Configuring apache for multiple SSL domains

A year ago my conclusion from googling around was that it is
impossible to run multiple SSL vhosts on a single Apache server. At
least if you do not resort to methods like assigning vhosts to
specific ports. What I wanted was name based virtual hosting combined
with the security provided by a SSL certificate.
So when I got certified by CAcert a while back I was more than happy
to find instructions in their wiki concerning name based SSL hosts.
The method that works for many applications that can communicate via
SSL is to store one common name and several alternative names in one
certificate.
The mentioned wiki page discusses the alternative options in detail
but I just want to highlight the procedures you need to follow in
order to get a usable certificate for your SSL vhosts.
mkdir vhost_ssl
cd vhost_ssl
wget http://guillaume.romagny.free.fr/evaldo/csr.sh
chmod u+x csr.sh
./csr.sh
First enter an identifier for the certificate. This is not related to
the server names and you can choose whatever you wish here:
Short Hostname (ie. imap big_srv www2): vhosts
Now follows the name of your primary host as common name:
FQDN/CommonName (ie. www.example.com) : gunnarwrobel.de
Subsequently you need to enter all alternative host names of the other
vhosts that you wish to handle with this one certificate. Do not
forget to provide the common name once again as the first alternative name:
SubjectAltName: DNS: gunnarwrobel.de
SubjectAltName: DNS: torp4.de
...
Finish with one line of empty input.
The script will place the certificate request and the private key into
your home directory. Move them over to the current directory:
mv ~/vhosts_{csr,privatekey}.pem .
Now all you need to do in order to get the final certificate is to
either process the certificate signing request using standard openssl
procedures to get a self signed certificate. Or you submit the signing
request to your certificate authority of choice, preferably CAcert.
Apache_HTTP_Server
howto
linux
vhosts
CAcert
SSL
Posted at: 07:59 |
Permalink |
category: /english/technical