Re: SSL and reverse proxy and multiple certificates/domains

Kevin,

Yes, SNI works great. Pete and I though use a single proxy as a server to
distribute requests to different domains/subdomains. Each of these would
be a separate instance instead of having one big instance running all
domains/subdomains.

Reverse proxy works great with non SSL, but we want to also make it work
with SSL. I only mentioned SNI as it may be part of the clues on how to do
it.

I remember searching to see how others on other systems did it, but those
discussions get muddy pretty quick on Stackoverflow... :)


Bradley V. Stone
www.bvstools.com
MAILTOOL Benefit #8 <https://www.bvstools.com/mailtool.html>: Email Logging
- Each email that is sent out is logged with a delivery status. MAILTOOL
also tracks each of the recipients for each email as well as the
attachment(s) sent along with each email.

On Fri, Aug 31, 2018 at 10:21 AM Kevin Bucknum <Kevin@xxxxxxxxxxxxxxxxxxx>
wrote:

I don't know about with reverse proxy, or the version on the IBM i, but
with my linux hosts SNI just works. I set up multiple virtual hosts and
inside each of them point to the respective certificate, and each site
serves the correct cert.

Kevin Bucknum
Senior Programmer Analyst
MEDDATA/MEDTRON
Tel: 985-893-2550

-----Original Message-----

From: WEB400 [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of Pete
Helgren
Sent: Friday, August 31, 2018 10:11 AM
To: web400@xxxxxxxxxxxx
Subject: Re: [WEB400] SSL and reverse proxy and multiple
certificates/domains

Yeah...I saw SNI referred to in many "generic" Apache posts but I

couldn't

find documentation about it for IHS for IBM i. *Just* found the 7.2 HTTP
Server for IBM i Redbook so I'll peruse that and it does specifically

state:

Server Name Indication(SNI) is an extension to the SSL and TLS protocols

that

indicates what hostname the client is attempting to connect to at the

start of

the handshaking process. This allows a server to present multiple

certificates

on the same IP address and port number and hence allows multiple secure
(HTTPS) websites to be served off the same IP address without requiring

all

those sites to use the same certificate. It is the conceptual equivalent

to

HTTP/1.1 virtual hosting for HTTPS.

I hope there is a *good* example of a working configuration......

Once done, if done, I'll post up the working config so you won't have to
experiment as much as I have....

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java
Twitter - Sys_i_Geek IBM_i_Geek

On 8/31/2018 9:59 AM, Bradley Stone wrote:

I've tried this in the past without luck. But that was before the
apache server was able to use SNI. I haven't tried since as I want my
sites to be up. Maybe one weekend I'll give it another shot.:)

SNI -https://www.fieldexit.com/forum/display?threadid=439


Bradley V. Stone
www.bvstools.com
MAILTOOL Benefit #5<https://www.bvstools.com/mailtool.html>: Easy

setup!

No confusing or obscure setup instructions, directory entries, SMTP
users, aliases or host tables. All you need is TCPIP, a connection to
the internet and you're done!

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing

list

To post a message email: WEB400@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/web400.

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.