Is unique IP address a must for SSL?

Question

The shared hosting company told me that if I buy an IP address then it will be applicable for the addon domains too. What does it mean? Then the SSL certificate won't work since there will be more than 2 domains in one IP (if I add an addon domain)? If the SSL certificate works with one IP where is hosted two different domains then why it does not work on a shared host?

Answer 1

Yes, you need a dedicated IP address for your SSL certificate. The following article explains exactly why:

SSL certificates on Sites with Host Headers

The key paragraph is:

It's a chicken and egg problem: The host name is encrypted in the SSL blob that the client sends. Because the host name is part of the binding IIS needs the host name to lookup the right certificate. Without the host name IIS can't lookup the right site because the binding is incomplete. Without the certificate IIS can't decrypt the SSL blob that contains the host name. Game over - we are turning in circles.

There is a way to use SSL certificates with host headers on a shared IP address, but you still need to get that first IP address:

But there is a way if you need two different sites on the same IP:Port. You can accomplish this by getting a certificate that contains both common names, i.e. sitev1.mysite.com and sitev2.mysitem.com. Cert Authorities usually allow more than one so called "common names" in a certificate. By binding the certificate to one of the two sites you won't not get certificate errors anymore. The client is happy if one of the names in the certificate matches.

When your hoster says "then it will be applicable for the addon domains too.", what they mean is either you can you use:

• a wildcard SSL e.g. *.example.com then more than one site that is a host in example.com can share the IP address, for example www.example.com, webmail.example.com and so on.

• a Subject Alternative Names SSL that permits more than one domain to be secured using the same SSL, for example: http://www.globalsign.co.uk/ssl/buy-ssl-certificates/unified-communications-ssl/

Answer 2

RFC 4366 permits virtual hosting for SSL and is pretty old and well supported nowadays

See http://wiki.apache.org/httpd/NameBasedSSLVHostsWithSNI for a pretty in-depth explanation.

Answer 3

It depends on the server software. IIS 7 supports hosting multiple SSL enables sites on the same IP address.

Answer 4

There are several kinds of server SSL certificates including those that work for a single server, those that can be used for an entire domain of servers (so-called 'wildcard' certs) and those that work across multiple domains.

Be very careful which cert you buy as it will limit how you can scale.

FYI: Certificate authorities (the companies that issue certs) do not like to issue domain-wide or multi-domain certs as they view them as a loss of revenue. (Why issue 1 cert for an entire domain at $x when you can issue 5 certs for $5x?) but if you press themy, you can usually get them to issue you a domain-wide cert.

Answer 5

It means that all domain hosted by you will assign your IP. But you can restrict host to set IP only for specific domain. SSL certificate secured applied on domain but domain should be on dedicated IP. Some SSL certificate also can secure multiple domain like geotrust multidomain ev. On shared hosting there are multiple domain on same hosting so your IP also hosting some other client's domain. So it is not secure thats why it will not work.