Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

We're hosting two websites on our fairly tiny but dedicated production server. Both website require SSL authentication.

So, we have virtualhosts set up for both of them. They both reference their own domain.key, domain.crt and domain.intermediate.crt files.

Each CSR and certificate file for each site was setup using its own unique information and nothing is shared between them (other than the server itself)

However, which ever site's symbolic link (set up in /etc/apache2/sites-enabled) is reference first, is the site who's certificate is referenced even if we're visiting the second site.

So for example, assume our companies are Cadbury and Nestle. We set up both sites with their own certificates but we create Cadbury's symbolic link in apache's site-enabled folder first and then Nestle's.

You can visit Nestle perfectly fine but if you check the certificate installation, it reference's Cadbury's certificate.

We're hosting these websites on a dedicated Ubuntu 12.04.3 LTS server. Both certificates are provided by Thawte.com.

I came across a few potential solutions with no degree of success. I'm hoping someone else has a decent solution?

Thanks

Edit: The only other solution that seems to have provided success to some people is using SNI with Apache. However, the setups here didn't seem to coincide with our setup at all.

share|improve this question
    
You're 100% correct. I've edited the question. I tried out the SNI option but that didn't seem to work at all. –  Kyle O'Brien Oct 23 '13 at 11:59
    
But actually, I think I should be open to listening to that again in case I didn't implement something correctly the first time –  Kyle O'Brien Oct 23 '13 at 12:00
    
Without SNI you can only have one cert per IP address, as the web server cannot know what site you are GETting until after the certificate exchange has taken place. So it uses the first one it has. You don't mention in your question how many IPs you have. –  Paul Oct 23 '13 at 12:48
    
@Paul - yeah it seems there's little workaround here. Well we technically have 5. At the time I posted this though, I wasn't so sure we wanted to use one of them on a fairly low budget client. That being said, from an academic stand point, you seem to be correct. The only way is a good implementation of the SNI. Could you put together an answer using SNI and the information in my question and I'll accept it as the correct one. Thanks –  Kyle O'Brien Oct 23 '13 at 13:32
    
Be warned, you may still see a number of clients connecting that don't support SNI. Internet Explorer on Windows XP, for example. –  David Schwartz Oct 23 '13 at 21:49

1 Answer 1

up vote 0 down vote accepted

The problem with hosting multiple SSL sites on a single IP address is that the SSL certificate exchange happens first, before the GET statement that lets the web server know which site you are targeting.

Even though you type the name of the server https://google.com into your browser, the name is resolved to its IP address, and an SSL session is initiated to the IP address. The specific URL we are targeting cannot be part of a standard SSL handshake, otherwise this would be visible to eavesdroppers. So the webserver cannot know which certificate to use, and so generally uses the first one.

SNI is an extension to TLS/SSL which allows the hostname to be included in the session negotiation. This is widely supported in clients and servers these days. While this does make the hostname visible to eavesdroppers, it is considered acceptable because it only includes the hostname rather than the full url (which may contain sensitive information) and you very likely did an unencrypted DNS lookup for the hostname immediately prior to kicking off the SSL session.

In Apache, there are three steps:

  1. Don't use a default website on 443
  2. Use ServerName directives in your :443 virtual host definition
  3. Ensure Apache is built with a recent OpenSSL

You'll get a message in the Apache error logs if it isn't built with SNI support:

 You should not use name-based virtual hosts in conjunction with SSL!!

If all is well, you'll get the following in the logs:

 [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.