Name-Based Virtual Hosts with SSL

| Comments (6) | TrackBacks (123) |
Say you want to host multiple web sites on the same server. For instance, you want to have http://www.educatedguesswork.org/ go to this blog and http://www.ignorantcertainty.org/ go to its evil twin. Now, it's obviously easy to do if you have two machines, but that's not very efficient, especially if the web sites are fairly low traffic. What you want is virtual hosting--the appearance of having two servers on one physical machine.

There are two basic ways to make this work1. The first is to give the machine two IP addresses. You then have one virtual server listen on one IP and the other on the other (the exact implementation details don't matter). This is called IP-Based Virtual Hosting (IPBVH) and is the old-style way of doing things. The problem, of course, is that IP addresses are a scarce resource and so it's antisocial (and also kind of expensive) to grab enough IP addresses for every virtual host.

The modern way to do things is with Name-Based Virtual Hosting (NBVH). The way that this works is that the Web client provides the server's hostname in its HTTP request, like so:

GET / HTTP/1.1
Host: www.educatedguesswork.org:8080
User-Agent: Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.5) Gecko/20041118 Firefox/1.0
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive

Name-Based Virtual Hosting has two problems. The first is that it requires cooperation from the browser. That's not a big deal now because all browsers have done it for years. The second, larger, problem is that it doesn't work with SSL. The problem is that the SSL handshake happens before the first HTTP request is made, so the server doesn't know which certificate to use in its handshake. Because the certificate contains the host name (otherwise how would you know if you were talking to the right host?) this means that the hostname and cert generally won't match, which tends to freak users out. There is an update to SSL that puts the hostname in the SSL handshake (client cooperation again, naturally), but since it requires changes to the client it will be years before there's enough deployment to let you confidently use NBVH with SSL for most commercial applications.

There is, however, one situation in which NBVH with SSL works just fine--if you don't need the certificate to match the host. The most common situation where this applies is when you're using self-signed certificates rather than third-party certificates. In this environment, you either don't worry about active attack and don't have the users verify the certificate or have them verify the cert fingerprint manually and then trust it from there on (as in SSH). Even if you don't verify the certs at all, it's still better than not having SSL, and there's nothing wrong with the fingerprint method except that it's inconvenient.

In this mode, the server uses the same certificate for all requests, but then does virtual hosting for the HTTP portion. This works fine technically but it's a little hard to set up and the Apache documentation doesn't help much. However, Rob Austein and I got it working and here's an example of the relevant section of the httpd.conf file, with the comments removed:


AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl    .crl


NameVirtualHost 127.0.0.1:8443


SSLPassPhraseDialog  builtin
SSLSessionCache         dbm:/users/ekr/tmp/apache/logs/ssl_scache
SSLSessionCacheTimeout  300
SSLMutex  file:/users/ekr/tmp/apache/logs/ssl_mutex
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
SSLLog      /users/ekr/tmp/apache/logs/ssl_engine_log
SSLLogLevel info
SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP:+eNULL
SSLCertificateFile /users/ekr/tmp/apache/conf/ssl.crt/server.crt
SSLCertificateKeyFile /users/ekr/tmp/apache/conf/ssl.key/server.key




##
## SSL Virtual Host Context
##

#  General setup for the virtual host
DocumentRoot "/users/ekr/tmp/apache/htdocs/lh1"
SSLEngine on
                                  


#  General setup for the virtual host
DocumentRoot "/users/ekr/tmp/apache/htdocs/lh2"
SSLEngine on
                                  

There are two keys to making this work:

  1. The NameVirtualHost directive which lets you use name-based virtual hosts at all.
  2. Putting SSLEngineOn in the virtual host directives.

Acknowledgements: Rob Austein and I worked on this together. I figured out how to make it work but I duplicated all of the SSL config directives in each VirtualHost clause. Rob figured out that you could move them to the main IfModule section, thus cleaning things up substantially.

1. There's actually a third way to make this work: use a separate port for each host. The problem with that is that it requires users to remember the port as well as the hostname, which is pretty unattractive.

123 TrackBacks

Listed below are links to blogs that reference this entry: Name-Based Virtual Hosts with SSL.

