Apache: How to Enable Multiple SSL On One IP Using SNI and Virtual Host

When you have multiple websites and want to run them on one IP address, you use name-based virtual hosting. Using a name-based host, you can quickly direct a user to the right site. However, this becomes a problem while using SSL/TLS certificates. That’s because SSL/TLS involves a handshake between the client and server. An HTTP header can only be sent after the handshake. As a result, the server doesn’t know which website it should serve. That’s why it forces some people to purchase separate IP addresses.

Here Comes SNI 

Server Name Indication (SNI) is an extension to the SSL/TLS protocol. It allows you to host multiple SSL certificates on a single unique IP address. This is done by inserting an HTTP header in the SSL/TLS handshake. This saves some serious money.

Sound good? Want to go ahead and enable SNI on Apache using virtual host? Of course, you do. Here’s how to do it!

Enable SNI on Apache Through Virtual Host

Note: Before you begin, we suggest you take a backup of your .conf file.

• To run multiple SSL certificates on one server, you’ll need to create a virtual host. To do so, you’ll need to add the following line to your .conf file.

Include my_other_site.conf

• Once this line is added, go to the NameVirtualHost directive and add your server’s IP address *:443 or whichever SSL port you’re using.
• Now, you need to direct  SSLCertificateFile,  SSLCertificateKeyFile, and the SSLCertificateChainFile to the locations of the certificate files for every website that you want to secure.

<VirtualHost *:443> ServerName www.yourdomainname.com DocumentRoot /var/www/domainname SSLEngine on SSLCertificateFile /path/to/www_ yourdomainname _com.crt SSLCertificateKeyFile /path/to/www_ yourdomainname _com.key SSLCertificateChainFile /path/to/NameofCA.crt</VirtualHost>

<VirtualHost *:443> ServerName www.yourdomainname2.com DocumentRoot /var/www/domainname2 SSLEngine on SSLCertificateFile /path/to/www_yourdomainname2_com.crt SSLCertificateKeyFile /path/to/www_ yourdomainname2_com.key SSLCertificateChainFile /path/to/NameofCA.crt</VirtualHost>

If you want to use a Wildcard SSL or a Multi-Domain SSL certificate, you must point to the same IP address. Here’s how you should do it:

<VirtualHost 192.168.1.1:443> ServerName www.yourdomainname.com DocumentRoot /var/www/ SSLEngine on SSLCertificateFile /path/to/your_domain_name.crt SSLCertificateKeyFile /path/to/your_private.key SSLCertificateChainFile /path/to/NameofCA.crt</VirtualHost>

<VirtualHost 192.168.1.1:443> ServerName domain2.yourdomainname.com DocumentRoot /var/www/domain2 SSLEngine on SSLCertificateFile /path/to/your_domain_name.crt SSLCertificateKeyFile /path/to/your_private.key SSLCertificateChainFile /path/to/NameofCA.crt</VirtualHost>

Are all done? Well, you have just enabled SNI on your Apache server using Virtual Host!