Ssl – How to setup SSL on Amazon EC2

You can have more than 1 SSL cert per IP, but you can't have more than 1 SSL cert for each IP:port combination. If you're willing to try to run one of the SSL certificates on a non-standard port (anything but 443) then you can use a single IP address.

You can easily serve up a different SSL certificate on different ports.

It turns out that this can be easily implemented with Elastic Load Balancer. You can redirect port 443 on several elastic load balancer IPs to different ports on your instance.

Someone was kind enough to write a good tutorial, complete with diagrams: http://elwoodicious.com/2009/12/23/using-elb-to-serve-multiple-domains-over-ssl-on-ec2-for-giggles/

The "UCC" cert that you're referring to is a certificate with many names in the SubjectAltName field. Since you already have a wildcard certificate, you may find it to be limiting - how many different domain names are you covering with the wildcard? One advantage of a SAN-based certificate is it can cover multiple domains, but you'll need to enumerate every domain name individually when requesting the certificate rather than allowing a browser to match the wildcard cert.

While there are some solutions that allow multiple SSL identity certificates on a single IP address, in general if you require good browser compatibility, then you will require an IP per Certificate. There are some details on why this is the case in this question

The problem for standard Name-based Virtual Hosts is basically that the first thing that the https server does during the TLS/SSL handshake is send the SSL certificate with a "common name" identifying itself as www.mysecuresite.com - However Name virtualhosts relies on a "Hosts:" header to decide which site which is sent later during the HTTP phase.

Hence (using traditional... SSL v1, old browsers etc, Windows XP) there can only be 1 SSL identity per IP address, because the first thing the servername is already known as www.amazon.com, which it cannot change afterwards...

Notes -generally these are for fairly niche situations, such as intranet or *.mydomain.com wildcard certs.

Server Name Indication, is a solution for hosting multiple SSL certs on a single IP, but it has poor support:

• not XP or old safari, or old android - works with only 1 IP - http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI"

• Wildcard certs, not suitable in this particular situation because the servers names are domain level, eg badger.com and monkey.com, rather than badger.server.com and monkey.server.com