SSL for multiple subdomains

Hi,

I have a webiste www.chillifire.net installed plus some subdomains, i.e. login01.chillifire.net with ISPConfig 2.1.18 on an Ubuntu 7.10 server. With http they direct to the specific folders /var/www/webx with x being the number of the virtual host. I have a SSl certificate installed for the www domain, which works well. I have one IP address on that server. So far so good.

When I tried reaching the subdomains under https I expected to see the certificate error warning screens from the browser, warning me that the url does not match the certificate's. What I did not expect is that the browser redirected in https to the folder /var/www/webx of the www.chillifire.net domain although the URL still shows https//login.chillifire.net.

Is this expected behaviour?

I understand that I need two IP addresses on an Apache2 server if I want two different certificates for two different domains.

But does this restriction count for subdomains as well?

What I wanted to do is to install a GoDaddy Multiple Domain Certificates, also called Unified Communications Certificates (UCC), domain, which covers the two mentioned plus some more subdomains, and have them all sitting on one server- with one IP address, since they are just subdomains of the identical domain chillifire.net.

Can this be achieved?

As usual, any hints/input are welcome.

Thanks

 

I don't run ISPconfig, but from what I know about Apache, this might work.

Here's a post I ran accross when I thought about trying the same thing.

http://www.howtoforgehttp://www.how...owthread.php?t=4853&highlight=ssl+virtualhost

 

Resolved

erk

Thanks for the hint. I tried this out, but ran into the 'SSL overlap' error on stratup of apache2. So no go.

Thanks till, but I need the separate folders for security reasons - that was the whole point. So a second IP address, I guess.

Thanks for the input

 

chillfire, I would like to know how that cert worked for you. I was thinking about purchasing one or two for my servers for postfix+tls, pop3s, imaps, and ispconfigs apache services. All in one cert would be nice and more cost effective. I would think since each service was on a dif port and service it would work well. Like
cpanel.example.tld:81
smtp.example.tld
imap.example.tld
pop.example.tld
is that what you used yours for?

 

Different purpose

Hi,
no, that is not why I bought this. I use 'snakeoil' certificates for the email services and I do not think the user actually ver sees a difference.

I use the multi subdomain certificate for two web servers I have running on ISPConfig under different subdomain names. One server is 'front-of house' www.chillifire.netpromoting my service, the other one login01.chillifire.netis actually delivering the service.

Hope this helps.

 

doesn't work correctly for single domain

Hi folks
I tried for several hours without find any solution. My problem is similar (or the same); I need to define a SSL certificate for each site of my subdomain i.e.:

main domain name: www.tryme.it
subdomain name:
sub1.tryme.it
sub2.tryme.it
sub3.tryme.it
[... and so on ...]

I discovered that if I create a certificate SELF-SIGNED for the first domain (doesn't matter what is the first, I mean: the first used for SSL...) the certificate will be stored inside the SSL folder, i.e.:

/var/www/sub1/ssl

well, all is ok and for that domain all works correctly.

But when I try to create another certificate for another domain ISPConfig tells me that 'there is another certificate for this IP address'.

But if I try a connection to a different site, i.e.:
https://sub3.tryme.it

the certificate proposed and used is the same of sub1 (see example above).

This situation could be replicated so that I believe this is very frustrating and limitating (infact I manage another domain with Plesk and for each domain I can create certificates without problems).

My colleague says that the creation certificate process have not to be based on IP address but instead on site name.

I'm not expert in this then I wait for an answer and to understand if there is a solution to apply, otherwise I'll be forced to look for another CP.

Thank you very much!

 

ssl and certificates...

I appreciated ISPConfig and I think it is a good product.
My choice to change this CP could be linked to this aspect.
However I bought a virtual server and using Plesk I can create certificates without any limitation (I tried this morning). The IP is the same, so that I cant undestrand what you mean....
thank you very much for your intervention.

 

ok

Dear Till
thank you for your help. Since 2006 I'm using ISPConfig succesfully.
Now I'm investigating to see if there is a solution for my host (manually or patch...)
See you

 

howto...

Dear Staff
thank you for your help. To solve this annoying problems may be this is the solution: (?)

http://www.g-loaded.eu/2007/08/10/ssl-enabled-name-based-apache-virtual-hosts-with-mod_gnutls/

if yes (I can try it...) and this is compatible with ISPConfig, should be useful make some documentation (howto).

Cordially

 

oops!

May be there is more than one method: I don't know what is simpler.
Don't forget Till post:

http://www.howtoforge.com/enable-multiple-https-sites-on-one-ip-using-tls-extensions-on-debian-etch