如何为 Apache 上的虚拟主机设置不同的 SSL 证书？
我有一台网络服务器，它服务于不同的域名，但只分配了一个IP地址。 这与 Apache 中的虚拟主机配合得很好。 现在我想要网站的 SSL 加密连接。 如何为不同的虚拟主机设置不同的 SSL 证书？
对不同的主机名使用不同的 IP 将是一种解决方案 - 不是很优雅但可行。 但我想知道如何为不同的虚拟主机使用不同的 SSL 证书。 所以我寻找一种只有一个 IP 地址的解决方案。
I have a web-server, that serves different domain-names, but has only one IP-address assigned. That works fine with virtual hosts in Apache. Now I want SSL-encrypted connections for the websites. How can I set different SSL-certificates for the different vhosts?
Using different IP's for the different hostnames would be an solution - not very elegant but possible. But I want to know, how I can use different SSL-certificates for different vhosts. So I look for a solution with only one IP-address.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
更新：2013
随着旧版浏览器的逐渐消失，SNI 似乎终于开始占据主导地位。 以下是 Apache SNI 的文档，这是 关于 SNI 的维基百科文章，其中包含支持它的浏览器的图表。 简而言之，所有主流浏览器都在支持的版本中支持它； 如果支持旧版浏览器很重要，您可能必须考虑到这一点。
-----之前的回答 ------------
SSL 主机必须绑定到唯一的 IP 地址/端口组合，因此您不能使用虚拟主机（或者在至少，每个 IP 地址只能有一个 ssl 主机）。 这是因为 https 在 http 中发送 Host: 参数之前就开始加密，因此它无法从主机名确定要使用哪个密码 - 它拥有的只是 IP 地址。
如果 HTTP 有一个 TLS 命令，这样它就可以在询问主机名后启动 SSL，那么这个问题就很容易解决，但没有人问我。
有关明确的答案，请参阅 http://httpd.apache.org/ docs/2.0/ssl/ssl_faq.html#vhosts2
UPDATE: 2013
It appears that SNI is finally beginning take hold as older browsers are falling away. Here are the docs for Apache SNI and here is a wikipedia article on SNI that includes a chart on browsers that support it. In short, all the major browsers support it in supported versions; if supporting older browsers is important, you may have to take that into consideration.
------ previous answer ------------
SSL Hosts must be tied to a unique IP address/port combination, thus you cannot use virtual hosting (Or at least, it can only have one ssl host per IP address). This is due to the fact that https begins encryption before the Host: parameter is sent in http, and thus it cannot determine which cipher to use from the hostname - all it has is the IP address.
This would be silly easy to fix if HTTP had a TLS command so it could start SSL after asking for the hostname, but no one asked me.
For the definitive answer, see http://httpd.apache.org/docs/2.0/ssl/ssl_faq.html#vhosts2
在给出答案的提示和评论（尤其是 Martin v. Löwis）之后，我做了一些谷歌搜索，发现 此网站有关 RFC 2817 和 RFC 3546。 RFC 3546 似乎是一个很好的解决方案。
After hints in the answers given and comments to it (especially by Martin v. Löwis) I did some googling and found this website about RFC 2817 and RFC 3546. RFC 3546 seems to be a good solution.
AFAIK 不可能使用 mod_ssl 为基于名称的虚拟主机设置不同的 SSL 证书。 您可以在此处阅读详细原因。 另一种方法是使用基于 IP 的虚拟主机（这可能是不可能的/不是一个非常令人满意的解决方案） - 只需插入不同的 SSLCertificateFile 指令，或者您可以尝试 此方法使用mod_gnutls。
AFAIK it's not possible to set up different SSL certificates for name-based virtual hosts using mod_ssl. You can read the detailed reason here. An alternative would be using IP based virtual hosts (Which is probably not possible / not a very satisfying solution) - just insert different SSLCertificateFile directives, or you could try this method using mod_gnutls.
每个虚拟主机都需要一个单独的 IP:端口组合。
RFC 3546 尚不可行。 IE 仅在 Vista 下运行时支持它，最后我检查了 Safari 也不管理它。
You will need a separate IP:port combination for each vhost.
RFC 3546 is not feasible yet. IE only supports it when running under Vista, and last I checked Safari doesn't manage it either.
虽然 DGM 提到的所有内容都是真实的，但已经有人尝试绕过每个证书（包括 mod_gnutls）的唯一 IP 地址的要求，并使用 TLS 扩展。 虽然有一些缺点，但您可能可以接受。
While everything DGM mentioned is true, there have been some attempts to get around the requirement for a unique IP address for every certificate including mod_gnutls and using TLS extensions. There are some drawbacks but they may be acceptable to you.
终于可以了！ 您需要服务器和客户端来支持服务器名称指示 (SNI)
支持 SNI 的浏览器：
此文档展示了配置服务器的方法：SSL with Virtual Hosts using SNI
Finally it's possible! You need both server and client to support Server Name Indication (SNI)
Browsers, that support SNI:
This doc shows hoe to configure your server: SSL with Virtual Hosts Using SNI