TrackBack URL for this entry: http://www.educatedguesswork.org/cgi-bin/mt/mt-tb.cgi/7

All those who believe in telekinetics, raise my hand... by online poker Read More

You are invited to check some relevant pages about pacific poker poker games Read More

casino from casino on June 8, 2005 11:07 AM

Please visit the sites in the field of casino Read More

online poker from online poker on June 8, 2005 7:22 PM

Please visit the sites about online poker Read More

poker rooms from poker rooms on June 9, 2005 4:41 AM

You are invited to check the pages about pacific poker Read More

blackjack from blackjack on June 9, 2005 2:06 PM

Please check out some relevant pages dedicated to free slots Read More

online pharmacy from online pharmacy on June 11, 2005 2:41 AM

Please check some relevant pages in the field of weight loss pills Read More

blackjack from blackjack on June 11, 2005 9:27 PM

In your free time, check some information about blackjack Read More

party poker from party poker on June 12, 2005 7:15 AM

You are invited to check the pages dedicated to party poker Read More

party poker from party poker on June 13, 2005 9:23 PM

You are invited to visit some helpful info about party poker Read More

Please visit some helpful info about loans home loans payday loans Read More

pacific poker from pacific poker on June 16, 2005 1:14 AM

You are invited to take a look at the sites about poker games party poker Read More

world series of poker from world series of poker on June 16, 2005 11:19 AM

Please take a look at some information on free strip poker free online poker Read More

free online poker from free online poker on June 18, 2005 2:43 AM

You are invited to check out some relevant pages in the field of strip poker free strip poker Read More

poker rules from poker rules on June 18, 2005 2:13 PM

You may find it interesting to check some information in the field of poker games party poker Read More

free casinos from free casinos on June 19, 2005 12:11 AM

You can also check some information on slot machines casino gambling Read More

poker rules from poker rules on June 20, 2005 12:32 PM

Please take a look at some relevant information dedicated to poker rules Read More

internet casino from internet casino on June 21, 2005 7:05 PM

Take your time to visit some information about internet casino Read More

texas holdem online game from texas holdem online game on June 22, 2005 1:04 PM

You may find it interesting to check out the sites in the field of poker chip manufacturer cheap poker table Read More

no limit texas hold em practice software from no limit texas hold em practice software on June 22, 2005 10:53 PM

You may find it interesting to visit some helpful info about poker supplies poker chip Read More

In your free time, check out some relevant information dedicated to texas hold em poker rooms Read More

payday loan from payday loan on June 25, 2005 9:45 PM

Please take a look at some information on loans home loans payday loans Read More

video poker from video poker on June 26, 2005 6:36 AM

You may find it interesting to check the sites dedicated to world series of poker free online poker Read More

empire poker from empire poker on June 27, 2005 6:45 AM

You may find it interesting to check out some helpful info on pacific poker texas hold em Read More

slot machines from slot machines on June 27, 2005 3:26 PM

Please check some information in the field of roulette Read More

poker games from poker games on June 29, 2005 5:30 AM

You can also check out some relevant information about pacific poker poker games Read More

pacificpoker european open from pacificpoker european open on June 29, 2005 2:03 PM

Please check out some helpful info in the field of how to win consistently at online poker ebook for free Read More

video poker game from video poker game on June 29, 2005 10:15 PM

You can also visit some information on statistic on home texas hold em poker Read More

texas hold em and macintosh from texas hold em and macintosh on June 30, 2005 6:53 AM

Please check some relevant information dedicated to texas hold em addison flash texas holdem Read More

online poker room from online poker room on June 30, 2005 3:09 PM

In your free time, visit some helpful info dedicated to online poker announced on tv real poker online Read More

no limit texas hold em poker from no limit texas hold em poker on June 30, 2005 11:43 PM

In your free time, check some relevant information on remove partypoker clay poker chip sets Read More

download texas hold em from download texas hold em on July 1, 2005 8:10 AM

You can also take a look at the pages on hold em training software teaxas holdem gamev free Read More

offical rules texas holdem from offical rules texas holdem on July 1, 2005 4:51 PM

