MDC SSL and SNI question - thanks for any help

    Hi everyone, about to lay down some serious moolah and need to know how to do it. I did search, but it is hard to get answers when SSL, SNI, MDC etc are under minimum search term length.


    Using current stable on ubuntu 12.04


    I am looking to secure a number of domains on one IP with an MDC SSL certificate. Now I could add these files to each domain and leave it at that, but I assume on XP users of IE would get error messages due to not supporting SNI.


    If I just add the MDC to my base host configuration (like you can during install) then the individual domains won't have the directives to listen on port 443 etc.


    What I want to know is if I add the MDC as my hosting environments SSL certificate, then add the same certificate to each domains config (via gui), will this work on XP IE and also other systems via SNI, or will I just get conflict related errors??? Is there an easy way to update the hosting panels SSL cert after install?


    Thank you for your time!!!
    [hr]
    I am going to chance it for a couple of domains as I found information about an apache directive which should in theory make this work. :D


    I will post back for any future searcher who wants to try this so you know how I got on, but for reference the directive which should allow non-SNI browsers to use the default certificate is "SSLStrictSNIVHostCheck off". I don't know yet if that is already how imscp comes set up.

    Edited once, last by o-leary ().

    To resume:


    http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI

    badge.php?id=1239063037&bid=2518&key=1747635596&format=png&z=547451206

    SSH key for online support

    Hey o-leary,
    I have solved the sni problem in that way:
    1. have created a default server page like in that howto
    http://forum.i-mscp.net/Thread…OGRESS-Secure-admin-panel
    2. have changed in the default virtual host the ssl certificate file with a certificate, that is in use for my main domain. After that I had no problems anymore.


    But you can also just create a new virtual host with the included certificate, that's showing to the imscp control panel.

    Edited once, last by mafioso ().



    Thanks. I'm quite certain I'll get it going, I'm just having trouble where a clients website is listed as the primary domain on the certificate rather than my own, so if you browse https on an unsecured domain then instead of just showing a regular error chrome will actually tell you the certificate is for a client. Something for people to watch out for if they use SSL this way. I've asked the CA to change that if they can.