1

In web, what is a certificate issued to, a website, a web server or a web application?

Which has to handle certificate, a website, a web server or a web application?

For example, when I run a web application on Nginx, an article shows to configure Nginx to support HTTPS and certificates.

  • I was wondering if a web application has to be implemented to support HTTPS and certificates? (I hope not, because that will make web application development simpler)

  • A web server can host multiple websites, so I was also wondering if the configuration of Nginx and the certificate are at the web server level or web site level?

Thanks.

1
  • These terms are very broad and can mean a few different things (especially for different people). It may help answer-ers (and also yourself) if you can clarify your terminology and how you mean them. Feb 7 '20 at 14:00
3

A Web Server handles certificates and TLS connections

A web site itself is simply an HTML document, possibly including scripts and stylesheets, and references to other resources (external scripts, styles, images, etc.). The document itself is not aware if it is served via HTTP or HTTPS, and if so, which certificate was used for that.

Instead, these things are handled by the web server. A web server, such as nginx, can be given a certificate and the private key associated with the certificate. If configured to server HTTPS, then the web server will use said certificate in any incoming TLS connection.

Regarding Multiple Certificates

You seem to confuse "web site" for "web server", in regards to nginx. A web site is one document, where as a "web server" is one logical unit for nginx, with its own configuration and, more importantly, host name.

As such, nginx can be configured as follows:

server {
    listen 443;
    server_name server1.example.org
    ssl_certificate cert1.pem;
    ssl_certificate_key key1.pem;
}

server {
    listen 443;
    server_name server2.example.org
    ssl_certificate cert2.pem;
    ssl_certificate_key key2.pem;
}
...

If the web server was reached with the hostname server1.example.org, it would serve the certificate found in cert1.pem. Likewise, if it was reached as server2.example.org, it would server the certificate from cert2.pem.

Regarding Web Applications

Likewise, a "web application" is just a fancy name for a document with some server-side logic behind. But this also does not handle any certificates or TLS connections. In fact, it would make a web application a lot less portable if it did so, because any change in certificate would require changes to the codebase.

This split was done intentionally, as it separates two different tasks. The task of the web server is to accept incoming connections, parse HTTP requests, handle TLS connections, etc.. Once all of this is done, the web server forwards the parsed requests to the web application, which then handles all the application logic.

4
  • Thanks. 1) In nginx config file, it can have several server directives. Does each server directive define a web server or a web site? 2) Book The HTTP Definitive Guide says a web server can host multiple websites by virtual hosting. How does Nginx allows users to specify websites and specify to use virtual hosting to host multiple websites?
    – Tim
    Feb 7 '20 at 14:19
  • Although rare, there are some cases where a web application might handle its own SSL needs, especially if building your own socket server (aka working more directly with the TCP/IP stream). I've had to do it once or twice, although for the reasons you point out, you usually want to avoid it. Feb 7 '20 at 14:20
  • @Tim 1.) A server directive defines one web server. Each webserver can have many websites. 2.) You confuse the nginx server software for one "logical" server as defined in the configuration. nginx tells web servers apart by the server name directive, as shown in my answer.
    – MechMK1
    Feb 7 '20 at 14:25
  • Web site vs Web server? These are not specific terms and generally there is no difference. en.wikipedia.org/wiki/Website
    – jwilleke
    Feb 8 '20 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.