Apache support two SSL certificates?

[67ray]

If I assign two IP addresses to a box, can I then support two SSL certificates? Separate names, separate Ips, same box. Can virtual hosts factor in here either.

How about any open source/aftermarket add-ons that might let me do the same thing?

Many thanks.

 

[RhythmAce]

Yes you would use virtual hosting but use port 443 instead of 80. You would also need to use ip based addressing rather than name based.

 

[67ray]

Ok but if I use IP based addressing then I can not obtain a verisign certificate, yes? I use self-certified certificates but if I understand you correctly I will not be able to bind a second name to the server? Is this correct.

 

[RhythmAce]

Name based addressing allows for many virtual hosts to share the same ip. From what I understand, two different ssl sites can't share the same ip. This is why I suggested ip based addressing. You either need a public ip for each virtual host or use ip aliasing. With ip aliasing one NIC can have more than one ip. This is also called multi homing or virtual ip addressing.

 

[Legion13]

Assuming you have multiple IP's on your box you can make it work.

I used an apache server to proxy to two separate orion servers in a similar manner. In my httpd.conf I redirected to https from htpp.

<VirtualHost 192.168.174.101:80>
ServerName site1.domain.com

RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(.*)

https://%{SERVER_NAME}/$1

[L,R,NC]

</VirtualHost>

<VirtualHost 192.168.174.102:80>
ServerName site2.domain.com

RewriteEngine On
RewriteCond %{SERVER_PORT} !^443$
RewriteRule ^/(.*)

https://%{SERVER_NAME}/$1

[L,R,NC]

</VirtualHost>

then in my ssl.conf I had something like this;

<VirtualHost 192.168.174.101:443>
ServerName site1.domain.com
SSLEngine On
SSLCertificateFile conf/ssl/site1/site1.cer
SSLCertificateKeyFile conf/ssl/site1/site1.key

ProxyVia On
ProxyPass /

http://10.1.1.131:8500/

ProxyPassReverse /

http://10.1.1.131:8500/

</VirtualHost>

<VirtualHost 192.168.174.102:443>
ServerName site2.domain.com
SSLEngine On
SSLCertificateFile conf/ssl/site2/site2.cer
SSLCertificateKeyFile conf/ssl/site2/site2.key

ProxyVia On
ProxyPass /

http://10.1.1.131:8500/

ProxyPassReverse /

http://10.1.1.131:8500/

</VirtualHost>


Using a specific IP for each virtual host while including the ServerName directive seems to solve the problem of needing a unique IP but only being able to get a cert tied to a domain name. You could also use the same IP but with different ports, SSL only cares that it is a unique IP/Port combination. Hope this helps some.

Note: IP addresses were changed to protect the innocent. ;-)