You can also check the pages on how to shuffle poker chips Read More

poker tables from poker tables on July 2, 2005 12:23 AM

You may find it interesting to check some helpful info about celebrity poker clay poker chips Read More

free blackjack from free blackjack on July 3, 2005 8:14 AM

You can also visit the sites on online black jack casino on net Read More

womens health from womens health on July 4, 2005 5:43 AM

Take your time to check out some relevant pages about quit smoking prescription drugs Read More

texas hold em from texas hold em on July 4, 2005 12:55 PM

Please check some relevant pages dedicated to party poker texas hold em poker rooms Read More

poker games from poker games on July 4, 2005 8:20 PM

You are invited to take a look at the sites on online poker Read More

pacific poker from pacific poker on July 5, 2005 3:59 AM

You may find it interesting to check some helpful info on pacific poker poker games Read More

holdem play poker texas from holdem play poker texas on July 5, 2005 8:40 AM

You can also check out the sites dedicated to free texas holdem download Read More

pacific poker from pacific poker on July 5, 2005 5:59 PM

Please visit some information on poker party poker poker games Read More

texas holdem from texas holdem on July 6, 2005 1:03 AM

You are invited to check some relevant information in the field of poker pacific poker Read More

poker from poker on July 6, 2005 9:29 AM

Take your time to check out the pages in the field of pacific poker online poker Read More

texas holdem from texas holdem on July 6, 2005 4:39 PM

Please check the sites about poker games texas hold em Read More

texas holdem tournament rule from texas holdem tournament rule on July 7, 2005 1:30 PM

You may find it interesting to take a look at some relevant information on stratagies for texas holdem poker online Read More

student loans from student loans on July 8, 2005 7:36 AM

You may find it interesting to visit the pages about bad credit personal loans bad credit mortgage Read More

online poker from online poker on July 8, 2005 3:48 PM

You are invited to visit some relevant pages on poker Read More

texas holdem from texas holdem on July 9, 2005 8:12 AM

Take your time to check out some relevant pages about texas holdem online poker Read More

blackjack from blackjack on July 10, 2005 11:49 AM

You can also visit some relevant pages on casino Read More

student loans from student loans on July 10, 2005 6:11 PM

Please check some information on bank of america business loans Read More

celexa from celexa on July 11, 2005 5:20 AM

Please take a look at some relevant pages on lisinopril generic viagra Read More

online poker from online poker on July 11, 2005 3:12 PM

Take your time to visit some helpful info in the field of online poker texas holdem online poker Read More

texas hold em from texas hold em on July 13, 2005 1:40 AM

In your free time, check the sites on poker forum poker rooms Read More

texas holdem from texas holdem on July 14, 2005 1:18 PM

Take your time to check some helpful info on texas holdem Read More

online poker from online poker on July 15, 2005 6:17 AM

You may find it interesting to visit some relevant pages dedicated to poker tables texas hold em Read More

world series of poker from world series of poker on July 15, 2005 2:28 PM

You may find it interesting to visit some relevant pages in the field of strip poker poker Read More

casino on line from casino on line on July 16, 2005 7:39 AM

You may find it interesting to visit the pages about casino on net roulette Read More

casino slots from casino slots on July 16, 2005 4:47 PM

You can also check out some information dedicated to casino games internet casino Read More

TEXas Holdem Poker from TEXas Holdem Poker on July 18, 2005 11:47 AM

You can also check out the sites on no limit texas holdem rule Read More

pogo video poker from pogo video poker on July 20, 2005 3:16 AM

Please take a look at some relevant pages dedicated to slot machines for sale biloxi mississippi casinos Read More

mortgages from mortgages on July 21, 2005 7:44 AM

Please visit some helpful info dedicated to loan payment calculator loan Read More

You may find it interesting to visit the sites dedicated to credit card processing free credit reports Read More

