Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

blog.benroux.me

Post reply on HN
Print view View original

51–60 of 76 posts

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#51

Post by skilgarriff »

_eht wrote: post #46
scrollaway wrote: post #32

Earlier quoted context omitted.

Also, plugging Caddy: https://caddyserver.com/ I used to be a huge fan of nginx and I haven't touched it in a year now. I don't miss it, Caddy is fantastic and handles the Let's Encrypt stuff for me.

Can anyone else speak to Caddy? My interest is peaked. I run several hundred thousand HTTP requests in a load balanced web cluster hourly, I'll do some reading, but has anyone else used it for high traffic?

Caddy is pretty awesome. I use it to run my personal website (love that it can serve statically compiled Brotli assets out of the box). I maintain it's docker image here: https://github.com/ZZROTDesign/alpine-caddy :) Should be incredibly simple to set up!

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#52

Post by ge96 »

phil21 wrote: post #28
WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

> You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that covers all the domains you use. Horrible idea depending on your use case. If you are single-tenant, this might work out well for you. If you are multi-tenant then the information leak is pretty nuts, and not something I can see any of my customers being alright wi…

Not sure if you'll see this or if it's directly related. I also domain map but on an Apache server, this is probably an excuse but while I realize Let's Encrypt is free, and although there is the 90-day thing that you could automate, I just go with the year-long $9.00 certificate for each domain. I was wondering though, since it's domain mapped, the root domain can bridge to other sites by subfolders eg.

/var/www/html/main-domain | https://mainsite.com

/var/www/html/main-domain/domain2 | https://somesite.com

/var/www/html/main-domain/domain3 | https://somesite2.com

My question I could just easily try it, I'm not sure if it's related to what you mentioned where if you switch domains while logged into one if you'll lose session. I don't expect it to work. I just don't know what happens if people figured out "hey this ip is hosting multiple sites" and could figure out how to traverse each subfolder-site.

My question sucks sorry. I'll have to try it out I guess, at least my stuff is for myself not dealing with other people's info/sites.

This quesiton is related to information leak. I handle the domain mapping with virtualhosts. I also realized when you switch from say non-www to www (I saw you should stick with one) but when you do that you'll lose the session value so I imagine I'm safe.

I actually just took down one site as it was a useless domain so I can't test the multiple ssl certificates at the moment. Yeap this question is a waste of time my bad.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#54

Post by gwu78 »

WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

"... setup and security and resource problems of SNI..."

As a user who really dislikes SNI, I would like to see someone write more about these problems.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#55

Post by zwetan »

"This means you cannot have multiple HTTPS sites hosted from the same IP address."

Is that some kind of joke?

Yes you can, unless you want to support very old browsers [0] which would defeat the whole purpose of using SSL/TLS in the first place.

Maybe have a look at Mozilla Security/Server Side TLS [1]

Also SSL certs are issued for FQDN, not IP addresses (unless the IP is public and owned but still it is considered deprecated now [2]).

[0]: https://blogs.msdn.microsoft.com/ieinternals/2009/12/07/unde...

[1]: https://wiki.mozilla.org/Security/Server_Side_TLS

[2]: https://www.digicert.com/internal-names.htm

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#56

Post by eicnix »

scrollaway wrote: post #32
WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Also, plugging Caddy: https://caddyserver.com/ I used to be a huge fan of nginx and I haven't touched it in a year now. I don't miss it, Caddy is fantastic and handles the Let's Encrypt stuff for me.

How does Caddy compare to nginx performance wise? I have a similar setup like you running on nginx.

For loadbalancers I mainly care about performance and not usability of the configuration language.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#57

Post by devwastaken »

scrollaway wrote: post #32
WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Also, plugging Caddy: https://caddyserver.com/ I used to be a huge fan of nginx and I haven't touched it in a year now. I don't miss it, Caddy is fantastic and handles the Let's Encrypt stuff for me.

I can never take caddy seriously until they get serious about updates and start working with linux packages.

When you have to do this: https://gist.github.com/Jamesits/2a1e2677ddba31fae62d022ef8a...

That means your webserver is not going to receive updates until you re-do this manually each time, which is dangerous and not at all something you should be using proffessionally.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#58

Post by Jaruzel »

zeta0134 wrote: post #44
smarinov wrote: post #25

Earlier quoted context omitted.

This is a solution if you don't care that anyone looking at the certificate would be able to directly see every single domain that you are hosting as part of your setup. Determined people would be still able to find it out, more or less, despite not having it handy in their web browser under the field for the certificate's Subject Alternative Name . However, there is nothing stopping you from issuing separate certifi…

I was under the impression that older clients wouldn't send the host header over HTTPS, making it impossible to determine the correct certificate to serve in a shared IP environment. Modern browsers all support SNI which prevents exactly this problem, but compromise by sending the hostname in plain text, which may be a privacy concern; this is something that's still up for debate: http://security.stackexchange.com/qu…

SNI doesn't work on Windows XP.

"Who still use Windows XP?" I hear you ask?

Just under 10% of all users[1]. Enough to make SNI problematic. In a few years time, we'll be OK, but not right now.

---

[1] https://www.netmarketshare.com/operating-system-market-share...

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#59

Post by mikeyjk »

cowholio4 wrote: post #49
mikeyjk wrote: post #35

Earlier quoted context omitted.

Even with AWSs load balancers? We are trying to solve this issue right now in house. Any recommendations/war stories/further reading would be greatly appreciated. Related forum post: https://forums.aws.amazon.com/message.jspa?messageID=520926

Yes! I do with NGINX using SNI (to server multiple ssl certs from the same IP) and using Proxy Protocol on the ELB to send the requests to NGINX. What you need to do is enable the proxy protocol on the ELB and then point to NGINX. http://docs.aws.amazon.com/elasticloadbalancing/latest/class... You need to also enable the proxy_protocol in nginx. server { listen 443 ssl proxy_protocol; ... } I'll write something up an…

That would be very kind, thank you. I'm not the particular dev who has been doing the research, but I might read his notes later to catch up to what he perceived as the pitfalls of using ELB with LetsEncrypt.

Re: Hosting Multiple HTTPS Domains from the Same Server with Let's Encrypt and Nginx

#60

Post by fenollp »

WildUtah wrote: post #18

Ugh. Let's Encrypt will issue you a single certificate for multiple domains on the same server. It's easy to set up, too. It's not just for multiple subdomains like sub1.example.com and sub2.exmaple.com. You can have any unrelated domains you want on the cert. You don't need multiple IPs and you don't even need SNI with its legacy client compatibility problems (now mostly well past). Just get a certificate that cover…

Exactly.

I made this for exactly this usage: https://github.com/fenollp/nginx_ssl_compose

Just create a folder in ~/www for each host. It's been working great for around a year. Only interruption was due to docker destroying my containers during the upgrade of docker-engine. Great software guys...

Post reply on HN