I've been trying to do this for a couple of weeks. I have no idea what I'm doing and it's been hard to find any help via google. But I finished it last friday. Without multiple external IP addresses. Funny to see this as the top story when I woke up today. But yes, as caleblloyd says, it's 2017. Use SNI. It's not hard, I'd never even heard of nginx or letsencrypt before I started my project.
Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
21–30 of 76 posts
Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
#22This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni
(author here) I would have loved to have SNI work. I wrote this article in response to having profound struggles making it work. My iPhone 7's Safari was routinely failing to connect to sites other browsers claimed were fine, when relying on SNI. The day i swapped over to IP-based connections, the problem resolved itself immediately. If there is something i am missing i would love to know what it is.
Never had any SNI issues with Safari. Could it be the mobile network provider (which tends to insert things like NATed IPv6 that can cause weirdness), or did it also fail over wifi?
Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
#23This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni
Unfortunately for our ecommerce site this just isn't the at all an option. 3 months ago we analysed our traffic and found that 12% of our desktop traffic didn't support it (Win XP) and about 8% of our mobile traffic didn't support it (Android older than 4.0). I'm not losing 10% of my revenue just so I don't need to get a couple extra IPs from AWS. And even better, AWS doesn't actually charge me for the IPs. Once IPs are priced in line with their scarcity, I'll start caring. Today when I can get them for free? Not worth it.
Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
#24Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…
Indeed this is what a SAN cert does. From Letsencrypt's FAQ:
"Can I get a certificate for multiple domain names (SAN certificates or UCC certificates)?
Yes, the same certificate can contain several different names using the Subject Alternative Name (SAN) mechanism.
Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
#25Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…
This is a solution if you don't care that anyone looking at the certificate would be able to directly see every single domain that you are hosting as part of your setup.
Determined people would be still able to find it out, more or less, despite not having it handy in their web browser under the field for the certificate's Subject Alternative Name. However, there is nothing stopping you from issuing separate certificates for each domain (possibly with subdomains) and configuring your webserver appropriately with SNI.
I have been using precisely Nginx to serve multiple HTTPS domains with certificates from Let's Encrypt since the first few weeks after it came out, so I am not sure why OP thinks it's strictly necessary to assign them separate IP addresses. Generally speaking, there is nothing wrong with that, and it is indeed a somewhat cleaner solution, if it wasn't for the IPv4 examples, oh my...
Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
#26This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni
(author here) I would have loved to have SNI work. I wrote this article in response to having profound struggles making it work. My iPhone 7's Safari was routinely failing to connect to sites other browsers claimed were fine, when relying on SNI. The day i swapped over to IP-based connections, the problem resolved itself immediately. If there is something i am missing i would love to know what it is.
I have been using precisely Nginx to serve multiple HTTPS domains with certificates from Let's Encrypt since the first few weeks after it came out, so I am not sure why you think it's strictly necessary to assign them separate IP addresses. Generally speaking, there is nothing wrong with that, and it is indeed a somewhat cleaner solution, but it is definitely doable with SNI if one configures their web server appropriately.
Check out the IMHO best TLS SNI test website out there (https://sni.velox.ch/) and the Qualys SSL Labs server test (https://www.ssllabs.com/ssltest/). They may give you a staring point to find out what exactly went wrong with SNI. And the documentation of Nginx, of course.
Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
#27Earlier quoted context omitted.
It must have been something else. Even Safari on iOS has supported SNI since iOS 4.0 (2010).
The only thing I've had SNI fail under (so far) had been Netscape Navigator 3.0 and at that point, does it really matter?
IE on Win XP. Or at least anything using the built in crypto stuff. I think firefox will still use it's own. Not sure about chrome.
Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
#28Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…
> You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that covers all the domains you use.
Horrible idea depending on your use case. If you are single-tenant, this might work out well for you.
If you are multi-tenant then the information leak is pretty nuts, and not something I can see any of my customers being alright with. That and the whole idea of giving the public access to my customer list is pretty silly to me.
Additionally in many environments the end-user can potentially access the private key on the server (think managed services environments) which is an obvious security hole. You'd think people would realize this, but in my experience they do not. In such cases you just let the private key walk out the door for every domain ever configured for that SSL certificate.
Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
#29The only clients I've had trouble with SNI is Amazon and Apple's Java clients, as well as python2. It's unfortunately still not possible to host a podcast feed with an SNI HTTPS URL in iTunes, nor can you use SNI for Alexa skills. Otherwise, I've been happily using SNI for years now.
Interesting, those two are very surprising to have issues. Got anything about the alexa skill one?
Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx
#30This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni
Plenty of reason to not use SNI. First off - not everything is a web browser. While browser support for SNI is pretty good these days, other clients are far behind. That random app that connects to your web API has to also support SNI, which means some old PHP library somewhere has to as well. Good luck.
That and a surprising number of "regular" clients still seem to have issues with SNI. My numbers are quite dated, but even as recent as 3 years ago it was something like dropping 10% of traffic for a high traffic site I did A/B testing with. I'm guessing the number was even higher, but the client requested we immediately stop the test once it became apparent it was a major reachability issue affecting revenue.