All geek questions in one place

SNI multiple ssl apache iis domains

we need to host several sites with different domains. eg

a.test.dk b.test.dk a.test.fi b.test.fi

Now from what I know is that being either in apache or in iis, you will need 1 ip / host when using the ssl domain certificate, this means that we will need to buy 4 certificates and 4 IP addresses to host them on

another option is to use wildcard certificates, if we buy * .test.dk and * .test.fi, we can use 2 ip / address and 2 certificates to host the same number of sites, since our iis / apache can use sni.

But now my real question is: is there also something called multiple ssl domains

Will it be allowed to run all 4 sites under 1 ip-address?

because we are struggling with our use of external ip-addressing at the moment.

+1
source share
1 answer

Well, you mix two different things. You enter blank wildcard certificates and SNI (server name). They are certainly different solutions to such problems.

Wildcard certificates do not use header verification to encrypt your traffic, you simply specify the DNS at the desired IP address, and your request is sent to any site that you configured in IIS.

SNI is different and is what you want. SNI checks each HTTP request and determines which IIS site you want to use based on host headers. Before SNI existed, you could not verify headers in SSL requests because headers were also encrypted.

When using SNI, if you have certificates for each site (wildcard certificates or individual site certificates, UCC certificates, or some combination of them), you can use SNI to verify each HTTP request and maintain the corresponding SSL certificate and site. You can do this for as many websites as you want, and share 1 IP: port combination at all.

Here is a WikiPedia article that explains this in a bit more detail:

http://en.wikipedia.org/wiki/Server_Name_Indication#Background_of_the_problem

Here is an article on how to configure it in IIS 8 and higher :

https://www.digicert.com/ssl-certificate-installation-microsoft-iis-8.htm#multiple

At step 18, these instructions indicate where you enable SNI.

Here is an article on how to configure it in Apache 2.2.12 and higher :

https://www.digicert.com/ssl-support/apache-multiple-ssl-certificates-using-sni.htm

0
source

Source: https://habr.com/ru/post/1238888/

More articles:


All Articles