faqs/4.10.html

Aha.  That makes sense to me.  I noticed this discussion because I was 
considering doing this sort of thing in the next month or two. Damn!  Now I 
have to provide IP addresses for virtual sites that require this support.  :(

Thanks for the heads up though.

- hawk

>From: Hack Hawk [mailto:[email-masked]]
>Sent: Tuesday, December 03, 2002 3:35 PM
>Subject: RE: how to add multiple SSL cert for each virtual host?
>
>
>What?!?!?!  Are you absolutely sure about this?  SSL certs are based on the
>Domain Name,,, NOT the IP address.  It stands to reason that it would be
>possible for virtual hosts/domains to have their own certs.  Perhaps modssl
>doesn't support it, but I think that in theory it's possible.
>
>- hawk
>
>At 10:24 AM 12/03/2002, you wrote:

---

From: [email-masked]
Date: Wed, 4 Dec 2002 08:17:23 +0100

> have to provide IP addresses for virtual sites that require 

Might not something like this work? It gives you name based virtual hosts
for the http part...

NameVirtualHost 12.34.56.78:80

<VirtualHost 12.34.56.78:80>
     ServerName domain1.com
     Redirect / https://domain1.com:1443
</VirtualHost>

<VirtualHost 12.34.56.78:80>
     ServerName domain2.com
     Redirect / https://domain2.com:1444
</VirtualHost>

<VirtualHost 12.34.56.78:1443>
     ServerName domain1.com
     CustomLog "..."
     ErrorLog "..."
     SSLEngine on
     SSLCertificateFile "/somewhere/ssl.crt/domain1.crt"
     SSLCertificateKeyFile "somewhere/ssl.key/domain1.key"
</VirtualHost>

<VirtualHost 12.34.56.78:1444>
     ServerName domain2.com
     CustomLog "..."
     ErrorLog "..."
     SSLEngine on
     SSLCertificateFile "/somewhere/ssl.crt/domain2.crt"
     SSLCertificateKeyFile "somewhere/ssl.key/domain2.key"
</VirtualHost>

I've just written this from the top of my head, so I don;t know if I didn't
make any syntax errors. But I'll have to try this out someday here, as I'm
going to run into the same problem as you are now.

Greetings,

Krist

---

From: Shawn Syms <[email-masked]>
Date: Tue, 3 Dec 2002 15:49:21 -0500

---

-----Original Message-----
From: Hack Hawk [mailto:[email-masked]]
Sent: Tuesday, December 03, 2002 3:35 PM
To: [email-masked]
Subject: RE: how to add multiple SSL cert for each virtual host?

- hawk