Index: [Article Count Order] [Thread]

Date:  Sun, 14 Oct 2007 10:58:14 -0400
From:  "Brian N. Smith" <brian (at mark) nuonce.net>
Subject:  [coba-e:10894] Re: two SSL certificates on the same IP through BQ
To:  <coba-e (at mark) bluequartz.org>
Message-Id:  <008e01c80e72$a5bb3830$1e64a8c0 (at mark) nuonce.net>
References:  <47121748.4080802 (at mark) zbronx.com>
X-Mail-Count: 10894

> Has anyone tried having two SSL certificates over the same IP on BQ?
> I dont think its possible, but doesnt hurt to ask..

It is extremely possible.  BUT, each site has to be on different 
ports, and it has to be configured manually.

Apache + SSL only allows for 1 SSL cert per IP / Port combo.

The reason is this.

When a client makes a connection, the SSL negotiation is the first 
thing to happen.  In order for that to happen, a cert must be sent. 
When the receiving side gets the cert, it can decrypt the data.  When 
the actual HTTP header is then sent, the name of the virtual site is 
sent.

The client then looks to make sure that the SSL cert matches that of 
the HTTP header's virtual site information.

If it doesn't match, you get that certification error.

If it matches, you get no errors.

Now, that is the reason why you can't host multiple sites.  Apache 
wouldn't know which virtual site to send.  If there are 10 of them, it 
would technically have a 1 in 10 chance of sending the correct one. 
So, to avoid that, there is the limitation of 1 SSL enabled site per 
IP per PORT.

Since BQ can't change the port number of a virtual site, your stuck.

I hope that helps!

-Brian