Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

The shared hosting company told me that if I buy an IP address then it will be applicable for the addon domains too. What does it mean? Then the SSL certificate won't work since there will be more than 2 domains in one IP (if I add an addon domain)? If the SSL certificate works with one IP where is hosted two different domains then why it does not work on a shared host?

share|improve this question

migrated from stackoverflow.com May 18 '11 at 0:59

This question came from our site for professional and enthusiast programmers.

    
No, it's not required. There are many hosting providers that allow SSL certificates on shared IP's. –  William D. Edwards Jul 28 at 19:31
    
Almost the same as my question, Does an SSL Certificate actually require a dedicated IP? –  Traven Jul 29 at 5:55

6 Answers 6

up vote 10 down vote accepted

NOTE: While this answer was accurate at the time it was written and accepted, it is no longer correct. There are other answers here that address SNI which allows multiple SSL certificates per IP address.


Yes, you need a dedicated IP address for your SSL certificate. The following article explains exactly why:

SSL certificates on Sites with Host Headers

The key paragraph is:

It's a chicken and egg problem: The host name is encrypted in the SSL blob that the client sends. Because the host name is part of the binding IIS needs the host name to lookup the right certificate. Without the host name IIS can't lookup the right site because the binding is incomplete. Without the certificate IIS can't decrypt the SSL blob that contains the host name. Game over - we are turning in circles.

There is a way to use SSL certificates with host headers on a shared IP address, but you still need to get that first IP address:

But there is a way if you need two different sites on the same IP:Port. You can accomplish this by getting a certificate that contains both common names, i.e. sitev1.mysite.com and sitev2.mysitem.com. Cert Authorities usually allow more than one so called "common names" in a certificate. By binding the certificate to one of the two sites you won't not get certificate errors anymore. The client is happy if one of the names in the certificate matches.

When your hoster says "then it will be applicable for the addon domains too.", what they mean is either you can you use:

share|improve this answer
2  
@ilhan this answer is no longer accurate. There are other answers here that address SNI which allows multiple ssl certs per IP. –  Mxx Aug 29 '13 at 22:13
    
Please update this answer to reflect the current situation. –  Lèse majesté Apr 24 at 7:53

RFC 4366 (Server Name Indication) permits virtual hosting for SSL and is pretty old and well supported nowadays

See http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI for a pretty in-depth explanation.

share|improve this answer
    
Do you have any data on current SNI support? –  Deebster Apr 23 '12 at 9:51
2  
This wiki article has more compatibility info for Server Name Indication support: en.wikipedia.org/wiki/Server_Name_Indication –  James McCormack Aug 9 '12 at 13:45

It depends on the server software. IIS 7 supports hosting multiple SSL enables sites on the same IP address.

share|improve this answer

There are several kinds of server SSL certificates including those that work for a single server, those that can be used for an entire domain of servers (so-called 'wildcard' certs) and those that work across multiple domains.

Be very careful which cert you buy as it will limit how you can scale.

FYI: Certificate authorities (the companies that issue certs) do not like to issue domain-wide or multi-domain certs as they view them as a loss of revenue. (Why issue 1 cert for an entire domain at $x when you can issue 5 certs for $5x?) but if you press themy, you can usually get them to issue you a domain-wide cert.

share|improve this answer

Hosting multiple SSL-enabled websites on single server usually needs single IP address per site, but SAN SSL Certificate can solve this difficulty. MS IIS 6 and Apache are both able to Virtual Host HTTPS sites using UC Certificate, also known as SAN certificates.

Using a SAN certificate saves you the hassle and time involved in configuring multiple IP addresses on your Exchange 2007 server, binding each IP address to a different certificate, and running a lot of low level Power Shell commands just to piece it all together.

Effortless and trouble-free to maintain than putting multiple IP addresses on your server and assigning a different certificate to each.

share|improve this answer

It means that all domain hosted by you will assign your IP. But you can restrict host to set IP only for specific domain. SSL certificate secured applied on domain but domain should be on dedicated IP. Some SSL certificate also can secure multiple domain like geotrust multidomain ev. On shared hosting there are multiple domain on same hosting so your IP also hosting some other client's domain. So it is not secure thats why it will not work.

share|improve this answer
    
There's no need to quote the question in the answer. –  ChrisF May 18 '11 at 11:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.