1 online soma from akane soma gallery, akane soma on July 22, 2005 3:42 AM

overnight soma order soma india muscle relaxers soma soma for relief of esophageal spasm soma for sale photo of soma w/codeine soma vedas discount soma cheapest soma with overnight delivery forward to meeting soma toronto message week soma high instruc... Read More

pacific poker cheat from pacific poker cheat on July 23, 2005 2:12 AM

Take your time to check out some relevant pages in the field of free pacific poker game Read More

empire poker from empire poker on July 23, 2005 2:41 PM

You are invited to visit the sites about poker rooms party poker poker Read More

effexor from effexor on July 27, 2005 7:23 PM

Take your time to check out the sites on naproxen cheap generic viagra ativan Read More

Take your time to check out the pages about canadian pharmacy weight loss pill Read More

weight loss pills from weight loss pills on July 28, 2005 2:32 PM

You may find it interesting to check out the pages about phentermine online viagra online Read More

credit restoration from credit restoration on July 29, 2005 9:04 AM

In your free time, take a look at some helpful info on small business loans countrywide home loans Read More

home loans from home loans on July 29, 2005 6:39 PM

You are invited to check out some relevant pages on loans refinance Read More

texas holdem win percentages from texas holdem win percentages on July 30, 2005 4:50 AM

Please take a look at some relevant pages about strip poker online poker games Read More

strongest prescription diet pill available from strongest prescription diet pill available on August 3, 2005 11:14 PM

You are invited to check some relevant information in the field of diet pills fighting enemy Read More

play poker online without downloads or signing up from play poker online without downloads or signing up on August 8, 2005 11:05 AM

You can also check the sites dedicated to online gaming poker Read More

discover card from discover card on August 11, 2005 3:07 PM

In your free time, visit some information dedicated to discover card mortgage rates bad credit loans Read More

pokemon porn paris hilton sex tape sex toys sexy women free sex videos pornstars Read More

sexy girls free porn clips worldsex tsunami video cartoon sex asian porn Read More

poker rooms from poker rooms on August 16, 2005 4:15 AM

Please take a look at some relevant information about poker games texas hold em Read More

texas holdem from texas holdem on August 16, 2005 7:42 AM

Take your time to visit some information in the field of party poker online poker pacific poker Read More

TExas Holdem from TExas Holdem on August 23, 2005 9:05 AM

Take your time to check out the pages on texas holdem poker game Read More

play free texas poker online from play free texas poker online on August 27, 2005 5:49 PM

You are invited to take a look at some helpful info dedicated to free download of strip poker game Read More

papaya weight loss drugs from papaya weight loss drugs on August 28, 2005 9:39 PM

You are invited to visit some relevant information about weight loss effective drug Read More

poker The most detestable wickedness, the most horrid cruelties, and the greatest miseries that have afflicted the human race have had their orig Read More

Take your time to take a look at some information about texas hold em poker rules Read More

Hummer also promises that the 2006 Hummer H3 will perform on par with the fuel-thirsty V8-powered H2 while achieving as much as 20 mpg on the highway. Read More

You may find it interesting to visit the pages about online gambling free slots Read More

Poker Texas Holdem from Poker Texas Holdem on September 13, 2005 5:48 PM

In your free time, visit some relevant information in the field of texas holdem strip poker flash games Read More

free hentai strip poker games from free hentai strip poker games on September 14, 2005 10:40 AM

Take your time to check out the sites about play poker in omaha Read More

free online strip poker from free online strip poker on September 16, 2005 8:05 AM

You may find it interesting to visit the pages dedicated to Party poker companion software Read More

espn world series of poker card % from espn world series of poker card % on September 17, 2005 6:25 AM

You may find it interesting to visit some relevant pages about buy poker chip Read More

texas holdem how to play animated from texas holdem how to play animated on September 18, 2005 11:27 AM

Take your time to take a look at the pages on texas holdem card Read More

play black jack online free from play black jack online free on September 27, 2005 2:47 PM

You may find it interesting to visit some information in the field of best online black jack Read More

online casino sites from online casino sites on September 28, 2005 8:55 PM

Please check out the sites dedicated to paris casino Read More

poker online play from poker online play on September 30, 2005 2:42 AM

You can also check out the sites dedicated to How to Cheat at Online Poker Read More

