RE: Issue with SSL server/ network configuration

2009-03-20 Thread i_am_superman
Peter Crowther wrote: From: i_am_superman [mailto:ee...@objectivation.nl] is there a simple way to map one domain name to two different SSL connectors? I don't think there is, unless you want part of your application to be accessible from a different port. So the part that doesn't

RE: Issue with SSL server/ network configuration

2009-03-20 Thread Peter Crowther
From: i_am_superman [mailto:ee...@objectivation.nl] is there a simple way to map one domain name to two different SSL connectors? I don't think there is, unless you want part of your application to be accessible from a different port. So the part that doesn't need certs might be at

Re: Issue with SSL server/ network configuration

2009-03-20 Thread i_am_superman
Gregor Schneider wrote: How about a self-seigned cert? A nasty browser-window will pop up once, however, the users could import the server-cert into their browser, and then they#re done It's gonna be a public government website, so a self-signed certificate will not be an option :-)

Re: Issue with SSL server/ network configuration

2009-03-20 Thread André Warnier
i_am_superman wrote: It's gonna be a public government website, so a self-signed certificate will not be an option :-) Considering the amount of taxpayer money that governments are currently pumping into failed financial institutions and car makers, I'm sure they could afford a 400 €

RE: Issue with SSL server/ network configuration

2009-03-20 Thread Peter Crowther
From: i_am_superman [mailto:ee...@objectivation.nl] I don't think my client will allow me to run a public SSL website any port but 443 (firewalls). Then you'll also need a second IP address on the server, as I'm sure you've already realised. - Peter

Re: Issue with SSL server/ network configuration

2009-03-20 Thread i_am_superman
awarnier wrote: i_am_superman wrote: It's gonna be a public government website, so a self-signed certificate will not be an option :-) Considering the amount of taxpayer money that governments are currently pumping into failed financial institutions and car makers, I'm sure they

RE: Issue with SSL server/ network configuration

2009-03-20 Thread Darren Kukulka
Why not opt for a wildcard certificate for the domain, if that's applicable (e.g. *.yourcompany.com) -Original Message- From: i_am_superman [mailto:ee...@objectivation.nl] Sent: 20 March 2009 11:52 To: users@tomcat.apache.org Subject: Re: Issue with SSL server/ network configuration

Re: Issue with SSL server/ network configuration

2009-03-20 Thread Gregor Schneider
On Fri, Mar 20, 2009 at 12:10 PM, i_am_superman ee...@objectivation.nl wrote: If anyone else has another idea, please respond. How about a self-seigned cert? A nasty browser-window will pop up once, however, the users could import the server-cert into their browser, and then they#re done Rgds

RE: Issue with SSL server/ network configuration

2009-03-20 Thread i_am_superman
Darren Kukulka wrote: Why not opt for a wildcard certificate for the domain, if that's applicable (e.g. *.yourcompany.com) Hi Darren, Interesting idea! What are the restrictions on wildcard certificates? If I have two subdomains with one wildcard certificate, do I still need the two IP

RE: Issue with SSL server/ network configuration

2009-03-20 Thread Peter Crowther
From: i_am_superman [mailto:ee...@objectivation.nl] we have 3 environment (test, accept, prod) so we need 3 extra certificates. No big deal indeed, but I need to be sure that I really need them. Get a wildcard certificate? They're about 3 times the price of a regular cert, and can

RE: Issue with SSL server/ network configuration

2009-03-20 Thread Peter Crowther
From: i_am_superman [mailto:ee...@objectivation.nl] What are the restrictions on wildcard certificates? Some very old browsers don't understand them. Probably not a problem in your environment, but check your client's browser support requirements. If I have two subdomains with one wildcard

RE: Issue with SSL server/ network configuration

2009-03-20 Thread i_am_superman
Peter Crowther wrote: Or is the IP address tied to the (wildcard) certificate? IP addresses are never tied to certificates. Certificates allow browsers to authenticate based on the common name in the certificate, and the hostname that the browser is using to access the site. Yep, I

Re: Issue with SSL server/ network configuration

2009-03-20 Thread Gregor Schneider
On Fri, Mar 20, 2009 at 12:36 PM, André Warnier a...@ice-sa.com wrote: Considering the amount of taxpayer money that governments are currently pumping into failed financial institutions and car makers, I'm sure they could afford a 400 € certificate, no ? Or is it that bad ? +1 Cheers

Re: Issue with SSL server/ network configuration

2009-03-20 Thread Gregor Schneider
Peter, On Fri, Mar 20, 2009 at 2:05 PM, i_am_superman ee...@objectivation.nl wrote: I just don't understand it; how do hosting companies host 2 sites on one box with a certificate each? That'll be a lot of IP address juggling.. Well, we f.e. do have a box 8ok, actually two boxes behind a