From 5c792bf561f4df0b4346e693f2959bc85648fa69 Mon Sep 17 00:00:00 2001
From: Daniel Earl Poirier
Name-Based Virtual Hosting is a very popular method of identifying different virtual hosts. It allows you to use the same IP address and @@ -742,16 +742,24 @@ Virtual Hosting to identify different SSL virtual hosts?
It comes as rather a shock to learn that it is impossible.
+It is possible, but only if using a 2.2.12 or later web server, + built with 0.9.8j or later OpenSSL. This is because it requires a + feature that only the most recent revisions of the SSL + specification added, called Server Name Indication (SNI).
The reason is that the SSL protocol is a separate layer which encapsulates the HTTP protocol. So the SSL session is a separate transaction, that takes place before the HTTP session has begun. The server receives an SSL request on IP address X and port Y - (usually 443). Since the SSL request does not contain any Host: - field, the server has no way to decide which SSL virtual host to use. - Usually, it will just use the first one it finds, which matches the - port and IP address specified.
+ (usually 443). Since the SSL request did not contain any Host: + field, the server had no way to decide which SSL virtual host to use. + Usually, it just used the first one it found which matched the + port and IP address specified. + +If you are using a version of the web server and OpenSSL that + support SNI, though, and the client's browser also supports SNI, + then the hostname is included in the original SSL request, and the + web server can select the correct SSL virtual host.
You can, of course, use Name-Based Virtual Hosting to identify many non-SSL virtual hosts (all on port 80, for example) and then -- 2.40.0