Subject: RE: Confession: I use NBVHs with SSL (was Re: 2 VirtualHosts with 2 Certificates)

From: "Boyle Owen" <[email-masked]>
Date: Mon, 13 Jan 2003 10:45:50 +0100

>-----Original Message-----
>From: James Collier [mailto:[email-masked]]
>
>I realise I am on thin ice as it would be a "reasonable" 
>optimisation to assign the final virtual host at an earlier 
>stage than is currently the case with SSL.

I wouldn't worry too much. Currently, in an SSL transaction, *all*
information is regarded as requiring encryption - including the Host
header in the original request. So the SSL session has to be established
before any traffic takes place. Anything different (e.g. putting the
host header in the SSL layer) would be a major revision of the protocol.
One of two things will happen first:

- IPv6 will take off, creating so many IP addresses that NBVH will be
unnecessary and we will revert to one site, one IP.
- A new SSL-like protocol will appear which promotes the site name to
the SSL layer thus enabling NBVH.

Either way, you'll need substantially to upgrade and reconfigure your
server so you'll be well aware of the changes.

Rgds,

Owen Boyle

This message is for the named person's use only. It may contain
confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please notify the sender urgently
and then immediately delete the message and any copies of it from your
system. Please also immediately destroy any hardcopies of the message.
You must not, directly or indirectly, use, disclose, distribute, print,
or copy any part of this message if you are not the intended recipient.
The sender's company reserves the right to monitor all e-mail
communications through their networks. Any views expressed in this
message are those of the individual sender, except where the message
states otherwise and the sender is authorised to state them to be the
views of the sender's company. 
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email-masked]
Automated List Manager                            [email-masked]

---

From: James Collier <[email-masked]>
Date: Tue, 14 Jan 2003 01:10:38 +1300

Sorry - I didn't express that very well, but thanks for the reply.

At the moment, the handshake take place using the first matching vhost 
on the basis of IP+Port, but evidently Apache then scans the decrypted 
host header and assigns the correct NBVH. This is using 1.3.x; I haven't 
tested 2.x yet.

My fear is that future apache+modssl code may lock-in the first NBVH 
that matches on the basis of IP+Port, which would break my scheme.

   Regards,
      James.

PS For those of you who were wondering, we use a private CA to issue the 
wildcard server cert.  As someone has already noted, Thawte advertise 
them as well.

>>stage than is currently the case with SSL.
                                         ^^^
                             I meant "apache+modssl"

---

From: Eric Rescorla <[email-masked]>
Date: 13 Jan 2003 07:32:24 -0800

> unnecessary and we will revert to one site, one IP.
There is already a document describing how to do this with SSL/TLS
in the IETF standards pipeline.

-Ekr

-- 
[Eric Rescorla                                   [email-masked]]
                http://www.rtfm.com/

---

From: Mads Toftum <[email-masked]>
Date: Mon, 13 Jan 2003 16:39:04 +0100

> in the IETF standards pipeline.
Unfortunately this is not implemented very many places - so far the only
place I've heard of is Apache 2.1 which has some preliminary and untested
code for it. If anyone knows of a compliant client, then that would be
much appreciated.

vh

Mads Toftum
-- 
`Darn it, who spiked my coffee with water?!' - lwall

---

From: Eric Rescorla <[email-masked]>
Date: 13 Jan 2003 08:08:09 -0800

> code for it. If anyone knows of a compliant client, then that would be
I don't.

Moreover even if there were it will be like 2-3 years before it's
sufficiently widespread that you can count on it.

-Ekr