多个域名、一个IP的ssl证书
AFAIK，SSL 被分配给单个域名（可能通过通配符分配给多个子域）。
另一方面，我听说网络服务器在提供 ssl 服务之前看不到域？
如果我在一个 IP 地址上有多个域作为虚拟主机运行：
问题 1：网络服务器可以为站点提供相应的 SSL 服务吗？
问题 2：有没有一种方法可以让一个多域 SSL 为一个 IP 上的两个域提供服务？
请照亮我，摆脱这句看似自相矛盾的引言给我带来的困惑：
常规 SSL 证书是针对单个 FQDN（完全合格的 域名）。使用证书的域必须有自己的 提供服务的唯一外部 IP 地址。在实践中，这 意味着如果您在单个 IP 地址/服务器上有多个域， 那么你必须在每个域上安装一个单独的证书 想要确保安全。
其原因是使用了“Host-Headers”。他们允许 Web 服务器使用单个 IP 地址为许多单独的站点提供服务 具有不同的 FQDN。他们通过识别传入的请求来做到这一点 网页，并相应地将其路由到正确的站点。
当发起 SSL 连接时，服务器必须发送一个 向客户端发送证书 - 在客户端知道主机头之前 要求。它拥有的唯一标识数据是请求的 IP 地址。因此，一个 IP 地址上的两个或多个站点无法使用 不同的 SSL 证书....
AFAIK, SSL is assigned to a single domain name (maybe several subdomains via wildcard).
On the other hand i heard that the webserver does not see the domain before it serves the ssl?
If I have multiple domains running as vhosts on one IP address:
Q1: Can the webserver serve the appropriate respective SSL to the sites?
Q2: Is there a way to have only one multi-domain SSL serving two domains on one IP?
Illuminate me out of confusion brought upon me by this seemingly self-contradictory quote:
Regular SSL Certificates are issued for a single FQDN (Fully Qualified
Domain Name). The domain using the certificate has to have its own
unique external IP address from which to be served. In practice, this
means that if you have multiple domains on a single IP address/server,
then you had to install a separate certificate on each domain you
wanted to secure.The reason for this is the use of 'Host-Headers'. They allow a
web server to use a single IP address to serve many separate sites
with different FQDNs. They do this by identifying the incoming request
for a webpage, and routing it to the correct site accordingly.When an SSL connection is initiated, the server must send a
certificate to the client - before it knows the host-header of the
request. The only identifying piece of data it has is the requested IP
address. As such, two or more sites on one IP address cannot use
different SSL certificates....
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
Q1> Web 服务器不需要知道 SSL 证书中嵌入的域。只有浏览器会这样做，因为它是确保证书中的域与地址栏中的域匹配的浏览器。 Web 服务器仅提供绑定到 IP 地址的证书，而不管证书中的域是什么。
Q2>您所描述的是 SAN 或 UC 证书。它们旨在执行您所说的操作，即允许多个域在一个 IP 地址上共享一个证书。查看主题备用名称链接了解更多信息
Q1> the web server doesn't need to know the domains embedded in an SSL cert. only the browser does since it's the one making sure the domain in the certificate matches the domain in the address bar. The web server just serves up the cert bound to the ip address, regardless of what domain is in the certificate.
Q2> what you describe is a SAN or UC certificate. They are designed to do what you stated, namely allow multiple domains to share one cert on one ip address. Check out this link on Subject alternative names for more info