Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (herse.apache.org: domain of rea-asf@codelabs.ru designates
 144.206.177.45 as permitted sender)
DomainKey-Signature: a=rsa-sha1; q=dns; c=simple; s=one; d=codelabs.ru;
	h=Received:Date:From:To:Message-ID:References:MIME-Version:Content-Type:Content-Disposition:In-Reply-To:Sender:X-Spam-Status:Subject;
	b=PUPcAWLzWR/XFJU9vkBhOHexKv6VGDQLKUnVfgQawFsMPsHF4EWjKlviTW+P8gIGk+Iae8dH0FaZa6O4vSQMnq8iFe/gAGf1NFdNFof3VhZ31l3nTF15ZAzRrJokgwicbaeo/EwttH5NSDXekRd4GVxTcxK/L73JjquH8huBN8I=;
Date: Sun, 8 Apr 2007 23:43:07 +0400
From: Eygene Ryabinkin <rea-asf@codelabs.ru>
To: dev@httpd.apache.org
Message-ID: <20070408194307.GA12909@codelabs.ru>
References: <46192AF9.9080200@esuna.co.uk>
MIME-Version: 1.0
Content-Type: text/plain; charset=koi8-r
Content-Disposition: inline
In-Reply-To: <46192AF9.9080200@esuna.co.uk>
Sender: rea-asf@codelabs.ru
Subject: Re: Redundant SSL virtual host warnings?

Good day!

Sun, Apr 08, 2007 at 06:48:41PM +0100, Jay L. T. Cornwall wrote:
> Virtual hosts and SSL don't mix. Or so people say, for the simple reason
> that in order to reach the HTTP negotiation an SSL connection must be
> established first with a certificate/key pair.
> 
> If you give it a try, Apache fills its log with the "SSL server IP/port
> conflict" and "You should not use name-based virtual hosts in
> conjunction with SSL" warnings. But since the adoption of wildcard SSL
> certificates virtual hosts over SSL work just fine because the same
> certificate/key pair is used for all of them.

I can add that if you're using subjectAltName extension and place
many DNS names into it, this will do the trick for the name-based
virtual hosts. In the presence of the subjectAltName with the DNS
entries in it, the DNS name of the server SHOULD (if memory servers
me right: I am not able to find the reference document now) be
checked against the subjectAltName components. At least
IE/Mozilla/Firefox/OpenLDAP/curl/elinks are doing these checks. It
is a bit different from the wildcard certificates, since no wildcards
are here, just the bunch of the dNSName objects in the subjectAltName.
-- 
Eygene