How many SSL Certificates needed for SSL sites in one Config file? 1

[SirCharles]

Does anyone know if you need more that one certificate where all your ips for ssl are listed in the one Apache config file? Do you need one Cert per secure site specified in the config file, or will one Cert do for the "Main" ServerName, which might then be applied to rest of "ServerName"s in the file? Desired that all should work without user having to, repeatedly, acknowlege Security Alert.

 

[sleipnir214]

I'm not sure what you are asking, but here's some general rules about SSL...

The name of the host in the URL entered into the browser must match the name of the host to which the SSL certificate was issued. For example, if the certificate was issued to

http://www.foo.bar,

and

http://www.foo.bar

resolves to 10.1.1.1, then any attempt to connect to the server as

https://10.1.1.1

will cause the browser to pop up an alert saying the cert doesn't match the host name.

HTTPS does not work with sites sharing IP addresses. HTTP 1.1 implements the "Host:" request header, which allows a web server to determine to which site the browser wants to connect when sites share IP addresses (Apache attempts to match the hostname given to a hostname set in a "ServerName" or "ServerAlias" directive). However, the encryption handshake of HTTPS takes place before that "Host" header is transmitted, so the cert is matched to an IP address. If multiple SSL sites share an IP address, the server will generally use the first cert configured on that address -- which means all the other sites will pop up the security alert.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!

 

[SirCharles]

I've multiple IPs and SSL sites referenced from same config file - one SSL site per IP, but all served from same config file. Was hoping one certificate would do, if it had the name of the "main" ServerName.

 

[sleipnir214]

Nope. The number of configuration files is immaterial.

You have to match the site's host name to the site name built into the certificate.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!