Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Content-Class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Date: Wed, 13 Aug 2003 10:14:51 +0200
Message-ID: 
 <FAB6A3A2CC5BDB448DADFA1C8C0752965F72D2@SOMEXEVS001.ex.ordersx.org>
Thread-Topic: [users@httpd] More certificates for 1 server
Importance: normal
Priority: normal
thread-index: AcNhb66/h1UcrtpLQsKED2crBui/FgAAYM5w
From: "Boyle Owen" <Owen.Boyle@swx.com>
To: <users@httpd.apache.org>
Subject: RE: [users@httpd] More certificates for 1 server

>-----Original Message-----
>From: Louis Wevers [mailto:frut666@netscape.net]
>
>... It would be nice if a feature like this [name-based VHs on SSL]
would be implemented=20
>in the future.

It would be very nice, but unfortunately the restriction is not due to
some trivial oversight in apache. Rather, it is fundamental to the HTTP
protocol and affects all webservers.

Briefly, the problem is that in order to do name-based VH, the server
must use the "Host" header in the HTTP request to assign the VH.
However, in an SSL request, the entire HTTP packet is encrypted -
including the "Host" header. Thus the server has no way to know which VH
it is intended for. So the server can't decide which certificate to use
(the certificate is defined inside the VH!).=20

There are extensive discussions on this subject on the mod_ssl site and
on the archives for this list - just type "name-based SSL" into the
searcher or into Google.

Rgds,
Owen Boyle
Disclaimer: Any disclaimer attached to this message may be ignored.=20


>
>Louis
>
>lfellows@4lane.com wrote:
>
>>-----BEGIN PGP SIGNED MESSAGE-----
>>Hash: SHA1
>>
>>On Tuesday 12 August 2003 11:46, SAQIB wrote:
>> =20
>>
>>>>  For https, you cannot use NamedVirtualHosts for multiple=20
>hosts.  The
>>>>hosts must be on different IPs or different ports on the same IP.
>>>>     =20
>>>>
>>>However if you enable SSL on a different port lets say port=20
>5568, you can
>>>not reference it using
>>>
>>>https://www.yourserver.dom:5568
>>>
>>>https implies it is port 443
>>>   =20
>>>
>>
>>  As http implies it is port 80.  The default is unimportant=20
>as long as
>>  you have setup the virtual host with ssl enabled on that port.  Same
>>  principle as setting up http access on a different port.
>>
>>  HTH
>>
>>
>>-----BEGIN PGP SIGNATURE-----
>>Version: GnuPG v1.2.2-rc1-SuSE (GNU/Linux)
>>
>>iD8DBQE/ORXW+ShVRkQlJBIRAgNVAJ9OBhHlMOnllcgiV6LYIH6RnSCmJwCglcXT
>>WmDcxLTDmeYX7h8HeOw8Uq4=3D
>>=3Du6uf
>>-----END PGP SIGNATURE-----
>>
>>
>>---------------------------------------------------------------------
>>The official User-To-User support forum of the Apache HTTP=20
>Server Project.
>>See <URL:http://httpd.apache.org/userslist.html> for more info.
>>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>>   "   from the digest: users-digest-unsubscribe@httpd.apache.org
>>For additional commands, e-mail: users-help@httpd.apache.org
>>
>> =20
>>
>
>
>---------------------------------------------------------------------
>The official User-To-User support forum of the Apache HTTP=20
>Server Project.
>See <URL:http://httpd.apache.org/userslist.html> for more info.
>To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>   "   from the digest: users-digest-unsubscribe@httpd.apache.org
>For additional commands, e-mail: users-help@httpd.apache.org
>
>
Diese E-mail ist eine private und pers=F6nliche Kommunikation. Sie hat
keinen Bezug zur B=F6rsen- bzw. Gesch=E4ftst=E4tigkeit der SWX Swiss =
Exchange.
This e-mail is of a private and personal nature. It is not related to
the exchange or business activities of the SWX Swiss Exchange. Le
pr=E9sent e-mail est un message priv=E9 et personnel, sans rapport avec
l'activit=E9 boursi=E8re de la SWX Swiss Exchange.

This message is for the named person's use only. It may contain
confidential, proprietary or legally privileged information. No
confidentiality or privilege is waived or lost by any mistransmission.
If you receive this message in error, please notify the sender urgently
and then immediately delete the message and any copies of it from your
system. Please also immediately destroy any hardcopies of the message.
You must not, directly or indirectly, use, disclose, distribute, print,
or copy any part of this message if you are not the intended recipient.
The sender's company reserves the right to monitor all e-mail
communications through their networks. Any views expressed in this
message are those of the individual sender, except where the message
states otherwise and the sender is authorised to state them to be the
views of the sender's company.=20


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org