Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 9.2 \(3112\))
From: Stefan Eissing <stefan.eissing@greenbytes.de>
In-Reply-To: <56B1DA3D.8060102@felipegasper.com>
Date: Wed, 3 Feb 2016 11:54:21 +0100
Content-Transfer-Encoding: quoted-printable
Message-Id: <BF0B37EA-82C5-4C8E-98E1-6981B8F8695E@greenbytes.de>
References: <56AF895F.5060704@felipegasper.com> <56AF92E0.1020104@uni-due.de>
 <56AF93ED.5020005@felipegasper.com>
 <CACsi251QTqg7fh=vvBP-02dkJrgdNkQPm_u_yM7u13aee0BY7w@mail.gmail.com>
 <56B1DA3D.8060102@felipegasper.com>
To: users@httpd.apache.org
Subject: Re: [users@httpd] SNI SSL per domain?

common.conf:

<Locationwhatever...
...
...
---------------------------

<VirtualHost *:443>
  ServerName foo.tld

  SSLCertificateFile foo.pem

  Include common.con
</VirtualHost>
<VirtualHost *:443>
  ServerName bar.tld

  SSLCertificateFile bar.pem

  Include common.con
</VirtualHost>


> Am 03.02.2016 um 11:45 schrieb Felipe Gasper =
<felipe@felipegasper.com>:
>=20
> What if I have a vhost with:
>=20
> ServerName foo.tld
> ServerAlias bar.tld
>=20
> =E2=80=A6 but I have two separate SSL certificates for these domains? =
Is there any way to accommodate this without either splitting the =
domains onto separate vhosts or buying a new certificate that covers =
both domains?
>=20
> -FG
>=20
> On 3 Feb 2016 12:26 AM, William A Rowe Jr wrote:
>> Sounds like you have mis-structured the config.  Per servername - =
each
>> can and should have its own cert and will be selected via SNI.  If =
there
>> are subadmins beneath each vhost section #include those snippets and
>> they all still fall within the given host name.
>>=20
>> On Feb 1, 2016 11:21 AM, "Felipe Gasper" <felipe@felipegasper.com
>> <mailto:felipe@felipegasper.com>> wrote:
>>=20
>>    On 1 Feb 2016 12:16 PM, Oscar Knorn wrote:
>>=20
>>        On 2016/02/01 Felipe Gasper wrote:
>>=20
>>            Hello,
>>=20
>>                  Is it possible to do SNI SSL per domain rather than
>>            per vhost? If
>>            not, is there a feature request in for this?
>>=20
>>                  Thank you!
>>=20
>>            -Felipe Gasper
>>            Houston, TX
>>=20
>>            =
---------------------------------------------------------------------
>>            To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>>            <mailto:users-unsubscribe@httpd.apache.org>
>>            For additional commands, e-mail: =
users-help@httpd.apache.org
>>            <mailto:users-help@httpd.apache.org>
>>=20
>>=20
>>=20
>>        Hello Felipe,
>>=20
>>        are'nt in your configuration the domains organized in vhost =
sections
>>        yet? Do you think, there might be a reason you can't organize
>>        them that way?
>>=20
>>        Cheers Oscar
>>=20
>>=20
>>    Hi Oscar,
>>=20
>>    Thanks for responding!
>>=20
>>    We have end users customizing their own vhost configurations via a
>>    limited-access interface; hence, I can=E2=80=99t put one domain =
per vhost.
>>=20
>>    -F
>>=20
>>    =
---------------------------------------------------------------------
>>    To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>>    <mailto:users-unsubscribe@httpd.apache.org>
>>    For additional commands, e-mail: users-help@httpd.apache.org
>>    <mailto:users-help@httpd.apache.org>
>>=20
>=20
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
>=20


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org