2

I have a server running Ubuntu 12.04.3 LTS and two running Ubuntu 14.04.1 LTS, of which have SSL certificates on them. All are bitnami stacks so have their apache2 config files in:

/opt/bitnami/apache2/conf/bitnami

The requirement was for multiple domain name certificates for two domains with and without www. so really 4 in total.

website.com
www.website.com
website.co.uk
www.website.co.uk

In the end it had one certificate for all these domains set up in the virtual-host _default_:443 section of the Apache2 bitnami.conf file. However the certificate provider suggested having two certificates instead of one (as it would be cheaper).

  • Is it possible to have two certificates in the Apache2 conf when there is only one physical server for both domains?

  • If so then how would you set up the virtual-host to handle two certificates?

3

You can only have one certificate per virtualhost. But this is free software. There is no cost (and very little overhead) to just adding a separate virtualhost for each domain with its own certificate.

Unless the content ever differs, I would go one step further and pick one domains as your main domain and have all the others redirect to it. This is generally best to keep search engines happy (and the links people spread organically will be to the same domain).

Anyway, that results in three virtualhosts:

  • The one you host from. Eg www.website.com
  • One with the same domain but with the alternate prefix (eg website.com) to redirect to the main one, eg website.com. Uses the same certificate.
  • One for each alternative TLD (capturing both www and www-less) to redirect.

There are some benefits from a single multi-domain certificate:

  • IE8 and earlier on XP and earlier doesn't support SNI which means you need a single, legal IP address per certificate. Multi-domain certs make that easy to work around because you just throw out the same cert for every request.
  • Less to update when the cert expires.

That usually doesn't outweigh their cost though. And they're fixed things so if you need to add another domain, you have to pay the full price. Nabbing a load of IPv4 addresses is still cheaper.

And even with a multi-domain cert, I'd still use three virtualhosts to redirect to one domain.

  • So I can have a virtual host, for www. and without, on the same cert, then a third virtual host for the .co.uk site? And just redirect? That's handy to know. Thank you. – Aravona Oct 8 '15 at 7:59
  • That assumes your certificates cover www and www-less. Many issuers will give you the choice but default to www as the prefix for the additional subdomain. – Oli Oct 8 '15 at 8:00
  • That makes sense, the premise came simply because they thought having 2 certs would be cheaper than 1 and I wanted to know the feasibility. Looks simple enough. – Aravona Oct 8 '15 at 8:02
  • 1
    Multiple-domain certs have their benefits (you need IE8/XP support and only have a single IP) but they're super-expensive for what they are. Hopefully that will change in time. – Oli Oct 8 '15 at 8:04
2

It possible to have one certificate per domain. To achieve that, you need to create virtual host file for each domain. Let us taking example as website.com.

  1. Ypu can find the default SSL template file at /etc/apache2/sites-available/default-ssl.

  2. We will make a new file instead. /etc/apache2/sites-available/website.com.

  3. Edit the new file to match below example:

    <IfModule mod_ssl.c>
    <VirtualHost 192.168.0.100:443>
        ServerAdmin webmaster@website.com
        ServerName website.com:443
        DocumentRoot /var/www/website.com
    
        <Directory />
            Options FollowSymLinks
            AllowOverride None
        </Directory>
    
        <Directory /var/www/website.com>
            Options Indexes FollowSymLinks MultiViews
            AllowOverride None
            Order allow,deny
            allow from all
        </Directory>
    
        SSLEngine on
        SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key
    </VirtualHost>
    </IfModule>
    
  4. Then activate the new file. sudo a2ensite website.com

  5. Reload apache sudo service apache2 reload

  • depends on your certificate provider. What CN that certificate are signed for? Looks like you are not using default httpd installation, then you need to adjust based on your environment. Yes you may set it up in httpd.conf as well. – Aizuddin Zali Oct 8 '15 at 7:34
  • CN is common name, which is your domain name. If the certificate request is for website.com, then the certificate can only be used for website.com. Basically you dont use ubuntu default apache2 installation. – Aizuddin Zali Oct 8 '15 at 7:36
  • then you are good to go. Just add those line in httpd.conf. of course with servername www.website.com – Aizuddin Zali Oct 8 '15 at 7:38
  • Same thing, just repeat the virtual host config section for another domain. However this is bitnami, you should better asking this question on bitnami forum instead of askubuntu, where this is not a default installation on ubuntu. – Aizuddin Zali Oct 8 '15 at 7:45
  • So I can have two virtual hosts using _default_:443 that's not an issue? And it's still ubuntu, they just use httpd.conf to include bitnami.conf to, in their eyes, make it tidier. - Tidy up your comments and I'll upvote as this has helped explain. – Aravona Oct 8 '15 at 7:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.