Apache – Running Two Secure Sites on Port 443 on the Same Server

apache-2.2httpsssl

Let's say I want two secure sites running from the same machine using the Apache server:

 1. https://example.com
 2. https://example.ca

Is it possible to use port 443 for both of the above sites?

Best Answer

As already explained, the SSL connection is created before any actual data is sent over the connection so Apache can not provide different SSL certificates for each of your virtual sites since it has no idea which server name is being requested. What this means is that regardless of what server name is actually requested (In this case "mysite.com" or "mysite.ca"), Apache will respond with the default SSL certificate it has been configured to use. This might be declared inside of the "default" 443 VirtualHost or in the global Apache configuration.

What this means from a usability standpoint is that you can absolutely host both sites from the same apache host and IP but users will receive a warning when accepting the certificate telling them the certificate is for the wrong site. The only way around this would be to have two different IP addresses and configure your virtual hosts so that they each listen on a different address. (Make sure to update DNS accordingly)

Once the certificate exchange has taken place, normal VirtualHost rules will apply and you can actually host different content on each server name if that's what you desire to do.

These examples are a little rough, you'll want to consult official apache documentation on the exact parameter names for setting up virtual hosts and configuring ssl if you don't know the basics already.

Example: Two servers on different IP addresses with different document roots, each presenting the correct certificate

<VirtualHost 1.1.1.1:443>
ServerName mysite.com
DocumentRoot /var/www/comroot
SSLEngine On
// Configure certificate for mysite.com
</VirtualHost>

<VirtualHost 2.2.2.2:443>
ServerName mysite.ca
DocumentRoot /var/www/caroot
SSLEngine On
// Configure certificate for mysite.ca
</VirtualHost>

Example: Two servers on the same IP using the wrong certificate (configured elsewhere) but still serving different content based on server name.

<VirtualHost *:443>
ServerName mysite.com
DocumentRoot /var/www/comroot
SSLEngine On
</VirtualHost>

<VirtualHost *:443>
ServerName mysite.ca
DocumentRoot /var/www/caroot
SSLEngine On
</VirtualHost>

Related Solutions

SSL – Multiple SSL Domains on the Same IP Address and Port

For the most up-to-date information on Apache and SNI, including additional HTTP-Specific RFCs, please refer to the Apache Wiki

FYsI: "Multiple (different) SSL certificates on one IP" is brought to you by the magic of TLS Upgrading. It works with newer Apache servers (2.2.x) and reasonably recent browsers (don't know versions off the top of my head).

RFC 2817 (upgrading to TLS within HTTP/1.1) has the gory details, but basically it works for a lot of people (if not the majority).
You can reproduce the old funky behavior with openssl's s_client command (or any "old enough" browser) though.

Edit to add: apparently curl can show you what's happening here better than openssl:

SSLv3

mikeg@flexo% curl -v -v -v -3 https://www.yummyskin.com
* About to connect() to www.yummyskin.com port 443 (#0)
*   Trying 69.164.214.79... connected
* Connected to www.yummyskin.com (69.164.214.79) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: /usr/local/share/certs/ca-root-nss.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using DHE-RSA-AES256-SHA
* Server certificate:
*    subject: serialNumber=wq8O9mhOSp9fY9JcmaJUrFNWWrANURzJ; C=CA; 
              O=staging.bossystem.org; OU=GT07932874;
              OU=See www.rapidssl.com/resources/cps (c)10;
              OU=Domain Control Validated - RapidSSL(R);
              CN=staging.bossystem.org
*    start date: 2010-02-03 18:53:53 GMT
*    expire date: 2011-02-06 13:21:08 GMT
* SSL: certificate subject name 'staging.bossystem.org'
       does not match target host name 'www.yummyskin.com'
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):
curl: (51) SSL: certificate subject name 'staging.bossystem.org'
does not match target host name 'www.yummyskin.com'

TLSv1

mikeg@flexo% curl -v -v -v -1 https://www.yummyskin.com
* About to connect() to www.yummyskin.com port 443 (#0)
*   Trying 69.164.214.79... connected
* Connected to www.yummyskin.com (69.164.214.79) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: /usr/local/share/certs/ca-root-nss.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server key exchange (12):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using DHE-RSA-AES256-SHA
* Server certificate:
*    subject: C=CA; O=www.yummyskin.com; OU=GT13670640;
              OU=See www.rapidssl.com/resources/cps (c)09;
              OU=Domain Control Validated - RapidSSL(R);
              CN=www.yummyskin.com
*    start date: 2009-04-24 15:48:15 GMT
*    expire date: 2010-04-25 15:48:15 GMT
*    common name: www.yummyskin.com (matched)
*    issuer: C=US; O=Equifax Secure Inc.; CN=Equifax Secure Global eBusiness CA-1
*    SSL certificate verify ok.

IIS 7.5 – Securing Two Subdomains with SSL on Port 443

No, you cannot do it -- IIS does not support different certificates on the same port -- only one unique SSL Certificate per IP:port pair (search on this site -- plenty of answers for similar questions, for example: Using several SSL certificates on same IP with IIS 7 ).

Basically you have 2 choices:

Put each site on different HTTPS port: for example 444. You access such site with port number included in URL (which is perfectly fine when used for development or when putting non-important site on SSL) -- http://sub2.example.com:444/
Generate/Obtain wildcard certificate (*.example.com). This site has instructions how then one such certificate can be used by multiple sites: http://www.sslshopper.com/article-ssl-host-headers-in-iis-7.html

Best Answer

Related Solutions

SSL – Multiple SSL Domains on the Same IP Address and Port

IIS 7.5 – Securing Two Subdomains with SSL on Port 443

Related Topic