Re: [jetty-user] Question about Jetty and HTTPS

On Thu, Sep 30, 2010 at 11:42 AM, Silvio Bierman <
[email protected]> wrote:

> We use a embedded Jetty instances to implement a multi-tier web-based
> system. We serve multiple customers concurrently and distinguish between
> them by the DNS they use to get into the system. We use one single primary
> IP and use CNAME (alias) DNS chains that in the end all point to that same
> IP.
>
> We would like to extend this scheme with HTTPS. We want our customers to be
> able to provide their own certificates and use these in combinations with
> their DNS-es only. So we would have
>
> DNS1 -> Customer A@IP
> DNS2 -> Customer A@IP
> DNS3 -> Customer A@IP
> DNS4 -> Customer B@IP
> DNS5 -> Customer B@IP
>
> and use multiple certificates behind the same SSL listener on the same IP.
> Is this at all possible? Can a certificate be bound to only a single (or
> preferably a set of) DNS(-es)? Will using multiple different certificates on
> the same IP/port cause any kind of conflict?
>
> I know little about HTTPS and certificates. I have read some tutorials
> about Jetty + HTTPS and think I know what to do but if what I want is not
> possible then that effort would be wasted.
>

No, the problem is the SSL library has to return a certificate long before
the web server sees the Host: header in the HTTP request to know which
customer it is serving.

-- 
John A. Tamplin
Software Engineer (GWT), Google