Hello list,
I've just written to Robert and he suggested I post to this list, so I will.
It is possible to do virtual hosting with SSL. Roberts' description of the
connection setup with SSL is of course completely correct. The only
assumption not correct is that SSL certificates may only represent one
single domain. There is a way (in fact several) to generate a certificate to
represent many domains.
So Pound - or any other proxy or webserver - could be saying: This is my
certificate and my certificate represents example1.org, example2.com and
example3.biz and certificate authority X will certify that.
A very precise description (and status information) may be found on
http://wiki.cacert.org/wiki/VhostTaskForce.
That page also includes a
browser compatibility list for different vhost methods.
Luckily, some commercial vendors also offer multi-domain certificates, so
you won't have to wait for cacert to be included into Mozilla products, IE
and Opera. I use a (commercial) multi-domain certificate in Apache and it
works flawlessly with IE >=6 and FF >=1.5 (as is to be expected).
You have 10+ domains and your CA is still selling you a certificate for each
single domain? Get out of that situation as soon as possible, it will save
you a lot of money.
Beware: I do not use Pound. I do not know if Pound skips reading the HTTP
Host header after doing HTTPS (maybe for efficency reasons?). If it does I
assume it wouldn't require a lot of tweaking to put reading the Host header
with HTTPS back in (the code must surely be there already).
Cheers,
Stephen
|