Please visit some information in the field of viagra Read More

herbal diet pills from herbal diet pills on October 4, 2005 3:50 AM

You may find it interesting to visit the pages about diet pills ultra 99 Read More

merrell shoes from merrell shoes on October 8, 2005 4:36 PM

merrell shoes In the other corps there were linen-shrouded United merrell shoes Loyalists from the different provinces, incl Read More

casino sport book from casino sport book on October 9, 2005 4:37 AM

You can also check out some relevant pages in the field of secure online casinos Read More

jugar poquer internet from jugar poquer internet on October 15, 2005 3:43 AM

In your free time, visit some relevant pages on gane Read More

You are invited to check out some relevant information in the field of casino online gambling Read More

You may find it interesting to check some helpful info in the field of texas holdem poker rule Read More

memory foam mattress bed pillow from memory foam mattress bed pillow on October 18, 2005 10:04 PM

A memory foam mattress is made of a very unique foam material. When synthetic foam and chemicals are combined they create a product that has an increase in density weight. Read More

online pharmacy forum from online pharmacy forum on October 19, 2005 3:02 PM

You may find it interesting to check out some information in the field of target pharmacy Read More

In your free time, take a look at the sites dedicated to tamiflu purchase tamiflu without prescription Read More

texas hold em el paso texas from texas hold em el paso texas on October 20, 2005 11:57 PM

Take your time to check some helpful info dedicated to texas hold em online poker Read More

In your free time, take a look at some relevant information on discover card cash advance Read More

online phentermine no prescription from online phentermine no prescription on October 30, 2005 7:07 AM

Please check out some information dedicated to phentermine fatalities Read More

5 star hotels berlin from 5 star hotels berlin on October 30, 2005 11:53 PM

Take your time to take a look at the sites about cheap hotels berlin elegant berlin hotel Read More

In your free time, check out the pages dedicated to phentermine weight loss pills Read More

debt consolidation from debt consolidation on November 1, 2005 4:34 PM

Take your time to take a look at the sites about free credit report fast cash mortgage calculator Read More

You may find it interesting to visit some helpful info dedicated to 2193 Read More

how do you play backgammon from how do you play backgammon on November 6, 2005 7:21 AM
0 credit cards from 0 credit cards on November 8, 2005 5:19 PM

In your free time, visit some relevant information in the field of credit cards credit card application Read More

internet black jack from internet black jack on November 17, 2005 7:09 AM

Take your time to check out some helpful info on play blackjack blackjack Read More

Hard fuck teen rape from Personal porn movie on January 4, 2006 7:31 PM

Mature ladies fucking two guys Lesbian twins free trailer Quicktime movie hard Gangbang sex sto... Read More

online casino from online casino on January 17, 2006 8:45 PM

commonplace artifice oils jurist undocumented coincide online casino http://www.studyinslovakia.com/ seniors casino http://casino.seat208.com/ Read More

6 Comments

Most current browsers seem to support regular expressions (and not just wildcards) in the Common Name field. I wouldn't use it personally, but I've seen a lot of these certificates from browser CAs (at least I think so, I don't use these CAs and store all certificates manually).

By the way, IPv4 addresses for obscure HTTPS servers quite cheap because renumbering is usually not an issue (you just do it), and PA address space isn't exactly expensive for end users.

Is it possible to have the certificate bind the IP address rather than the host name? Would that satisfy browsers?

Regexps work a lot better if the domain names are related. Unfortunately, if you're running a hosting service, they're not. As for the availability of IPv4 addresses... They're not incredibly expensive but they're not free either. I'm paying like $5/month for the one the runs https://www.educatedguesswork.org/

Hal:
Putting the IP address in the cert doesn't protect you against active attack due to the possibility of DNS spoofing.

It would only take a few software packages adopting the TLS extensions for them to become commonplace:
IE, Mozilla, OpenSSL, MS Secchannel, IIS, Apache.

Everyone else will fall in line post haste.

Unfortunately, I think this assessment is unduly optimistic. Certainly IE and Mozilla could deploy the extensions tomorrow but it takes the installed base quite some time to catch up.

I've used the third approach in a few situations - it actually works pretty well with conventional named-based virtual hosting since you can simply have the HTTP server redirect to the appropriate HTTPS service on a non-standard port. Since users almost never type https URLs in by hand this is surprisingly painless.