How To Set Up Multiple SSL Certificates on One IP with Apache on Ubuntu 12.04

" There are also a small percentage of older web browsers that may still give certificate errors"

I don’t think the number is really so small. According to the latest data I can find (Dec 2012), Windows XP still holds 39% of the desktop market and 47% of those are surfing with Internet Explorer. So that means that roughly 19% of users on the web will have a problem with SNI at this time. If you’re looking to use it to lock down your admin logins and such, no problem. If you’re looking to use it for e-commerce sites, that will be a serious issue.

That is correct, SNI is not yet fully supported so you should review your webtraffic and see how much of it is still using older browsers that do not support it.

When we will get Multipel IP support from “digitalocean”, Any Idea ?

Anyone know what this looks like to an XP user? Do they get a warning or alert?

@flexcode: I believe it will look like this: http://www.enhanceie.com/images/blog/GmailNameMismatchIE6.png

with this example it is working in both modes like http://localhost and https://localhost I removed the VirtualHost *:80 from the default file then https://localhost is working but https://localhost/test.php is not working. After hitting the enter it is going to localhost/test.php and it is telling that 404 error

So how can we resolve this problem

@09jj1a514: Please pastebin apache’s virtualhost config files.

I have “www.mysite.com” and the subdomain “www.secure.mysite.com”

My goal is to only use my EV SSL UNDER www.secure.mysite.com, and not use SSL on www.mysite.com

I created the subdomain www.secure.mysite.com and it works fine.

Should I now make a vhost for www.secure.mysite.com then follow this tutorial?

Thanks in advance!

@KiwoT: Yes, that should work.

Well, it works, but most important question is - how to set this up with SSL certificate from say - GoDaddy ? Will it work ?

@k.horns: Yes, it will. Simply send them the CSR and replace the old crt file with GoDaddy’s signed certificate.

How to do the same in centos 6.4 since the command a2enmod is not working in centos

@Vineet: This article is for Ubuntu, it does <strong>not</strong> work on CentOS. We currently do not have a similar article for CentOS.

See <a href=“https://www.digitalocean.com/community/articles/how-to-create-a-ssl-certificate-on-apache-for-centos-6”>https://www.digitalocean.com/community/articles/how-to-create-a-ssl-certificate-on-apache-for-centos-6</a>

Problem with step 3? Step Three—Create a Self Signed SSL Certificate

The dash in front of “-out”, caused me a problem. I removed and added in a dash and it fixed an error I experienced.

Error: “unknown option –out” –out /etc/apache2/ssl/example.com/apache.crt –out /etc/apache2/ssl/example.org/apache.crt

Changed to: -out /etc/apache2/ssl/example.com/apache.crt -out /etc/apache2/ssl/example.org/apache.crt

Again, notice the dash in front of out, “-out”.

Heh, my username is the email addy of the site(s) I post to/from (signup with), in front of my personal domain. Hope that does not confuse in this case. I am not a rep of Digital Ocean.

~FastEddy =]

@digitalocean: Thanks, I’ve updated the article :]

for your example example.com can i use (for my internal intranet) can i change my server name to j.net and it will work with this ssl so instead of example.com i could use j.net is this correct i wish to follow these steps and will it cause any issues by changing my server name to do this and will it work please advise?

@jamied_uk: You will have to replace all occurrences of example.com with j.net (assuming it’s the domain that you want to set up the SSL certificate for).

Hi thanks for this. I had used it to setup my rapidssl cert. I didn’t change any port.conf info and Im running Ubuntu 14… I had to add the location for the intermediate crt from rapidssl though.

ie. SSLCertificateChainFile /etc/apache2/…crt

Mr.Black

Is this article or wiki out of date? https://wiki.apache.org/httpd/NameBasedSSLVHosts

Also, in your example do both sites point to the same hosted files? I want host 2 totally different ssl sites. Is this possible based on your tutorial? https://www.unrelatedsiteone.com and https://www.unrelatedsitetwo.com

@markjwill: This article assumes that you’ve already set up the Virtual Hosts to serve different files. You need to set <code>DocumentRoot</code> to point to different directories. See:

https://www.digitalocean.com/community/articles/how-to-set-up-apache-virtual-hosts-on-ubuntu-12-04-lts

i’ve followed these steps exactly, but when i go to test the sites, the SSL certificate for one site is being used for both, even though they are explicitly set to different certs in the .conf files. one is labelled www.ha… and the other is labelled www.ti… the one for www.ti… uses the cert for www.ha… but the www.ha… uses the appropriate cert. i’m assuming it’s an alphabetical thing, but should it be?

fixed my problem. had a .conf error. listed the VirtualHost as servername:443 and added :443 on the ServerName and ServerAlias items. changed the vhost to *:443 and removed the :443 from the two entries and it worked.

Some problems with the article that can be improved:

One is

ServerName: This is your domain name. Make sure that you write it in without a prepended www.

It’s an article about two domain names, and the code shown before shows two sections with barely any explanation, one with much more text in description, and both having the same “example.com.” Is one suppoesd to be “example.org”? Does one replicate a section to add a third or fourth site?

That is, there is a lot more in the <VirtualHost *:443><...> section vs. the <VirtualHost *:80><...> section, should there be more in the first? Should there be a second or an additional <VirtualHost *:443> section for each extra domain?

