{"id":993,"date":"2010-11-12T21:00:24","date_gmt":"2010-11-12T20:00:24","guid":{"rendered":"http:\/\/blog.fh-kaernten.at\/wehr\/?p=993"},"modified":"2010-11-22T16:09:18","modified_gmt":"2010-11-22T15:09:18","slug":"how-to-run-apache-2-2-x-with-multiple-ssl-certifiaktes-via-one-ip","status":"publish","type":"post","link":"https:\/\/blog.fh-kaernten.at\/wehr\/2010\/11\/12\/how-to-run-apache-2-2-x-with-multiple-ssl-certifiaktes-via-one-ip\/","title":{"rendered":"How to run Apache 2.2.x with multiple SSL certificates via one IP"},"content":{"rendered":"<p id=\"top\" \/>\n<p>I never thought that could be a problem. Well after digging around for HTTP+SSL (multiple certificates) and after understanding how it works, yes this is definitely a problem :-).<\/p>\n<p>But there is light at the end of the tunnel called <a href=\"http:\/\/wiki.apache.org\/httpd\/NameBasedSSLVHostsWithSNI\">SNI<\/a> (Server Name Indication). SNI is an extension for <a href=\"http:\/\/en.wikipedia.org\/wiki\/Transport_Layer_Security\">TLS <\/a>.<\/p>\n<p>The idea behind SNI is that the clients domain name request is deferred until the certificate is exchanged between the the two parties . This gives the server the change to switch to the right named virtual host :-)&#8230;. yeah thats cooooool.<\/p>\n<p>See here <a href=\"http:\/\/www.ietf.org\/rfc\/rfc3546.txt\">RFC3546 <\/a>(Section 3.1) for an in deep description.<\/p>\n<p>SNI works with (according <a href=\"http:\/\/en.wikipedia.org\/wiki\/Server_Name_Indication\">wikipedia<\/a>):<\/p>\n<ul>\n<li><a title=\"Mozilla Firefox\" href=\"http:\/\/en.wikipedia.org\/wiki\/Mozilla_Firefox\">Mozilla Firefox<\/a> 2.0 or later<\/li>\n<li><a title=\"Opera (web browser)\" href=\"http:\/\/en.wikipedia.org\/wiki\/Opera_%28web_browser%29\">Opera<\/a> 8.0 or later (the TLS 1.1 protocol must be enabled)<\/li>\n<li><a title=\"Internet Explorer 7\" href=\"http:\/\/en.wikipedia.org\/wiki\/Internet_Explorer_7\">Internet Explorer 7<\/a> (Vista or higher, not XP) or later<\/li>\n<li><a title=\"Google Chrome\" href=\"http:\/\/en.wikipedia.org\/wiki\/Google_Chrome\">Google Chrome<\/a> (Vista or higher. XP on Chrome 6 or newer<sup id=\"cite_ref-6\"><a href=\"http:\/\/en.wikipedia.org\/wiki\/Server_Name_Indication#cite_note-6\">[7]<\/a><\/sup>. OS X 10.5.7 or higher on Chrome 5.0.342.1 or newer)<\/li>\n<li><a title=\"Safari (web browser)\" href=\"http:\/\/en.wikipedia.org\/wiki\/Safari_%28web_browser%29\">Safari<\/a> Safari 3.2.1 and newer on Mac OS X 10.5.6 and Windows Vista or higher, not XP<\/li>\n<li>Any Apple iDevice running iOS4 has support for TLS server name indication.<\/li>\n<li>Android<\/li>\n<\/ul>\n<p>If you want to use SNI for your server you have to put your *.443 hosts configs into one file.<\/p>\n<pre class=\"brush: bash\">Listen 443\r\n\r\nNameVirtualHost *:443\r\n\r\n# Also accept connections from none SNI capable hosts\r\nSSLStrictSNIVHostCheck off\r\n\r\n# This is our default virtual host.\r\n DocumentRoot \/www\/blub1\r\n ServerName www.blub1.at\r\n\r\n# Other directives here\r\n\r\nDocumentRoot \/www\/blub1\r\n ServerName www.blub.at\r\n\r\n# Other directives here\r\n<\/pre>\n<p>&nbsp;<\/p>\n<p>have fun<\/p>\n<p>Mario<\/p>\n","protected":false},"excerpt":{"rendered":"<p>I never thought that could be a problem. Well after digging around for HTTP+SSL (multiple certificates) and after understanding how it works, yes this is definitely a problem :-). But there is light at the end of the tunnel called SNI (Server Name Indication). SNI is an extension for TLS . The idea behind SNI &hellip; <a href=\"https:\/\/blog.fh-kaernten.at\/wehr\/2010\/11\/12\/how-to-run-apache-2-2-x-with-multiple-ssl-certifiaktes-via-one-ip\/\" class=\"more-link\">Continue reading <span class=\"screen-reader-text\">How to run Apache 2.2.x with multiple SSL certificates via one IP<\/span> <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"ngg_post_thumbnail":0,"footnotes":""},"categories":[7],"tags":[],"class_list":["post-993","post","type-post","status-publish","format-standard","hentry","category-cool-tools"],"_links":{"self":[{"href":"https:\/\/blog.fh-kaernten.at\/wehr\/wp-json\/wp\/v2\/posts\/993","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.fh-kaernten.at\/wehr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.fh-kaernten.at\/wehr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.fh-kaernten.at\/wehr\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.fh-kaernten.at\/wehr\/wp-json\/wp\/v2\/comments?post=993"}],"version-history":[{"count":0,"href":"https:\/\/blog.fh-kaernten.at\/wehr\/wp-json\/wp\/v2\/posts\/993\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.fh-kaernten.at\/wehr\/wp-json\/wp\/v2\/media?parent=993"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.fh-kaernten.at\/wehr\/wp-json\/wp\/v2\/categories?post=993"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.fh-kaernten.at\/wehr\/wp-json\/wp\/v2\/tags?post=993"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}