Re: Apache for SSL Proxy? -- WEB400

Yes, you can do it and you need one external IP per domain.

If you're using subdomains you can use one cert for all
subdomains if you get a wildcard certificate (ie
*.mydomain.com).

Brad

On Mon, 9 Aug 2004 07:50:20 -0500
 "Jones, John (US)" <John.Jones@xxxxxxxxxxxxxxxxxxxxxxx>
wrote:
> So, you can do it but you need multiple IP addresses.
>   Is that correct
> or am I missing something?
> 
> TIA,
> 
> John A. Jones
> Americas Security Officer
> Jones Lang LaSalle, Inc.
> V: +1-630-455-2787 F: +1-312-601-1782
> John.Jones@xxxxxxxxxxxxxxxxxxxxxxx
> 
> -----Original Message-----
> From: Brad Stone [mailto:brad@xxxxxxxxxxxx] 
> Sent: Sunday, August 08, 2004 4:32 PM
> To: Web Enabling the AS400 / iSeries
> Subject: Re: [WEB400] Apache for SSL Proxy?
> 
> After some research on this, I found that it isn't
> possible.
> 
> Because SSL wraps the entire HTTP request (including the
> host headers)
> you currently need to have one IP for each SSL site you
> are running.  If
> it's behind a firewall, that means one external, and one
> internal per
> SSL site that is using a seperate certificate.
> 
> Even a firewall that can route by host name won't work
> with
> 2 domains using different certs.  Subdomain sites and the
> use of a
> wildcard certificate shouldn't be an issue.  But that
> isn't the case for
> my query.
> 
> Because SSL wraps the HTTP request, the web server must
> decrypt the
> request before applying any host matching, such as with
> Virtual Hosts.
> So, as Apache puts it, it's a "chicken and egg" problem.
>  Which comes
> first.  So, Apache always will use the first certificate
> specified in
> the config to do any decrypting.
> 
> There is an RFC in the works to solve this issue, but I
> wouldn't expect
> it to be implemented anytime soon juding from the talk
> about it.
> 
> Anyhow, it does make sense.  I wasn't completley aware
> that SSL wrapped
> everying... I assumed the headers were available... guess
> not.  :)  
> 
> Hope this helps for anyone else that ever ventures down
> this road.
> 
> 
> This email is for the use of the intended recipient(s)
> only.  If you have received this email in error, please
> notify the sender immediately and then delete it.  If you
> are not the intended recipient, you must not keep, use,
> disclose, copy or distribute this email without the
> author's prior permission.  We have taken precautions to
> minimize the risk of transmitting software viruses, but
> we advise you to carry out your own virus checks on any
> attachment to this message.  We cannot accept liability
> for any loss or damage caused by software viruses.  The
> information contained in this communication may be
> confidential and may be subject to the attorney-client
> privilege. If you are the intended recipient and you do
> not wish to receive similar electronic messages from us
> in future then please respond to the sender to this
> effect.
> 
> _______________________________________________
> This is the Web Enabling the AS400 / iSeries (WEB400)
> mailing list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the
> archives
> at http://archive.midrange.com/web400.
> 

Bradley V. Stone
BVS.Tools
www.bvstools.com