Days are gone when we needed a dedicated IP for each website with SSL!

With Server Name Indication(SNI) extension of the Transport Layer Security protocol, it is now possible to use authentic SSL certificates for sites hosted on shared IP addresses. If you are on a Linux hosted environment, you could very well reap the benefit of the feature right away.

Key benefits

1. Reduces the cost of adding dedicated IP addresses
2. All domains can have their own SSL certificates installed

How it works!

We all know how SSL works. In normal SSL, when a user types “http” in a browser’s URL field, the encryption is provided by the Transport Layer Security (TLS) protocol. TLS uses a digitally signed certificate that includes the domain name of the site to ensure that the user connects to the correct site requested. Browsers like Internet Explorer, Mozilla, Opera, Google chrome generally accepts the certificate as “trusted” if it is signed by a trusted certification authority.

In the TLS start-up phase, the browser compares the user-entered domain part of the URI with the domain name found in the server’s certificate (CN or subjectAltName). If this comparison fails, a warning is received by the customer.

In TLS encryption, the server must select and send the certificate based on the destination IP address, before it reads the domain name in the HTTP request. Thus when in a virtual hosting environment, it presents the wrong certificate(usually default for the server) and causes the browser to warn the user of a mismatch in name.

An extension to TLS called Server Name Indication(SNI), addresses this issue by sending the name of the virtual domain as part of the TLS negotiation. This enables the server to “switch” to the correct virtual domain early and present the browser with the certificate containing the correct CN (Common Name).

Is it supported by all browsers?

Most browsers, including Internet Explorer 7 or later, Mozilla Firefox, Safari 2.1 or later, Opera 8.0 or later, Google Chrome etc. supports TLS SNI. The complete list can be viewed at http://en.wikipedia.org/wiki/Server_Name_Indication

Thus the success of choosing SNI, largely depends on the browsers used by your customer base.

How to implement this feature in my Hosting?

SNI support is included in Parallels Plesk Panel for Linux (versions 10.2 or higher) and allows using different SSL certificates for sites hosted on the same shared IP address. Cpanel is yet to implement this feature and developers are already working on it.

Which Operating system should I choose for this to work?

As per Parallels, this feature is available on the following operating systems:

OpenSuSE Linux 11.3 or later.
Ubuntu Linux 10.4 or later.
Debian Linux 6.0 or later.
RedHat Linux 6.0 or later.
CentOS 5.0 or later (only with Apache and OpenSSL supplied with Panel).

In the near future this will be an effective solution to save the cost on dedicated IP addresses and their availability.

About the author:
Sijin A. George works as Sr. Software Engineer at Bobcares.com. She has been with Bobcares for 6 years and specializes on Linux/Windows server administration. During her free time she loves to spend time with her daughter.

Edited by Sankar.H