Home / server / Questions / 226910
Accepted
Sheldon McGee
Asked: 2011-01-26 16:33:16 +0800 CST

Is it possible to get a wildcard cert and use SNI?

  • 772

I'd like to make setting up new subdomains easy (at least for the development side) and getting one wildcard cert, setting up a wildcard dns (which is done and works great) and setting up SNI (Server Name Indication) seems like it would work for our HTTPS testing but googling around I haven't found any good instructions. Is this even possible? Everything I've read about SNI says you need to setup a cert for every site and that SNI just makes it possible to deliver a different cert depending on the hostname.

apache-2.2 https sni

1 Answers

  1. Best Answer

    If you have a wildcard certificate you can do named-based virtual hosting just like you do without SSL.

    When negotiating an SSL connection, your web server needs to select a certificate BEFORE any http protocol headers have been received -- which means that, without SNI, Apache can't select between multiple name-based virtual hosts. This is why in the past you needed a separate ip address for every virtual host hosted on your system. Using SNI, the client is able to provide the server with the name of the host to which it wishes to connect. This allows the server to select the appropriate virtual host configuration, and hence the appropriate certificate.

    If you're using a wildcard certificate, you sidestep this problem as long as all of your virtual hosts share a common parent domain. In this case, SNI is unnecessary. Because the certificate is valid for any of your hosts, there's no requirement that your web server is able to identify the appropriate virtual host at the beginning of the SSL negotiation...which means you can use the HTTP headers to identify the host, and proceed with normal name-based virtual hosting.

    Using Apache, your configuration would look something like this:

    NameVirtualHost *:443

<VirtualHost *:443>
    ServerName foo.example.com
    DocumentRoot /sites/foo.example.com/html
    SSLEngine On
    # ...other SSL parameters...
</VirtualHost>

<VirtualHost *:443>
    ServerName bar.example.com
    DocumentRoot /sites/bar.example.com/html
    SSLEngine On
    # ...other SSL parameters...
</VirtualHost>

    We're been running this sort of configuration in a production situation for a few years now without problems.

    • 5