top button
Flag Notify
    Connect to us
      Facebook Login
      Site Registration Why to Join

Facebook Login
Site Registration

How to access multiple virtual hosts with a single SSL instance?

0 votes
155 views

How to use multiple virtual hosts with a single SSL instance running on the standard https port.

posted Aug 12, 2014 by Bob Wise

Share this question
Facebook Share Button Twitter Share Button Google+ Share Button LinkedIn Share Button Multiple Social Share Button
SNI allows me to use separate SSL certificates for each virtual server. It looks like Tomcat does not yet support it.

I guess I am sticking to using Apache in front of Tomcat.

1 Answer

+1 vote

Tomcat uses both hostname + path to determine where the request should go: if you have multiple virtual hosts, then /foo might map to two different virtual hosts depending upon the Host header (or URL, which
generally agree with each other).

The only complication TLS adds is that a certificate often only has one single hostname in it, and the server can only bind to "all interfaces" on a single port (e.g. 443) a single time. Thus, administrators often have to pick a certificate that will work for everyone.

As you have mentioned, SNI offers a way around this: the client can notify the server which host they are attempting to contact and the server can reply with the preferred certificate for that host. I don't believe Tomcat has direct support for SNI, though Java 7+ should be able to handle it if the server software (Tomcat in this case) is capable. I haven't looked into how it can be done, but at this point, Tomcat should probably include this feature, at least for JSSE.

There are other ways to get around this, including using wildcard TLS certificates, binding to different network interfaces to get s unique interface/port combination for each certificate, etc.

Tomcat /can/ be used, here, but it currently takes some creativity.

answer Aug 13, 2014 by Dewang Chaudhary
Similar Questions
+1 vote

I'm using apache 2.2 as front end and apache tomcat 6.0.37 as backend. I'm using mod_jk for connecting them.

The problem is. I'm using ssl certificates and configured ssl on apache. when I connect the site with https it works but when I click on an link it no more secure i.e. its not secure browsing anymore.

My requirement is as follows.

If user connects as https all the links should work as https. If the user connects as http all the links should work as http is such thing is possible?

+1 vote

I have 3 virtual hosts that for all I can see are configured identically other the the obviously needed differences. The same is true of the 3 crt files.

 ServerName public.mydomain.com
 DocumentRoot /var/www/html
 SSLEngine on
 SSLCertificateFile /etc/httpd/SSL/public.crt
 SSLCertificateKeyFile /etc/postfix/SSL/server.key

 ServerName distrib.mydomain.com
 DocumentRoot /var/www/html/distrib
 SSLEngine on
 SSLCertificateFile /etc/httpd/SSL/distrib.crt
 SSLCertificateKeyFile /etc/postfix/SSL/server.key

 ServerName mail.mydomain.com
 DocumentRoot /usr/local/squirrelmail/www
 SSLEngine on
 SSLCertificateFile /etc/httpd/SSL/mail.crt
 SSLCertificateKeyFile /etc/postfix/SSL/server.key

The problem is that 2 of them work perfectly and the lock shows up in the browser. With the third (public), I get a gray globe indicating partial encryption which does not prevent eavesdropping. I have no clue
how to debug this or even where to look. Can someone point me in the right direction?

+1 vote

How do I checks what ciphers are available to the https compiled binary, and how do I check with of those are active in the configuration?

Is there any technical reason that ECDHE-RSA-AES128-SHA256 cannot be used on a server with a self-signed cert (there's no e-commerce or any financial data of any sort on the server).

If an existing server wants to switch so that all traffic is encrypted using DH if possible (interested in implementing Perfect Forward Secrecy) are there any "Gotcha's" lurking in the bushes?

If you enable ECDHE-RSA-AES128-SHA256, should you disable EDH?

To be accessible for most people (including some Windows XP users), what else do I need to enable in the cipher suite? RC4? RC4-SHA? TLSv1? AES?

Which ones do I need to avoid?

0 votes

how to manage the secured connection error in HTTPS?

+1 vote

In my webapp there's a directory '/admin' that's protected under SSL. Users are forced to use SSL via a security constraint in web.xml. It works great.

As mentioned in the docs and other places, it would be good to prevent SSL everywhere else on the site, but I searched around and couldn't find anything that works.I tried adding another security constraint with transport guarantee set to NONE for url-pattern '/*' but it didn't prevent https access to the site as a whole.

What's the correct way to selectively restrict https to only one area of a webapp?

Contact Us
+91 9880187415
sales@queryhome.net
support@queryhome.net
#280, 3rd floor, 5th Main
6th Sector, HSR Layout
Bangalore-560102
Karnataka INDIA.
QUERY HOME
...