Re: [gentoo-server] apache2 + ssl + multiple virtual hosts

[Andy Dustman]

On Tue, 7 Sep 2004 19:36:35 +0200, Christian Parpart
<cparpart@×××××××××.net> wrote:

> I'm still wondering about the technical side, AS I do not understand *why* the
> web server can just serve one webserver certificate per (IP:PORT) pair.

It's like this: With normal HTTP, the client opens a connection to the
server, generally sends a GET or POST command, and then follows that
with a Host: header with the name of the server, i.e.

POST /foo.cgi HTTP/1.1
Host: www.example.com

[data goes here]

When using HTTPS, however, the client opens a connection to the
server, negotiates the SSL/TLS session, and then does the above.
During the session negotiation, the server presents a certificate. The
problem is, the server cannot know at this point what name the client
has referred to it as; it only knows the IP address it has accepted
the connection on. Therefore there is no way to determine by what name
the client was referring to the server, and cannot select certificates
based on name. The Host header doesn't get sent until after the
session is negotiated, which is too late. Of course, the server can be
configured to use certificates based on the IP address, which is how
it's normally done.

What would have worked a lot better is a STARTTLS directive, similar
to that for SMTP and IMAP  and LDAP and others, which would negotiate
the session after determining the hostname, i.e.

STARTTLS www.example.com HTTP/1.1
[session negotiation begins]
[encrypted session begins]
POST /foo.cgi HTTP/1.1

[data goes here]
[encrypted session ends]

There might even be an RFC floating around for this somewhere. An
additional advantage is you don't need an additional port (443) for
secure HTTP: It just happens over the normal port (80). Disadvantage:
Hostname is sent in the clear, but this seems a very small
disadvantage.
-- 
Computer interfaces should never be made of meat.