SSL Certificates and multiple domains

Zippy1970 · 03-05-2013, 02:29 AM

I host a few domains on my webserver and one uses SSL. Back when I installed it, I created a private key and a CSR, sent the CSR to a certificate authority (Comodo), received the certificates and installed them together with Comodo's root & intermediate certificates. No problems there.

Now one of my customers wants me to host their small website on my server as well. They also need SSL. So I told them to get a certificate and they did. They sent me the certificate through email. Problem is, I only got 3 certificates. The public key certificate, and Comodo's root & intermediate certificate.

Aren't I supposed to get their private key as well? The one they used to request the certificate?

acid_kewpie · 03-05-2013, 03:35 AM

you need their private key to load the certificate in the server, yes. Otherwise there would be thousands of fake SSL identified sites for google and microsoft out there.

but you do realize it's impossible to serve multiple certs on the same port? unless you have multiple IP addresses, you need a SINGLE certificate containing BOTH of the domain names, stored in Subject Alternative Name attributes, (SAN's)

Zippy1970 · 03-05-2013, 05:02 AM

Quote:

Originally Posted by acid_kewpie

ybut you do realize it's impossible to serve multiple certs on the same port? unless you have multiple IP addresses, you need a SINGLE certificate containing BOTH of the domain names, stored in Subject Alternative Name attributes, (SAN's)

No, I wasn't aware of that. I thought that was handled by apache. Why wouldn't this work (in apache):

Code:

NameVirtualHost 12.34.56.78:443

<VirtualHost 12.34.56.78:443>
  ServerName www.somedomain.com
  ServerAlias somedomain.com *.somedomain.com

  (snip)

  SSLEngine on
  SSLCertificateFile /etc/ssl/private/www_somedomain_com.crt
  SSLCertificateKeyFile /etc/ssl/private/somedomain_com.key
  SSLCACertificateFile /etc/ssl/private/SSL-bundle1.ca-bundle
</VirtualHost>

<VirtualHost 12.34.56.78:443>
  ServerName www.someotherdomain.com
  ServerAlias someotherdomain.com *.someotherdomain.com

  (snip)

  SSLEngine on
  SSLCertificateFile /etc/ssl/private/www_someotherdomain_com.crt
  SSLCertificateKeyFile /etc/ssl/private/someotherdomain_com.key
  SSLCACertificateFile /etc/ssl/private/SSL-bundle2.ca-bundle
</VirtualHost>

acid_kewpie · 03-05-2013, 05:07 AM

Because you perform the SSL handshake **BEFORE** you make an HTTP request. So there is no knowledge at all about what site you're going to ask for. The browser obviously knows what site you've asked for, but it's not asked the server for it yet at this point, so the first certificate available has to be served.

There are some HTTP extensions to permit this, but they are not at all standardised or implemented reliably yet.

Zippy1970 · 03-05-2013, 05:19 AM

Quote:

Originally Posted by acid_kewpie

Because you perform the SSL handshake **BEFORE** you make an HTTP request.

Ok, that makes sense.

In this case it's not really a problem since SSL on the other domain was for testing purposes only anyway, but it is something to keep in mind for next time.

I want to secure a few sites of my own all running on the same IP address. So I need a single certificate for them all, right? Also, would I be able to add domains to the certificate in the future? Or do I simply need to purchase a new certificate that contains all domains?

acid_kewpie · 03-05-2013, 05:24 AM

TBH I've rarely been involved in the actual purchase arrangements of the certificates, but you'd want one certificate with multiple SAN's. I don't *think* SAN's cost extra, (a wildcard cert, e.g. to cover *.domain.com would though) so a new cert for one site *should* cost (approx) the same as a replacement cert with another SAN. Note though that the client will get that cert and be able to see all of the FQDN's that that cert can support. If this goes between different commercial customers, this can be an issue.

grim76 · 03-05-2013, 01:18 PM

There is a way to host multiple sites SSL enabled on nginx with a single IP. I know that you are using Apache now for your hosting needs, but figured I would throw that option out there.

acid_kewpie · 03-05-2013, 02:21 PM

Quote:

Originally Posted by grim76

There is a way to host multiple sites SSL enabled on nginx with a single IP. I know that you are using Apache now for your hosting needs, but figured I would throw that option out there.

no, it's not Apache, it's SSL. When a browser is asked to connect to an https site the very very first thing it does in an SSL handshake, it has no way of evening knowing what kind of server it's talking to. could be an HTTP server, could be NNTPS, could be FTPS, SMTPS, anything, let alone what the server is specifically.

Here's the solution... SNI... but http://en.wikipedia.org/wiki/Server_Name_Indication but It's not very commonly used at all, although TBH, maybe less uncommon than I thought before reading this.

grim76 · 03-06-2013, 09:36 AM

We have been employing SNI for the customers that we have to preserve IP space. It works for us pretty well. Problem is sometimes you get someone that is not using an up to date browser/OS.

TenTenths · 03-07-2013, 02:43 AM

Quote:

Originally Posted by acid_kewpie

Here's the solution... SNI... but http://en.wikipedia.org/wiki/Server_Name_Indication but It's not very commonly used at all, although TBH, maybe less uncommon than I thought before reading this.

I believe there's an apache module that can handle this. The way we are doing it is with a Citrix NetScaler front-ending the web servers. We use a Comodo Multi-Domain certificate for it with something like 15 domains on it.

acid_kewpie · 03-07-2013, 02:48 AM

Quote:

Originally Posted by TenTenths

I believe there's an apache module that can handle this. The way we are doing it is with a Citrix NetScaler front-ending the web servers. We use a Comodo Multi-Domain certificate for it with something like 15 domains on it.

booo, NetScaler suxxxxx, BigIP 4eva!

Yeah the wikipedia article says mod_ssl can handle it in very recent builds of the module.

TenTenths · 03-07-2013, 03:18 AM

Quote:

Originally Posted by acid_kewpie

booo, NetScaler suxxxxx, BigIP 4eva!

Meh! Netscaler as a virtual appliance and Juniper SSG firewalls, working fine for us

descendant_command · 03-07-2013, 06:19 AM

Quote:

Originally Posted by acid_kewpie

Yeah the wikipedia article says mod_ssl can handle it in very recent builds of the module.

... and even not so recent (depending on your definition).
The apache mod_ssl in Debian Squeeze is doing it fine for us.