https://issues.apache.org/bugzilla/show_bug.cgi?id=54385
Bug ID: 54385
Summary: SSL configuration independent from virtual hosts,
automatic certificate selection.
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: PC
OS: Linux
Status: NEW
Severity: enhancement
Priority: P2
Component: mod_ssl
Assignee: bugs@httpd.apache.org
Reporter: mail@joachim-breitner.de
Classification: Unclassified
With one certificate covering all hosted domains (using wildcard domains and/or
subject alternative name entries), it is possible to
* have all SSL configuration in one place.
* define one virtual host once and serve both HTTP and HTTPs
This works by having only one virtual host with ssl configuration. This virtual
host is not actually used (and the ServerName may be anything): Before the SSL
handshake, apache looks only at that virtual host, sends the certificate, then
recieves the request with the Host: header and re-selects the right virtual
host.
It is not possible to obtain the same level of convenience with multiple
certificates and SNI: Now I do need to configure SSL for each virtual host
idependently. Worse, I need to duplicate every virtual host configuration,
because the same configuration can no longer server both SSL and non-SSL
(unless the patch in 47256 is included).
Worse: If I have larger number of domains that I want to handle in a single
virtual host (e.g. using mod_rewirte magic), I still need to duplicate the
configuration if I need to show separate certificates for different domains.
It would be nice if I could, in my original setup with the single „dummy“ SSL
virtual host, multiple certificates (or even a whole directory), and have
apache select the right certificiate by matching the SNI data against the CN
and SAN entries of the ceritificate, showing the client the first one that
matches.
After the SSL handshake, virtual host selection would work as before, i.e.
based on the ServerName attribute.
This would entangle virtual host configuration and SSL configuration, which I
think is a good thing in many use cases.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
|