The problem is fundamental to the way HTTPS works.
Virtual hosting relies on the "Host" header introduced in HTTP/1.1. That's part of the HTTP protocol, but from the standpoint of the SSL protocol, the HTTP layer is "application data", and can't be transmitted until the SSL handshake has been completed.
However, the server certificate is presented during the handshake. The HTTP server hasn't seen the "Host" header yet, so it wouldn't know which certificate to send. Using a distinct IP address works, because that's visible at the IP layer below SSL.
Update: There's a new TLS extension that allows clients to indicate the server they intend to use during the handshake. See dlongley's answer for more information.
I am not sure what web server you are running, but in IIS 6 on windows server 2003, you can use host headers for SSL sites, thus allowing them to be on the same IP Address.
EDIT: This will only work if the certificate is a wildcard certificate. Otherwise, subdomain "affiliate" will try to use the same certificate as subdomain "www", and visitors will get a warning.
This probably won't help you, but hopefully it's informative.
There's an extension to the TLS protocol that some TLS clients use called Server Name Indication (SNI). This extension allows TLS clients to specify the hostname of the server they are trying to contact. So when the client connects and sends a ClientHello message within the TLS protocol, the server can decide which certificate to respond with. This makes virtual SSL/TLS servers possible on a single IP.
OpenSSL provides callback functions to allow you to read what hostname the client sent and handle fetching the appropriate certificate, but unfortunately I have no idea if this is possible with IIS.
In the particular situation you are where you need 2 subdomains of the same domain a WildCard certificate has to work... I use a wildcard cert since 3 years for dozens of sites, and no customer has reported errors
If you have something telling the cert is for "www", then your cert is not a true wildcard cert, or you are experiencing some kind of browser caching issues or you are using 2 copies of the cert and you updatet only one of them, or you forgot restarting the server, or .. I donno :)
发布评论
评论（5）
您猜对了。您将需要两个 IP 地址。
You guessed right. You will need two IP addresses.
这个问题是 HTTPS 工作方式的根本问题。
虚拟主机依赖于 HTTP/1.1 中引入的“Host”标头。 这是HTTP协议的一部分，但从SSL协议的角度来看，HTTP层是“应用程序数据”，在SSL握手完成之前无法传输。
但是，服务器证书是在握手期间提供的。 HTTP 服务器还没有看到“Host”标头，因此它不知道要发送哪个证书。 使用不同的 IP 地址是可行的，因为它在 SSL 下面的 IP 层上是可见的。
更新：有一个新的 TLS 扩展，允许客户端在握手期间指示他们打算使用的服务器。 请参阅 dlongley 的回答了解更多信息。
The problem is fundamental to the way HTTPS works.
Virtual hosting relies on the "Host" header introduced in HTTP/1.1. That's part of the HTTP protocol, but from the standpoint of the SSL protocol, the HTTP layer is "application data", and can't be transmitted until the SSL handshake has been completed.
However, the server certificate is presented during the handshake. The HTTP server hasn't seen the "Host" header yet, so it wouldn't know which certificate to send. Using a distinct IP address works, because that's visible at the IP layer below SSL.
Update: There's a new TLS extension that allows clients to indicate the server they intend to use during the handshake. See dlongley's answer for more information.
我不确定您正在运行什么 Web 服务器，但在 Windows Server 2003 上的 IIS 6 中，您可以使用 SSL 站点的主机标头，从而允许它们位于同一 IP 地址上。
http: // www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/596b9108-b1a7-494d-885d-f8941b07554c.mspx?mfr=true
编辑：这仅在证书是通配符证书时才有效。 否则，子域“affiliate”将尝试使用与子域“www”相同的证书，并且访问者将收到警告。
I am not sure what web server you are running, but in IIS 6 on windows server 2003, you can use host headers for SSL sites, thus allowing them to be on the same IP Address.
http:// www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/596b9108-b1a7-494d-885d-f8941b07554c.mspx?mfr=true
EDIT: This will only work if the certificate is a wildcard certificate. Otherwise, subdomain "affiliate" will try to use the same certificate as subdomain "www", and visitors will get a warning.
这可能不会对您有帮助，但希望它能提供有用的信息。
某些 TLS 客户端使用 TLS 协议的扩展，称为服务器名称指示 (SNI)。 此扩展允许 TLS 客户端指定它们尝试联系的服务器的主机名。 因此，当客户端连接并在 TLS 协议内发送 ClientHello 消息时，服务器可以决定使用哪个证书进行响应。 这使得虚拟 SSL/TLS 服务器可以在单个 IP 上运行。
OpenSSL 提供回调函数，允许您读取客户端发送的主机名并处理获取适当的证书，但不幸的是，我不知道这对于 IIS 是否可行。
This probably won't help you, but hopefully it's informative.
There's an extension to the TLS protocol that some TLS clients use called Server Name Indication (SNI). This extension allows TLS clients to specify the hostname of the server they are trying to contact. So when the client connects and sends a ClientHello message within the TLS protocol, the server can decide which certificate to respond with. This makes virtual SSL/TLS servers possible on a single IP.
OpenSSL provides callback functions to allow you to read what hostname the client sent and handle fetching the appropriate certificate, but unfortunately I have no idea if this is possible with IIS.
在特定情况下，您需要同一域的 2 个子域，通配符证书必须才能工作...我从 3 年来为数十个网站使用通配符证书，并且没有客户报告错误
如果您有一些信息表明该证书适用于“www”，那么您的证书不是真正的通配符证书，或者您遇到了某种浏览器缓存问题，或者您正在使用该证书的 2 个副本，并且您只更新了其中一个，或者你忘记重新启动服务器，或者..我不知道:)
In the particular situation you are where you need 2 subdomains of the same domain a WildCard certificate has to work... I use a wildcard cert since 3 years for dozens of sites, and no customer has reported errors
If you have something telling the cert is for "www", then your cert is not a true wildcard cert, or you are experiencing some kind of browser caching issues or you are using 2 copies of the cert and you updatet only one of them, or you forgot restarting the server, or .. I donno :)