验证共享主机上的 SSL 证书
根据这个问题，当我们使用HTTPS时，所有HTTP标头都是加密的（包括请求URI和主机）标题）。
当浏览器想要浏览使用HTTPS的网站页面时，它首先创建安全连接，然后发送HTTP请求（加密的），服务器将答案返回给浏览器。现在假设有多个安全网站具有多个 SSL 证书，因此当服务器想要创建安全连接时，它如何检测应该使用哪个证书，因为它不知道有关请求的任何信息！
according to this question all HTTP header when we are using HTTPS are encrypted(including request URI and Host header).
when browser want to browse a page on website that using HTTPS, it first create secure connection, then it sends HTTP request(encrypted) and server return the answer to browser. Now assume there are more than one secure website with more than one SSL certificate, so when server want to create secure connection how does it detect which certificate should be used because it doesn't know anything about request!!!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
由于 SSL 通道是在接收
Host标头之前协商的，因此 HTTPS 服务器最多可为每个绑定 IP 端点（IP 地址和端口）使用一个证书。换句话说，要使用两个不同的 SSL 证书，您需要将每个虚拟主机绑定到不同的端口或不同的 IP 地址。Since the SSL channel is negotiated prior to the reception of the
Hostheader, an HTTPS server can use at most one certificate per bound IP endpoint (IP address and port). In other words, to use two different SSL certificates, you will either need to bind each virtual host to a different port, or a different IP address.在 TLS 出现之前，服务器确实没有办法知道应该向客户端提供哪个主机的证书，这会导致问题。
在 TLS 中，引入了一个名为
Server Name的特殊扩展（请参阅 RFC 3546< /a>)，它让客户端告诉服务器客户端想要连接到哪个主机。根据此扩展的内容，服务器可以提供正确的证书。当然，这一切都需要TLS以及扩展本身得到双方的支持和使用。Before TLS the server indeed didn't have a way to know certificate of which host it should present to the client and this caused problems.
In TLS there was a special extension named
Server Nameintroduced (see RFC 3546), which lets the client tell the server, what host the client wants to connect to. Based on contents of this extension the server can present proper certificate. Of course, all of this requires that TLS and the extension itself are supported and used by both parties.其基础是为每个虚拟服务器提供一个 SSL 密钥（集）。
例如，在 Apache 中，它相对简单。每个共享站点都可能位于
粗略示例：
服务器随后将使用指定的密钥来处理通过 HTTPS 定向到该站点的所有请求。 有关 Apache 站点的更多详细信息。类似的事情应该适用于大多数支持虚拟主机概念的网络服务器。
您不会收到任何错误，因为证书和域名匹配。
The basis of this is to provide a SSL key(set) for each virtual server.
In Apache, for example, it's relatively simple. Each shared site is likely in a
<VirtualHost>directive. The SSL keys can be specified within that, and thus apply to that virtual host only.Rough example:
The server will then use the specified keys for all requests directed to that site over HTTPS. Further details on the Apache site. Similar things should apply to most web servers that support a concept of virtual hosts.
You won't get any errors, as the certificate and domain name match up.