Return-Path: Delivered-To: apmail-httpd-users-archive@www.apache.org Received: (qmail 20519 invoked from network); 24 Jan 2011 15:40:13 -0000 Received: from hermes.apache.org (HELO mail.apache.org) (140.211.11.3) by minotaur.apache.org with SMTP; 24 Jan 2011 15:40:13 -0000 Received: (qmail 17398 invoked by uid 500); 24 Jan 2011 15:40:10 -0000 Delivered-To: apmail-httpd-users-archive@httpd.apache.org Received: (qmail 17250 invoked by uid 500); 24 Jan 2011 15:40:06 -0000 Mailing-List: contact users-help@httpd.apache.org; run by ezmlm Precedence: bulk Reply-To: users@httpd.apache.org list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list users@httpd.apache.org Received: (qmail 17238 invoked by uid 99); 24 Jan 2011 15:40:05 -0000 Received: from athena.apache.org (HELO athena.apache.org) (140.211.11.136) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 24 Jan 2011 15:40:05 +0000 X-ASF-Spam-Status: No, hits=2.2 required=10.0 tests=HTML_MESSAGE,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (athena.apache.org: local policy) Received: from [64.30.36.242] (HELO mail2.geigerus.com) (64.30.36.242) by apache.org (qpsmtpd/0.29) with ESMTP; Mon, 24 Jan 2011 15:40:01 +0000 In-Reply-To: <4D3D42D6.1080906@ics.muni.cz> References: <4D3D42D6.1080906@ics.muni.cz> To: users@httpd.apache.org MIME-Version: 1.0 X-KeepSent: 9D1CDA14:0DED24EE-85257822:0055DB75; type=4; name=$KeepSent X-Mailer: Lotus Notes Release 8.5.2 August 10, 2010 Message-ID: From: Wolfgang.Miska@geigerus.com Date: Mon, 24 Jan 2011 10:39:39 -0500 X-MIMETrack: Serialize by Router on DOMSRVUS1/GEIGERUS(Release 8.5.2|August 10, 2010) at 01/24/2011 10:40:00, Serialize complete at 01/24/2011 10:40:00 Content-Type: multipart/alternative; boundary="=_alternative 005606E885257822_=" Subject: Re: [users@httpd] Name-based SSL virtual hosts --=_alternative 005606E885257822_= Content-Type: text/plain; charset="US-ASCII" Hi Martin, Thanks for the info. Guess I have some reading to do! My Best! Wolfgang Wolfgang Miska Executive Vice President GEIGER of Austria, Inc. 38 Pond Lane P.O. Box 728 Middlebury, VT 05753-0728 (802) 388-3156 (802) 388-9745 Fax www.geigerofaustria.com Martin Kuba 01/24/2011 04:13 AM Please respond to users@httpd.apache.org To users@httpd.apache.org cc Subject Re: [users@httpd] Name-based SSL virtual hosts Hi Wolfgang, there is a chicken-and-egg problem with name-based virtual hosts and SSL. The SSL connection is established *before* HTTP communication, so the SSL server does not know what Host: HTTP header will be sent in the moment it decides which SSL server certificate to send. So for SSL HTTP servers, each server needs its own IP address, virtual named-based hosts are not possible. There is a solution for this problem, it is a change in the SSL protocol which allows to send host name in the SSL handshake. However it is not supported by all web browsers. For details see http://en.wikipedia.org/wiki/Server_Name_Indication#The_fix In a nutshell, if you want to support MSIE on Windows XP, you cannot use it. I solve this by using one IP address for all SSL servers with the same DNS domain owner, and a SSL server certificate that has all the server names as subjectAltNames. That works for all browsers, but it is some hassle to create a new certificate for all names each time a new SSL server is added. Cheers Martin Dne 21.1.2011 22:18, Wolfgang.Miska@geigerus.com napsal(a): > Hi, > > I am not too familiar with Apache, so the following message has stumped me. > > [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366) > > Can somebody explain what that means and what are the consequences? > > Thanks so much! > > > Wolfgang -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Supercomputing Center Brno Martin Kuba Institute of Computer Science email: makub@ics.muni.cz Masaryk University http://www.ics.muni.cz/~makub/ Botanicka 68a, 60200 Brno, CZ mobil: +420-603-533775 -------------------------------------------------------------- --=_alternative 005606E885257822_= Content-Type: text/html; charset="US-ASCII" Hi Martin,

Thanks for the info. Guess I have some reading to do!

My Best!

Wolfgang

Wolfgang Miska
Executive Vice President

GEIGER of Austria, Inc.
38 Pond Lane
P.O. Box 728
Middlebury, VT 05753-0728

(802) 388-3156  (802) 388-9745 Fax

www.geigerofaustria.com


Martin Kuba <makub@ics.muni.cz>

01/24/2011 04:13 AM
Please respond to
users@httpd.apache.org
To
users@httpd.apache.org
cc
Subject
Re: [users@httpd] Name-based SSL virtual hosts





Hi Wolfgang,

there is a chicken-and-egg problem with name-based virtual hosts
and SSL. The SSL connection is established *before* HTTP communication,
so the SSL server does not know what Host: HTTP header will be sent
in the moment it decides which SSL server certificate to send.

So for SSL HTTP servers, each server needs its own IP address,
virtual named-based hosts are not possible.

There is  a solution for this problem, it is a change in the SSL protocol
which allows to send host name in the SSL handshake. However it is not
supported by all web browsers.

For details see
http://en.wikipedia.org/wiki/Server_Name_Indication#The_fix

In a nutshell, if you want to support MSIE on Windows XP, you cannot use it.

I solve this by using one IP address for all SSL servers with the same DNS domain owner,
and a SSL server certificate that has all the server names as subjectAltNames.
That works for all browsers, but it is some hassle to create a new certificate
for all names each time a new SSL server is added.

Cheers

Martin

Dne 21.1.2011 22:18, Wolfgang.Miska@geigerus.com napsal(a):
> Hi,
>
> I am not too familiar with Apache, so the following message has stumped me.
>
> [warn] Init: Name-based SSL virtual hosts only work for clients with TLS server name indication support (RFC 4366)
>
> Can somebody explain what that means and what are the consequences?
>
> Thanks so much!
>
>
> Wolfgang


--
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Supercomputing Center Brno             Martin Kuba
Institute of Computer Science    email: makub@ics.muni.cz
Masaryk University             http://www.ics.muni.cz/~makub/
Botanicka 68a, 60200 Brno, CZ     mobil: +420-603-533775
--------------------------------------------------------------
--=_alternative 005606E885257822_=--