RE: using multiple digital certificates

Great Explanation Scott.  Thank you. 


Christopher Bipes
Information Services Director
CrossCheck, Inc.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Scott Klement
Sent: Tuesday, July 25, 2006 9:53 AM
To: Midrange Systems Technical Discussion
Subject: Re: using multiple digital certificates

Is it possible to assign multiple digital certificates to a single 
apache web server instance? We host one secure name now for three 
different sites but want to switch to using three different names each

with their own certificate.

Others have explained that you can't do it with name-based virtual
hosts, you have to use IP-based virtual hosts...  I'll attempt to
explain why that is...

Name based virtual hosting works by looking at the hostname sent by the
browser in it's GET or POST request. For example, a browser will send
something like this:

GET /apps/payables/pendinginvoices?invno=12345&acct=4321 HTTP/1.1
Host: ais.pct.edu:443

Apache looks at the Host: keyword and uses it to decide which virtual
host the request is for.  In this case, the browser sent "ais.pct.edu"
so the server knows to look for a virtual host with that name.

But this can't be used to determine the SSL certificate...

Why not?  Because the SSL session, certificates and encryption are
established BEFORE that GET request was sent.  It has to be!  You want
the data on the GET request (in this example, an invoice number and
account
number) to be encrypted.  What if you sent a credit card number?  Or
some other sensitive information?  The encryption needs to be activated
before that GET request was sent.

If the GET request hasn't been sent yet, there's no possible way for the
host: keyword that's part of that request to be used in establishing
certificates.

Instead, you need to use IP-based virtual hosts. The IP address is known
before the SSL session is established, and therefore can be used to
decide which certificate to send.  Unfortunately, this means that you
have to have a separate IP address for each certificate.