Re: Metuxmpm test failed

-                                                 [email protected]
---------------------------------------------------------------------

On Mon, 6 Oct 2003 [email protected] wrote:

> Another conceptual problem we didnt really solve yet: is it possible to
> use different certs on an ssl connection at all ? In other words:
> is it ever possible having multiple vhosts with different certs sitting
> on the same port ?

The SSL handshake is done before any HTTP requests including the vhost's
name come through. Therefore multiple vhosts with different SSL
certificates are not possible.

Possible workarounds could be i) wildcards in the Common Name of the
certificate (SF does this: "*.sourceforge.net"), ii) IPs as the Common
Name or iii) SSL renegotiation on the established connection (STARTTLS,
several protocols [for example POP3] support this).

These solutions are more or less theoretical. For all three I don't know
what browsers have support, for iii) I don't even know whether HTTP
supports it.

Regards