[Xitami] Secure keys

[Thomas J. Hruska]

At 10:50 AM 8/24/2002 -0400, Brad Smith writeth:
>If I want to add multiple keys to the sslhttp.cfs file, how do I list them?  
>We now require two certificates and two keys, but I don't know what the 
>syntax is for changing the [SSL] section and whether I need to make 
>changes to [Virtual Hosts].

Unfortunately, due to the way SSL works, this is practically impossible.
VHosts are only accessible after the server certificate is sent to the
client.  For that reason, the only way to select certs. is based on IP
address.  You will have to get another IP address into Xitami to make it
work.  Another solution is to get a wildcard cert.  It is less secure, but
will allow you to make multiple VHosts under a top-level domain work with
just one cert.

To see an example of a wildcard cert., Shining Light Productions
(www.shininglightpro.com) issues 2cah.com a wildcard cert. every 395 days.
2cah.com is the primary host for Shining Light Productions.  A wildcard of
*.PrimaryDomain.com will allow you to use SubDomain.PrimaryDomain.com, but
not Whatever.Subdomain.PrimaryDomain.com.  Read up on the specifications
for SSL and HTTPS for more details on this.

You are, unfortunately, hitting one of the major limitations of the SSL/TLS
protocols and the difficulty you are having with configuring Xitami is not
iMatix's fault, but rather the weak protocol definition for multiple server
certificate selection AND the generic interface that OpenSSL/SSLeay provides.

Your best bet on a single IP address is to provide wildcard cert. VHosting.

Hope this helps!


          Thomas J. Hruska -- shinelight@shininglightpro.com
Shining Light Productions -- "Meeting the needs of fellow programmers"
                  http://www.shininglightpro.com/