Second,

DocumentRoot: This is the directory where you keep your site information. Currently it points to the apache default directory. You will probably have different server roots for the 2 different virtual hosts.

Clarifying this a little better would be awesome. e.g. I have /var/www with the domain names of each site within, i.e. “philosophique.org” and “travelandmail.com”, among others. In each of those folders (those were folder names) I have public_html–following the https://www.digitalocean.com/community/articles/how-to-set-up-apache-virtual-hosts-on-ubuntu-12-04-lts article (though I did 14.04, I don’t at this very moment remember if I used the 12-04 article or a 14-04 article).

Does that mean I have, in essence, one root with sub-domains and need to create a WWW2, or just a folder /www whose sub-url-named folders are each a root folder, so there are under /www multiple roots? I am pretty sure it’s the folders under …/www that are the roots though, given the article linked AndrewSB above.

Third,

SSLCertificateFile: This directive points to the location of the certificate file. The certificate for each site is stored in the directory that we created earlier in the tutorial.

“Directory” in the explanation here, should be made specific rather than referring-back in the article. Just far better from a new user’s standpoint.

Fourth,

SSLCertificateKeyFile : This directive points to the location of the certificate key. The certificate key for each site is stored in the directory that we created earlier in the tutorial.

Ditto the criticism–constructive not bashing, mind you–from #3. ;)

Fifth, a glaring problem with the explanations of 3 & 4, however, is that we didn’t make “a” directory earlier, but two separate ones for “example.com” and “example.org”, each under /ssl. This means that the article does not specify if we’re to change the configuration file lines from

SSLCertificateFile /etc/apache2/ssl/example.com/apache.crt
        SSLCertificateKeyFile /etc/apache2/ssl/example.com/apache.key

Or we’re supposed to double them

SSLCertificateFile /etc/apache2/ssl/example.com/apache.crt
        SSLCertificateKeyFile /etc/apache2/ssl/example.com/apache.key
SSLCertificateFile /etc/apache2/ssl/example.org/apache.crt
        SSLCertificateKeyFile /etc/apache2/ssl/example.org/apache.key

or what else we actually should be doing.

Which is the biggest of the article’s weaknesses–from the standpoint of anyone who lacks the background knowledge to extrapolate. From your–and almost from my (not quite, but I’m 3-4 tries of this or that to “arrive” wherever the intended destination of these directions is) point of view the words can simply be “applied” to the next issue but, I’m telling you, some priors are assumed here thus missing for a rational guy or gal who is paying close attention to be sure from what’s provided they’re doing the right thing! :O

In literary terms it’s a self-referencing problem ;) Fixing this or a slight revision to add clarifications and instructions to the article and this could perhaps be among the most valuable on the web.

If that point comes, I’m definitely planning to incorporate it among links in a guide to best web resources for new folks to any thing technical and web-site related. :D

Just thought I would add my 2̶ ̶c̶e̶n̶t̶s̶ 10 bucks. Now I’m waiting… -.0

Hi Friends,

Is multiple SSL with single IP for different multiple domains supporting to all browsers ? My server is ubuntu 12.10.

Will it work ?

Regards,

On Ubuntu 14.04.1 x64 bit [below steps worked for me] ** generate certificates for site example.com**

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/example.com/apache.key -out /etc/apache2/ssl/example.com/apache.crt

generate certificates for site example.org

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/apache2/ssl/example.org/apache.key -out /etc/apache2/ssl/example.org/apache.crt ##Virtual Host Configuration <note: the vhost file should have .conf extension###

root@server1:/etc/apache2/sites-available# vim example.com.conf <VirtualHost *:80> ServerAdmin webmaster@localhost ServerName example.org DocumentRoot /var/www/html/example.org

</VirtualHost>

<IfModule mod_ssl.c> <VirtualHost *:443>

    ServerAdmin webmaster@localhost
    ServerName example.org
    DocumentRoot /var/www/html/example.org

    #   SSL Engine Switch:
    #   Enable/Disable SSL for this virtual host.
    SSLEngine on

    SSLCertificateFile /etc/apache2/ssl/example.org/apache.crt
    SSLCertificateKeyFile /etc/apache2/ssl/example.org/apache.key

</VirtualHost>

</IfModule> ** #Configure ports** #cat /etc/apache2/ports.conf

NameVirtualHost *:80 NameVirtualHost *:443 Listen 80

<IfModule ssl_module> Listen 443 </IfModule>

<IfModule mod_gnutls.c> Listen 443 </IfModule> #Enable sites# a2ensite example.com a2ensite example.org

as of now my virtual hosts allow both 80 and 443, how can i force them to use 443 only?

Can I follow this process for CentOS 7 SNI installation?

Couple of items to note.

1. On Ubuntu 14.04 you don’t need to do anything with ports.conf. In fact if you do you’ll get a warning on restart about NameVirtualHost being removed in the future.
2. If you want your logs for the vhost going to a specific file (in my config I explicitly set the file names) remember to add that same config to the 443 host.
3. If you only want the vhost running on port 443 then don’t add a new section as noted above. Just change the :*80 to :*443 in the VirtualHost tag and add the SSL configuration bits…don’t create a new VirtualHost tag.

In an earlier comment it was pointed out that the dash character was wrong in the code for the generation of the .key and .crt file and this has not been corrected