Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

blog.benroux.me

Post reply on HN
Print view View original

41–50 of 76 posts

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#41

Post by mozumder »

WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

You don't want to do this, as it's a privacy violation. It will let attackers know all the names of all the other websites you are serving, just by looking at one of those website.

Do you want people to know that your server for www.donaldtrumpisgreat.com/www.hillaryclintonisgreat.com is also serving your company's homepage?

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#42

Post by schoen »

rnhmjoj wrote: post #40
schoen wrote: post #36

Earlier quoted context omitted.

Wow, is their nginx support portable to other OSes? Do you know who has implemented it?

NixOS modules are built around Nix and systemd so theoretically you could write a port for a different GNU/Linux distribution if you have those available. I'm not aware of any though. There is however a variant for Darwin based on launchd: https://github.com/LnL7/nix-darwin You can find the implementation of the nginx service here: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/s...

Thanks, I'd like the people working on nginx integration for certbot to see this!

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#43

Post by [deleted] »

schoen wrote: post #38
laumars wrote: post #33

Earlier quoted context omitted.

If you're having to support devices that old then I'd be more worried about how you're going to take payment details on your e-commerce website over a "secure" connection that would fail most PCI DSS vulnerability scans. The security of TLS has come a long long way since XP and so has research into breaking XP-era ciphers.

Deprecation of old stuff is going incredibly slowly even in rich countries (to the intense frustration of a lot of security teams). Check out the incredible true story, told over years on cabfpub, of the attempt to get rid of SHA-1 in TLS authentication. Notably, the attacks that led to experts' recommendation to move away from SHA-1 immediately were published back in 2005. Meanwhile, Microsoft's "effective date of t…

[deleted]

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#44

Post by zeta0134 »

smarinov wrote: post #25
WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

This is a solution if you don't care that anyone looking at the certificate would be able to directly see every single domain that you are hosting as part of your setup. Determined people would be still able to find it out, more or less, despite not having it handy in their web browser under the field for the certificate's Subject Alternative Name . However, there is nothing stopping you from issuing separate certifi…

I was under the impression that older clients wouldn't send the host header over HTTPS, making it impossible to determine the correct certificate to serve in a shared IP environment. Modern browsers all support SNI which prevents exactly this problem, but compromise by sending the hostname in plain text, which may be a privacy concern; this is something that's still up for debate: http://security.stackexchange.com/questions/86723/why-do-htt...

EDIT: I'm not sure what I was reading or who I was responding to. You mentioned this directly in your comment. Ignore my blathering, I'm tired. :)

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#45

Post by Buge »

zeta0134 wrote: post #44
smarinov wrote: post #25

Earlier quoted context omitted.

This is a solution if you don't care that anyone looking at the certificate would be able to directly see every single domain that you are hosting as part of your setup. Determined people would be still able to find it out, more or less, despite not having it handy in their web browser under the field for the certificate's Subject Alternative Name . However, there is nothing stopping you from issuing separate certifi…

I was under the impression that older clients wouldn't send the host header over HTTPS, making it impossible to determine the correct certificate to serve in a shared IP environment. Modern browsers all support SNI which prevents exactly this problem, but compromise by sending the hostname in plain text, which may be a privacy concern; this is something that's still up for debate: http://security.stackexchange.com/qu…

They all send host headers over HTTPS (unless it's http2, because the protocol is different). But the host headers don't get sent until after the encrypted transport is fully setup. And to set up the encrypted transport, the server needs to send a certificate. So the server needs to send the certificate before it sees the host header. That's what SNI helps.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#46

Post by _eht »

scrollaway wrote: post #32
WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Also, plugging Caddy: https://caddyserver.com/ I used to be a huge fan of nginx and I haven't touched it in a year now. I don't miss it, Caddy is fantastic and handles the Let's Encrypt stuff for me.

Can anyone else speak to Caddy? My interest is peaked. I run several hundred thousand HTTP requests in a load balanced web cluster hourly, I'll do some reading, but has anyone else used it for high traffic?

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#47

Post by profmonocle »

wnevets wrote: post #15
caleblloyd wrote: post #2

This article advocates for IP Per Domain over SNI. It's 2017, please use SNI. There's not enough IPv4 addresses in the world. Every single major browser supports it, and has supported it for some time: http://caniuse.com/#search=sni

That is if you don't care about supporting windows xp users, I certainly don't.

And it's not just XP, it's IE on XP, meaning IE 8 or older. SNI works on the most recent Firefox & Chrome for XP.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#48

Post by teach »

_eht wrote: post #46
scrollaway wrote: post #32

Earlier quoted context omitted.

Also, plugging Caddy: https://caddyserver.com/ I used to be a huge fan of nginx and I haven't touched it in a year now. I don't miss it, Caddy is fantastic and handles the Let's Encrypt stuff for me.

Can anyone else speak to Caddy? My interest is peaked. I run several hundred thousand HTTP requests in a load balanced web cluster hourly, I'll do some reading, but has anyone else used it for high traffic?

I don't know anything about Caddy but for some reason I feel compelled to tell you that it's "piqued", not "peaked".

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#49

Post by cowholio4 »

mikeyjk wrote: post #35
WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Even with AWSs load balancers? We are trying to solve this issue right now in house. Any recommendations/war stories/further reading would be greatly appreciated. Related forum post: https://forums.aws.amazon.com/message.jspa?messageID=520926

Yes! I do with NGINX using SNI (to server multiple ssl certs from the same IP) and using Proxy Protocol on the ELB to send the requests to NGINX.

What you need to do is enable the proxy protocol on the ELB and then point to NGINX. http://docs.aws.amazon.com/elasticloadbalancing/latest/class...

You need to also enable the proxy_protocol in nginx.

  server {
    listen    443 ssl proxy_protocol;
    ...
  }
I'll write something up and share it. But hopefully this will help you in the short term.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#50

Post by [deleted] »

mikeyjk wrote: post #35
WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Even with AWSs load balancers? We are trying to solve this issue right now in house. Any recommendations/war stories/further reading would be greatly appreciated. Related forum post: https://forums.aws.amazon.com/message.jspa?messageID=520926

[deleted]
Post reply on HN