问：共享IP下的多个域名启用SSL(Https)，有无弊端?

This topic created in 5005 days ago, the information mentioned may be changed or developed.

一般的SSL配合独立IP没什么问题，但若是共享IP，浏览器判断证书的时候好像会打架。
有了解的来说说，多谢。

Supplement 1 · Nov 28, 2012

In practice, this means that a HTTP server can only serve one domain (or small group of domains) per IP address for secured browsing. Assigning a separate IP address for each site increases the cost of hosting since requests for IP addresses must be justified to the regional internet registry and IPv4 addresses are now in short supply. The result is that many websites are effectively prevented from using secure communications.

SSL

共享

6 replies • 1970-01-01 08:00:00 +08:00

dndx

Nov 28, 2012

See http://en.wikipedia.org/wiki/Server_Name_Indication

bearice

Nov 28, 2012

简单来说TLS可以，SSL不行

hzlzh

Nov 28, 2012

@bearice 目前俩域名都可以正常https访问，小绿锁，统一个共享IP

bearice

Nov 28, 2012

@hzlzh FYI http://en.wikipedia.org/wiki/Server_Name_Indication

bearice

Nov 28, 2012

好吧我提交完了才想起来这个连接是一楼给的（跪

bearice

Nov 28, 2012

@hzlzh 或者说，多个证书共享一个端口的问题就是假如客户端浏览器不支持SNI扩展，就会提示证书出错。不过鉴于SNI扩展推出也有些年头了，所以基本上没有大问题。
之前我的服务器上的nginx就部署了好多证书（startssl的免费证书，不支持子域通配符），只好把比较旧的SSLv2和SSLv3禁用，只允许TLS，然后就可以正常握手了。