Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am researching if I can host multiple domains on one server through HTTPS but for each domain, I have a different certificate.

In this case, I would need to know the domain of the incoming connection so in that first part of the SSL handshake, will it have the information I need to send back the correct certificate for that domain?

share|improve this question
12  
The search term you need for this case is "SNI" - Server Name Indication – Matthew Feb 10 at 8:55
2  
You need SNI only if you cannot use different IP addresses for the different domains. This could be important as in the Xander's answer you can see that some older clients do not support SNI. – pabouk Feb 10 at 9:40
4  
If you need to support clients that don't send SNI, you could use a Subject Alternative Names certificate which lists all relevant domain names in the same certificate (or a wildcard certificate if they're subdomains of the same domain). – CodesInChaos Feb 10 at 10:35
3  
At this point, if you're still using a client too old to understand SNI, not getting HTTPS properly is the least of your problems. – Shadur Feb 10 at 11:58
1  
@CodesInChaos There are scenarios where generating a certificate covering all the possible domain names is not feasible. – kasperd Feb 10 at 18:32
up vote 24 down vote accepted

Yes, as long as the server and the clients support the Server-Name-Indication (or SNI) extension. This extension allows for virtual hosting for HTTPS, where you have multiple independent domains and certifications bound to a single IP address.

Most clients these days do support SNI. The place where you might have issues is if you have older clients using platforms like Windows XP, old versions of Android, or Java 6.

share|improve this answer
1  
Comments are not for extended discussion; this conversation has been moved to chat. – AviD Feb 11 at 0:57

Without SNI, the domain first appears in cleartext in the Server Hello of the TLS handshake (In the rdnSequence of the Certificate field).

With SNI, the domain first appears in cleartext in the Client Hello of the TLS handshake (In the SNI field).

Source: I fired up apache2 with TLS and took packet captures before and after implementing SNI (Virtual Hosts in apache2).

share|improve this answer
3  
Only the second case can be used for what is being asked for in the question - allow the server to select right domain and certificate at the beginning of the SSL/TLS handshake. --- The first case can be used for example by security devices (like firewalls, IPS, URL filtering, application detection etc.) to be able to distinguish domain names without SSL/TLS decryption. – pabouk Feb 10 at 9:45

Aside from SNI, there is an option to get a multi-domain certificate. Several certificate providers offer such certificates (not endorsing anyone, Google is your friend).

With a multi-domain certificate, you don't need to know the domain name at the beginning of the handshake, as the certificate is effectively valid for all the domain names listed.

Here's how an example of how such certificate looks like:

enter image description here

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.