You may try to use multiple host names in a single cert. Tested with apache
only, not with resin. Anyway, all vhosts have to use the same cert. Maybe
some of the following notes can help:

- csr generation tool using subjectAltName extension
        wget http://svn.cacert.org/CAcert/CSRGenerator/csr

- csr generation by script (will add subjectAltName extension to conf)
        sh csr

- modifying opennssl.cnf in order to sign request with extension
        [ v3_ca ]
        subjectAltName = critical,DNS:localhost1,DNS:localhost2

- signing the cert request
        openssl x509 -req -days 99 -extfile /etc/ssl/openssl.cnf \
                -extensions v3_ca -in lxwww2_csr.pem \
                -signkey host_privatekey.pem -out host_crt.pem

- check csr and crt (must contain X509v3 Subject Alternative Name)
        openssl req -in host_csr.pem -noout -text
        openssl x509 -in host_crt.pem -noout -text

- security issuses with subjectAltName and esp. wildcards:
        http://nils.toedtmann.net/pub/subjectAltName.txt

- browser compability
        http://wiki.cacert.org/wiki/VhostTaskForce#InteroperabilityTest and
http://www.switch.ch/pki/meetings/2007-01/namebased_ssl_virtualhosts.pdf

Best regards
Martin


-----Urspr√ľngliche Nachricht-----
Von: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Im Auftrag von Mattias Jiderhamn
Gesendet: Montag, 29. September 2008 12:24
An: Resin
Betreff: [Resin-interest] SSL - Different cert per virtual host?

Hi, I want to know if it is possible to set up Resin to use multiple SSL
certificates on the same server, each used for a different (virtual) host?

That is, I want the same Resin instance to correspond both to foo.com
with its SSL certificate and bar.com with its SSL certificate (on the
same port). Is that possible? How?

 /Mattias


_______________________________________________
resin-interest mailing list
resin-interest@caucho.com
http://maillist.caucho.com/mailman/listinfo/resin-interest



_______________________________________________
resin-interest mailing list
resin-interest@caucho.com
http://maillist.caucho.com/mailman/listinfo/resin-interest

Reply via email to