Enabling SSL for Apache2

Apache2 and SSL

The problem with SSL and Virtual Hosting

To enable SSL for Apache2, you must first realise some important limitations. First off: let's look at simple HTTP. One Apache instance can run multiple websites on one server (one IP address), as so-called virtual hosts. The visitors type in any one of your websites (www.saruman.biz or www.iceditch.nl), get the same IP number (212.238.151.172), and send the HTTP request there, on port 80. Apache receives the request, looks in it, notices the actual URI in it (say: http://www.saruman.biz or http://www.saruman.biz/wiki/index.php/Main_Page), and directs the request to the right website, the right virtual host.

Now consider what happens if we introduce SSL: any request to the HTTPS-port of the server (port 443) is encrypted using the public SSL-certificate of the server. However, this certificate is investigated by the browser of your visitors - one of the (sets of) things that must match, is the common name of the certificate (which must match the DNS-name of the website your visitor is visiting). Thus, a visitor for https://www.saruman.biz expects the SSL certificate to be in the name of www.saruman.biz, but a visitor for https://www.iceditch.nl expects the certificate to be in the name of www.iceditch.nl. Reasonable, eh? But wait - the single Apache2 webserver can have multiple websites, but only one SSL certificate! And that'll be presented to the visitor before Apache gets to hear which virtual host the visitor wants to visit.

This means that when multiple virtual hosts on a single Apache2 webserver are "put on SSL", they all share the same SSL certificate. And this means that if we have an SSL certificate for www.saruman.biz, that visitors to the HTTPS-version of www.saruman.biz will be presented the "right" SSL certificate, but visitors to the HTTPS-version of www.iceditch.nl will get a certificate for www.saruman.biz as well - leading to nagging warnings in the browser of each one of your visitors.

In effect, you can run only one virtual host, that's accessible over HTTPS, and gets no raised eyebrows on the certificate name issue. SO! Is this a totally unavoidable problem? For most situations: yes. But in some cases there are workarounds.

SSL for your main protected website

First we determine which one of our virtual hosts (assuming you have multiple) we need to provide SSL for. If you have multiple IP numbers for your servers, then you can select the same number of virtual hosts without running into the problems described previously. The only prerequisite for this is, that you've mapped each of those virtual hosts to a different IP number, so that a request to virtual host "one" gets resolved to IP address "one", virtual host "two" to IP address "two" et cetera.

Now we can start by obtaining the necessary SSL certificates.