JOIN OUR AFFILIATE NETWORK

Join our affiliate network and become a local SSL expert

♦ learn more about our program ♦
Menu
picture of tbs certificates
picture of tbs certificates
Certificates
Our products range
Partners
Support
Focus


Install several SSL certificates on a same machine / IP : TLS SNI

Is it possible to configure several X509 / SSL certificates on a same server with a unique IP? The answer is yes, thanks to SNI (Server Name Indication). But this protocol can cause compatibility issues and is not always accepted on old browsers depending on several things:
  • Your websites are subdomains of a main domain (*.domain.com)
    Use a Wildcard certificate

  • Your websites have miscellaneous names and you only have one IP address
    Use a Multiple Sites certificates (SSL SAN)

  • Your websites have miscellaneous names and you have several IP addresses
    Use one server certificate for each IP.

Warning: An "IP address/port number" couple can generally hold only one certificate (except with TLS SNI, see below). Indeed the SSL negotiation takes place before the HTTP headers are sent that allow to detect which server is solicited (on multihosting servers with one IP address).

TLS Server Name Indication (SNI)

The RFC 4366 created a "server name indication" (SNI) extention that is used to specify which server to solicite during the SSL connection with the client (the web browser). The server will then present the good certificate.

Browsers and servers have to implement this extention now.

Here is the mid-2011 situation:

  • Compatible browsers:
    • Internet Explorer 7+ (but IE under XP -no matter the version- does not work, and there are issues with other versions)
    • Firefox 2+
    • Opera 8+
    • Chrome
    • Safari 3.2.1+ under Mac OS X 10.5.6+
    • Safari under Vista or Seven
    • MobileSafari under iOS 4.0+
    • WindowsPhone 7
    • Android 3+
  • Compatible servers:
  •  Incompatible browsers:
    • Internet Explorer under XP
    • Safari under XP
    • Blackberry
    • Java 6
    • Android 2.3
    • Windows Mobile (works from version 7)
  •  Incompatibles servers:
    • Microsoft IIS before version 8

Examples of SNI implementation

Further information

External links